Compliance: Method & Machine

Pillar 01 tells you to map controls once. This is the database that does it, the clock that keeps it honest, and the agent layer that operates it.

Pillar 01 — The Compliance Operating System. Map controls once and satisfy many frameworks, driven from a registry rather than a platform's integrations. Four steps from registry to audit-ready, the two gaps the automation platforms structurally leave, and the ISO 42001 / EU AI Act layer most guides still omit.

Pillar 01 Companion — The Living ISMS. The build: a five-plane control graph, evidence that ages out on its own as a database view rather than a cron job, eleven single-purpose prompts with JSON Schemas your code can validate against, and an MCP surface that lets other agents ask your compliance system what is true. Forty pages plus the schema, the prompt library and the fillable P0 constitution template.

Why the pair. The two overlap deliberately at the control-mapping seam. The pillar argues why to organize by control rather than by framework and hands you the mapping worksheet; the companion hands you the database that worksheet is a flattened view of, plus the parts a worksheet structurally cannot do — a freshness clock, a state model that degrades honestly, and a place for privacy obligations to live. Read the method, then build the system that runs it.

The managed compliance pillar runs all of it for you if you would rather.