Every control, continuously mapped to every framework.

The app keeps the two apart. Control objectives are the reusable templates, and the Control catalogue holds your instances per business unit (ControlObjectives, ControlCatalogue).

• 01Objectives are authored or imported once and reused.
• 02The catalogue is what your business units actually operate.

Five control baselines seed you on day one so you are not starting from an empty catalogue (control_baselines).

• 01NIST 800-53 Rev. 5 comes as a Moderate starter set.
• 02CIS Controls v8 comes as Implementation Group 1.
• 03FFIEC IT Examination comes as a core control set.
• 04The Cyber Hub maps cybersecurity objectives to the FFIEC Information Security booklet, NIST CSF 2.0, the CRI Profile, GLBA, NCUA Part 748, and ISO/IEC 27001.
• 05The AI and Model Risk Hub maps model risk and AI governance objectives to SR 26-2 for models and to ISO/IEC 42001, the NIST AI RMF, the Financial Services AI RMF, and state AI laws.

Coverage is scored per framework from the mapping, so you always know what a given exam or standard actually covers.

• 01Coverage is computed from the mapping instead of self-attested.

Owner attestations are first-class objects, each tied to the control and the citation it satisfies (control_attestation).

• 01Attestations sign off on a cadence and satisfy the period.
• 02Certification campaigns drive periodic attestation across the catalogue.

An automated test checks a control on a cadence through a connection your institution already has. Checks cover MFA and two-factor enforcement, device compliance, vulnerability remediation, endpoint protection, cloud configuration, and backups, across identity providers, Microsoft 365, the security evidence tools, and AWS.

• 01A test can be added only on a connection whose provider can answer its check.
• 02A check that cannot be read records an error, never a pass.

Evidence is captured against the control, and when something changes, drift is detected and routed for re-test (control_evidence).

• 01Evidence is a first-class object instead of a spreadsheet column.
• 02Drift is detected and a re-test is proposed. A person confirms the outcome.

With the Zovos Evidence Protocol, your team can run a control test using their own AI assistant (Claude, Copilot, Cursor, or ChatGPT) against your own systems. They then submit the result and raw evidence to Zovos, where it lands pending human review in External test review, the reviewer inbox in the Library group of the sidebar. Zovos publishes the procedure, the schema, and the tools, and never receives your system credentials.

• 01The tester of record is the verified person who signs in. The assistant is recorded as UNVERIFIED and is never an authorization signal.
• 02Nothing changes a rating until a different person accepts it in External test review. A failed test opens a draft finding, and 5% of submissions are randomly re-tested by default.
• 03Raw tool output is required as evidence. A credential, PII, and SAR classifier refuses secrets before they are ever stored.