Governance & compliance

From requirements to accountable action.

Someone named a framework at you. Reading it is the easy part. Getting each requirement onto a named person, with proof attached, a date on the proof and the gap tracked as work — that is the part spreadsheets quietly stop doing after about six weeks.

Start your 14-day free trial Compare the frameworks

No credit card required

Sentinel Frameworks page with three activated frameworks averaging 78% readiness, and NIST CSF 2.0 and CIS Controls v8.1 available to activate.

Sentinel ISO/IEC 27001:2022 framework card scoring 80 out of 100, rated Excellent.

Screens captured from a Sentinel workspace on 10 September 2026. Northstar Manufacturing Ltd. is a fictional example — a 180-person manufacturer in Ontario, Canada — not a customer, and its scores are computed by the product from its records rather than typed in for the picture.

The chain

Eight links, and a programme fails at whichever one is missing.

Read this as a sequence rather than a feature list. Each row consumes what the row above it produced, which is why an unowned control cannot be evidenced and an unevidenced control cannot be reported honestly.

01
Requirement
The framework arrives as records you put in scope — 42 controls for ISO/IEC 27001:2022 in Sentinel’s readiness profile — not a PDF you annotate.
02
Control
Each requirement becomes a control with a plain description of how it works here. One control usually satisfies several frameworks, which is why the example workspace runs 3 frameworks against 26 controls.
03
Owner
A person’s name, not a team and not “IT”. 2 controls in the example workspace are still unassigned, and the register reports that as a gap rather than averaging it away.
04
Evidence
Proof attached once, carrying a status and an expiry date. 41 of 46 items accepted and verified; the expired penetration test and the missing restore test are visible before an auditor makes them visible for you.
05
Gap
Missing, expired, deficient and unowned are states, not blanks. 2 deficient controls and 1 open finding — a list, not a percentage, because a percentage invites an argument and a list invites work.
06
Risk
Where a gap has consequence it is rated likelihood by severity, given a treatment and a target date. 7 open risks in the example register, 1 critical.
07
Action
Work with an owner and a due date, bucketed by horizon — Critical Now, Next 30 Days, Next Quarter, Quick Wins, Strategic Projects. 2 critical now and 0 overdue is a sentence somebody can act on this week.
08
Report
One readiness view for the executive team, one package for the auditor, one answer for the customer’s security review — generated from the register, with every figure openable to the record it came from.

A control nobody owns is a sentence in a standard.

Certification is an outcome that somebody else awards. Accountability is a property of your register — a name on every control, a date on every piece of proof, and a gap that belongs to somebody. One of those two things you can build this quarter.

In the product

Every requirement lands on a person, with a status.

Open a framework and you are looking at its controls, each with a status — Completed, In progress, Ready for review, Not started — an owner, a due date and the evidence attached. Open a control and you get the plain-English explanation, why it matters, and how to implement it.

The control library underneath keeps its own tabs — Control Library, Framework Readiness, Test Schedule, Test History, Findings — so the test schedule and the findings are part of the register, not a separate spreadsheet. 85% of the example workspace’s controls have been tested; 2 came back deficient.

See the whole platform

Control library

26 controls

Control	Owner	Status	Evidence	Last tested
A.5.1Policies for information security	Priya Raman	Passed	Accepted	28 Jul 2026
A.5.18Access rights	Priya Raman	Passed	Accepted	26 Jun 2026
A.8.5Secure authentication	Priya Raman	Passed	Accepted	14 Aug 2026
A.8.13Information backup	Jordan Blake	Passed	Accepted	18 Jun 2026
A.8.2Privileged access rights	Priya Raman	Failed	Needs Review	20 Aug 2026
A.8.7Protection against malware	Jordan Blake	Tested	Accepted	28 Aug 2026
CC9.2Vendor and business partner risk management	Elena Kowalski	Failed	Accepted	12 Aug 2026
PR.AA-01Identities and credentials are managed	Unassigned	Not Tested	Missing	—

A.5.1Policies for information security
Owner
Priya Raman
Status
Passed
Evidence
Accepted
Last tested
28 Jul 2026
A.5.18Access rights
Owner
Priya Raman
Status
Passed
Evidence
Accepted
Last tested
26 Jun 2026
A.8.5Secure authentication
Owner
Priya Raman
Status
Passed
Evidence
Accepted
Last tested
14 Aug 2026
+ 5 more in the workspace

Sentinel ISO/IEC 27001:2022 drawer scoring 80 out of 100, On Track, listing each clause and control with its status. — ISO/IEC 27001:2022 in the example workspace: 42 controls, 17 gaps, 80/100 On Track.

Evidence

Proof with a status and an expiry date.

89% audit readiness in the example workspace: 41 items accepted, 2 awaiting review, 1 expired, 1 missing. Attach a file once with its expiry date, and a lapsed item is flagged in the list before an auditor finds it.

Sentinel Audit Evidence page showing 89% audit readiness, 41 accepted, 1 missing and 1 expired, above the evidence register.

