Pillar 01 — The Compliance Operating System

Pillar 01 of the CISO Marketplace AI Security Department, built DIY. The managed compliance pillar is the done-for-you version; this is the operating system behind it.

Compliance in 2026 is not a binder you produce once a year. It is a continuous, evidence-based operating system that maps your controls across every framework you owe, collects evidence tied to each control, and stays audit-ready — built from your registry, not a platform's integrations.

Map controls once. Satisfy every framework. The most expensive mistake in compliance is organising the work by framework — every new one becomes a fresh checklist and a fresh evidence hunt. Organise by control, mapped over one registry of what you actually have, and each new framework is mostly a re-mapping of evidence you already collected. One control — "access to production requires MFA and is reviewed quarterly" — satisfies a SOC 2 criterion, an ISO 27001 Annex A control, a HIPAA safeguard and a PCI requirement simultaneously. Five controls, five pieces of evidence, twenty requirements satisfied.

The two gaps the automation platforms structurally leave. Vanta, Drata and Secureframe made SOC 2 attainable without a compliance team, and if the budget fits you should use one. But platform evidence is only as complete as its integrations — shadow SaaS, OAuth grants and unmanaged accounts fall outside it, so the platform governs only the subset of your environment it has been told about. And a readiness dashboard can read 98% while the auditor's fieldwork disagrees, because completion percentage is not evidence quality. The registry-driven answer is to start from a deliberate inventory of everything that exists rather than whatever the integrations happen to see, and keep a human in the attest step.

Every framework, including the 2026 AI-governance layer. SOC 2 Type I and II, ISO 27001, HIPAA, PCI DSS v4.0.1, CMMC 2.0, DORA, NIS2 — plus ISO 42001 and the EU AI Act, whose high-risk obligations went live on 2 August 2026. Most compliance guides written even a year ago have neither. If you develop or deploy AI, which now includes most software companies, that layer is no longer optional — and being early on it shortens the AI section of every security questionnaire. Compliance done early is a sales asset.

Four steps from registry to audit-ready. Start from the registry, inventorying every asset, system, data flow and AI integration including the shadow SaaS. Map controls once, one row per control and one column per framework. Collect config, operating and population-sample evidence designed into the control's routine, so operating evidence exists across the whole period rather than being reconstructed the week before fieldwork. Then monitor for drift and attest — with a human confirming that green means auditor-defensible.

Not a substitute for an auditor, and crisp about that line. This gets you audit-ready; an independent auditor issues the SOC 2 opinion or the ISO certificate. Build the registry, controls, evidence and attestation an auditor will examine, and fieldwork becomes confirmation rather than discovery.

Includes the control register schema and cross-framework mapping worksheet, the evidence matrix and pre-audit readiness checklist, and an ISO 42001 / EU AI Act starter set. Practitioner-led with multi-client notes throughout for anyone running compliance across a portfolio. Data current as of September 2026 and cited.

This is the stream that feeds the hub: build the control register here and it plugs straight into Pillar 06, where compliance stops being a silo and becomes a feed into the board's risk register.