Evidence-first compliance. Frameworks are the output, not the input.
AssurIQ evaluates reusable technical and administrative controls with real evidence, then maps that proof into each applicable framework requirement. One control, one piece of evidence, every framework it satisfies — and a clear view of what is still unproven.
| Control | State | Confidence | Latest evidence |
|---|---|---|---|
AIQ-IAM-002 MFA enforced for privileged cloud identities | Fail | 96 | Identity connector · 2h ago |
AIQ-NET-011 Internet-facing services free of known-exploited CVEs | Fail | 98 | Collector scan · 40m ago |
AIQ-END-004 Endpoints run supported operating systems | Partial | 88 | Asset inventory · 1h ago |
AIQ-BCK-001 Backups tested for restore within policy window | Evidence Gap | — | No evidence attached |
AIQ-NET-003 Guest / IoT traffic segmented from corporate VLANs | Pass | 92 | Topology snapshot · 40m ago |
AIQ-VND-002 Service providers assessed on schedule | Exception | 70 | Approved exception · expires in 41d |
AIQ-PCI-007 Cardholder data environment scoped | N/A | 100 | Scoping decision · documented |
Checklists ask if you did something. Evidence shows that you did — and still do.
Framework-first tools create a copy of every requirement per framework and ask you to attest to each. That multiplies the work and decays the moment someone changes a firewall rule. AssurIQ inverts it: controls are evaluated continuously, and frameworks read from the control results.
- · Same MFA question answered five times across five frameworks
- · Attestations and screenshots collected before the audit
- · Red / green only; missing proof looks like failure
- · Nothing re-checks between assessments
- · One universal control evaluated once, mapped everywhere
- · Evidence collected from available collectors and connectors
- · Six states — Evidence Gap is visibly not Fail
- · Fresh evidence can change control state and inform remediation
One control result, many framework requirements.
High-level, original AssurIQ mappings — not reproductions of standard text. Mappings are versioned so they can follow framework revisions.
| Universal control | Satisfies (illustrative) |
|---|---|
| AIQ-IAM-002 · MFA for privileged identities | FTC Safeguards · access controls / MFAHIPAA · access control & authenticationNIST CSF 2.0 · PR.AAInsurance · MFA for admins |
| AIQ-NET-003 · IoT / guest segmentation | FTC Safeguards · risk assessment & safeguardsHIPAA · technical safeguards (network)NIST CSF 2.0 · PR.IRCMMC readiness · boundary protection family |
| AIQ-BCK-001 · Tested restores | HIPAA · contingency planNIST CSF 2.0 · RC.RPInsurance · offline / tested backupsFTC Safeguards · secure disposal & availability |
Packs available today and on the roadmap.
AssurIQ Security Baseline
FTC Safeguards
HIPAA Security
NIST CSF 2.0
Cyber Insurance Baseline
CMMC / NIST 800-171
The architecture supports versioned additions such as PCI readiness, SOC 2 readiness and ISO-aligned mappings. Roadmap items are labelled as roadmap inside the product as well.
Framework, control and evidence views that drill all the way down.
Every percentage on Compliance Home is clickable. Behind it is the control, behind the control is the evidence, behind the evidence is the asset and the collector or connector that observed it.
- Compliance Home: readiness per framework with evidence gaps and expiring exceptions
- Framework view: each requirement with the controls that satisfy it
- Control detail: state, confidence, evidence timeline, affected assets and open remediation
| Control | State | Confidence | Latest evidence |
|---|---|---|---|
AIQ-IAM-002 MFA enforced for privileged cloud identities | Fail | 96 | Identity connector · 2h ago |
AIQ-NET-011 Internet-facing services free of known-exploited CVEs | Fail | 98 | Collector scan · 40m ago |
AIQ-END-004 Endpoints run supported operating systems | Partial | 88 | Asset inventory · 1h ago |
AIQ-BCK-001 Backups tested for restore within policy window | Evidence Gap | — | No evidence attached |
AIQ-NET-003 Guest / IoT traffic segmented from corporate VLANs | Pass | 92 | Topology snapshot · 40m ago |
Readiness reports assessors can actually use.
Report Studio produces executive briefs, framework readiness reports and assessor packs from the same control results — so the numbers in the board pack and the numbers the auditor sees never disagree.
- Point-in-time snapshots with evidence attached
- What changed since the last report
- Scoped, expiring auditor access instead of shared folders
- Evidence gaps reduced 14 → 6; backup restore proof still open
- Privileged MFA moved PARTIAL → PASS and held for 61 days
- 1 approved exception expires in 41 days
- Collector coverage 97% of known subnets
Policies, vendors and people are controls too.
Policies
Vendors & service providers
Risk Register
AssurIQ provides continuous assurance, readiness, evidence, risk and remediation support. It does not certify an organization as compliant, a passing dashboard is not a legal determination, and AssurIQ does not make breach-notification decisions. Framework mappings use original AssurIQ summaries, not reproduced standard text.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.