How evidence works Evidence for access reviews

Framework selection

Choose the one your buyer named. If nobody named one, choose the smallest.

Framework choice is usually made for you — a contract, an insurer, a regulator, the market you sell into. Where it is genuinely open, the useful question is not which standard is most rigorous. It is which one you can sustain for three years.

Criterion	ISO/IEC 27001:2022	SOC 2 (Trust Services Criteria)	NIST CSF 2.0	CIS Controls v8.1
What it is	A management system standard with Annex A controls. The one most often written into a contract.	An attestation over trust services criteria, performed by a service auditor.	A voluntary framework organised by function: Govern, Identify, Protect, Detect, Respond, Recover.	A prioritised set of safeguards, grouped by implementation group.
Usually named by	Enterprise customers and procurement, especially outside North America.	North American SaaS buyers and their security teams.	Boards, insurers and anyone who wants maturity without a certificate.	Nobody — which is exactly why it is a good first scope.
In Sentinel’s catalogue	42 controls	45 criteria	59 subcategories	56 safeguards
Example workspace	80% ready · On Track	71% ready · In Progress	Available — not yet activated	Available — not yet activated
Readiness mapping	ISO 27001 mapping	SOC 2 mapping	NIST CSF mapping	CIS Controls mapping

ISO/IEC 27001:2022

What it is: A management system standard with Annex A controls. The one most often written into a contract.
Usually named by: Enterprise customers and procurement, especially outside North America.
In Sentinel’s catalogue: 42 controls
Example workspace: 80% ready · On Track
Readiness mapping: ISO 27001 mapping

SOC 2 (Trust Services Criteria)

What it is: An attestation over trust services criteria, performed by a service auditor.
Usually named by: North American SaaS buyers and their security teams.
In Sentinel’s catalogue: 45 criteria
Example workspace: 71% ready · In Progress
Readiness mapping: SOC 2 mapping

Essentials keeps one framework in scope, which is the right shape for a first programme. Full Platform keeps multiple frameworks against the same control set, so a control that satisfies two standards is maintained once and evidenced once. Compare plans

Sentinel supports readiness, governance, assessment, evidence organisation and control management. CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace independent auditors, certification bodies or legal counsel. Framework references are informational readiness mappings.

Risk and action

A gap nobody owns is a note, not a finding.

The output of a review is not a percentage. It is a rated risk with a treatment and a target date, and an action with a name and a due date. 12 risks in the example register — 7 open, 1 critical, 2 high — and 13 open actions across the product’s five horizons.

Sentinel risk register table giving each risk a rating, status, treatment, owner and target date, including an open critical ransomware risk.

See risk and actions

Reporting

Where are we, what changed, what needs a decision.

In the example workspace readiness sits in the product’s own “Expected” band, with one critical risk open. The governance summary reads the same register for the executive team: framework readiness, control implementation, policy completion, and the open controls that matter most.

See executive reporting

Sentinel governance summary showing ISO/IEC 27001:2022 at 80%, control implementation 69% and policy completion 71%, above seven controls marked High or Critical.

Straight answers

What this does not do.

No certification, and no audit opinion — those come from an accredited certification body and an independent auditor
No fabricated baseline: a new workspace reads “Not assessed” until somebody assesses it
Framework references are readiness mappings, not a conformity assessment
AI drafts and summarises; it does not decide, and its output is marked for review before it is relied on

Questions

What people ask before they start.

The buying questions, answered plainly.

Which framework should we start with?

Whichever one your customer, insurer or regulator named. If nobody has named one, CIS Controls v8.1 is usually the least painful start for a small team — 56 safeguards organised by implementation group, and the first group is achievable. Moving to ISO 27001 or SOC 2 later reuses most of the same controls and evidence.

Can we run more than one framework at the same time?

Essentials keeps one framework in scope. Full Platform keeps multiple frameworks against the same control set — a control that satisfies two frameworks is maintained once and evidenced once. The example workspace runs ISO/IEC 27001:2022, SOC 2, Cyber Insurance Readiness against 26 controls.

Does CyberWave certify us, or issue an audit opinion?

No. Certification comes from an accredited certification body and an audit opinion comes from an independent auditor. Sentinel organises the readiness work those parties will examine.

Our auditor works in their own portal. Does that cause a problem?

No. The audit engagement workspace is where scope, control testing status, findings and management responses are tracked on your side. What goes into the auditor’s own system is whatever they ask for, exported from Sentinel: the evidence inventory with statuses and dates, registers as CSV, and reports as PDF or Word.

How long does readiness actually take?

It depends on how much already exists and how quickly owners respond. What is predictable is the shape: scope and mapping move fast, evidence collection is the long pole, and the second quarter is where programmes without named owners stop moving.

What does it cost to run this?

Essentials is $99/month with 2 included users. Full Platform is $249/month with 5. Both have a no-card trial, and the annual figures are on the pricing page.

Start with one framework and one owner.

A scope you can defend, controls with names against them, and evidence that carries a date. Everything else in a compliance programme is downstream of those three things.

Start your 14-day free trial