FRAMEWORKS
One record. Every framework reads from it.
Frameworks are data in Lore, not separate products. Each one is a versioned crosswalk from its requirements onto the same enforcement-derived controls. Add a framework and the evidence you already have is re-read against it. Nothing is re-collected, and a gap is reported as a gap.
EVIDENCE COLLECTED ONCE · READ BY EVERY FRAMEWORK
Controls come from enforcement
The 15-control registry is derived from things the platform already does to operate safely: gates, approvals, verification, signing. Evidence is a by-product of running, not a screenshot exercise.
Frameworks are versioned data
Each framework is a crosswalk file that maps its requirements onto the control registry. When a regulation changes, the crosswalk gets a new version and the old one stays available for past audits.
Gaps stay gaps
If a requirement has no evidence behind it, the report says so. A signed bundle can be verified offline by your auditor and reports VALID, TAMPERED, or INVALID. Nothing is rounded up to a pass.
01. CATALOG
25 frameworks.
SECURITY
SOC2
SOC 2
Trust Services Criteria CC1 through CC9 mapped onto the 15-control registry. The first crosswalk we shipped.
LEARN MORE →
SECURITY
27001
ISO 27001
Annex A controls for an information security management system, mapped for customers selling outside the US.
LEARN MORE →
SECURITY
CSF
NIST CSF 2.0
Govern, Identify, Protect, Detect, Respond, Recover. Mapped at the subcategory level.
LEARN MORE →
SECURITY
PCI
PCI DSS 4.0
Cardholder data controls for teams whose agents touch payment flows.
LEARN MORE →
SECURITY
NIS2
NIS 2
EU essential and important entity obligations, including incident reporting timelines.
LEARN MORE →
SECURITY
CRA
Cyber Resilience Act
EU security-by-design and vulnerability-handling duties for products with digital elements, with an SBOM and 24-hour reporting.
LEARN MORE →
GOVERNMENT
FIPS
FIPS 140 / CMVP
Validated cryptographic modules for US and Canadian federal systems. Receipts record which module and key signed.
LEARN MORE →
OTHER
eIDAS
eIDAS
EU rules for electronic signatures, seals and time stamps. Receipts can carry a qualified seal or time stamp from your provider.
LEARN MORE →
PRIVACY
GDPR
GDPR
Lawful basis, data minimization, right to erasure. Provable deletion and the context disclosure record do most of the work here.
LEARN MORE →
PRIVACY
HIPAA
HIPAA
Security Rule safeguards for protected health information, with audit controls and authority checks as first-class evidence.
LEARN MORE →
PRIVACY
USDP
US state privacy
CCPA/CPRA and the growing set of state laws, normalized onto one set of requirements.
LEARN MORE →
PRIVACY
27701
ISO 27701
Privacy information management extension to ISO 27001.
LEARN MORE →
AI
EU AI
EU AI Act
Logging (Art. 12), transparency (Art. 13), and human oversight (Art. 14) for high-risk systems. Receipts and the disclosure record map directly.
LEARN MORE →
AI
RMF
NIST AI RMF
Govern, Map, Measure, Manage. Mapped to the runtime controls an agent platform can actually evidence.
LEARN MORE →
AI
42001
ISO 42001
AI management system requirements. Many clauses are organizational; those are marked out of scope, not passed.
LEARN MORE →
AI
AARM
AARM (CSA)
The Autonomous Action Runtime Management (AARM) spec contributed to the Cloud Security Alliance. Lore maps its gate, receipts and verification to the specification.
LEARN MORE →
FINANCIAL
DORA
DORA
ICT risk management and incident reporting for EU financial entities and their technology providers.
LEARN MORE →
FINANCIAL
FINRA
FINRA 24-09
Regulatory notice on generative AI use in broker-dealers; recordkeeping obligations mapped to receipts.
LEARN MORE →
FINANCIAL
NYDFS
23 NYCRR 500
New York DFS cybersecurity rules for financial institutions.
LEARN MORE →
FINANCIAL
SOX
SOX ITGC
IT general controls for financial reporting, with maker–checker as the change-control anchor.
LEARN MORE →
GOVERNMENT
800-53
NIST SP 800-53
Access control, audit and accountability, least privilege, separation of duty. The anchor for the approval policy packs.
LEARN MORE →
GOVERNMENT
FR
FedRAMP
Federal cloud authorization, built on the 800-53 mapping once it ships.
LEARN MORE →
GOVERNMENT
CMMC
CMMC 2.0
Controlled unclassified information for defense contractors.
LEARN MORE →
OTHER
P11
21 CFR Part 11
Electronic records and signatures for FDA-regulated workflows. Signed receipts and accountable approvals map directly.
LEARN MORE →
OTHER
BYO
Internal control sets
Bring your own controls. Enterprise customers map internal policies onto the registry with the same crosswalk format.
LEARN MORE →
02. HOW ONE PIECE OF EVIDENCE SERVES MANY FRAMEWORKS
Illustrative mapping. Each shipped crosswalk carries the exact clause references, its version, and the date it was reviewed. Where a framework has no matching requirement the cell is marked n/a rather than stretched.
03. WHAT THIS IS, AND IS NOT
What a crosswalk gives you
A live view of which requirements have evidence behind them, signed bundles your auditor can verify without our help, and a clear list of what is still missing. It shortens the audit and makes the conversation honest.
What it does not give you
A certification. Turning on a framework does not make you compliant with it, and we will not describe it that way. Some requirements are organizational and live outside any software. The report marks those as out of scope so nobody mistakes silence for a pass.
ASSURANCE PROGRAMS
Run the program, not just the evidence.
The same record that feeds the crosswalks runs the programs around them.
SOC 2
SOC 2 program
Type I or Type II basis, versioned system descriptions, management assertion drafts, auditor engagements with request lists, and a readiness package.
ISO 27001
ISO 27001 management system
Objectives, a risk register with expiring risk acceptances, a versioned Statement of Applicability, internal audits, management reviews, verified corrective actions, and a readiness package. Licensed ISO text is not included.
READINESS
Readiness packages
A package per program, assembled from the evidence already on the record, with offline verification.
BRING YOUR OWN
Your own frameworks
Customer-authored frameworks with versioned editions, and an impact review when a new edition lands.
EVIDENCE
Lore identity data as evidence
Identity and access data from Lore itself is a native evidence source.
WORKBENCH
The assurance workbench
Connections, drift detection, Mapping Studio, evidence custody, collectors, report packages with offline verification, subject requests, incidents and campaigns.
Lore
Context is all you need.
Built by Neurabyte.
Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.