Implement once. Satisfy many.

Kyūdō supports more than 80 compliance and security frameworks, including SOC 2, ISO 27001, ISO 42001, the NIST Cybersecurity Framework, NIST SP 800-171, CMMC, HIPAA, PCI DSS, the EU AI Act, and DORA, among others. All supported frameworks are available to activate without a per-framework charge, because Kyūdō defines controls once and maps them across frameworks through a Secure Controls Framework crosswalk. As regulations evolve, new frameworks are added to the same crosswalk rather than rebuilt from scratch.

There is no cap on how many frameworks you can map at once, and activating more does not raise the price. Kyūdō defines each control a single time, then uses its Secure Controls Framework (SCF) crosswalk to satisfy the equivalent requirement in every framework you turn on simultaneously. Organizations commonly run SOC 2, ISO 27001, and a sector framework like CMMC or HIPAA together, reusing the same evidence across all of them. Charging per framework would contradict how the crosswalk works.

Kyūdō maps multiple frameworks through the Secure Controls Framework, a meta-framework that acts as a common control language. Each control is written once against the Secure Controls Framework, and the Set Theory Relationship Mapping (STRM) method, aligned with NIST Interagency Report 8477, defines how that control relates to requirements in each specific framework. When you activate SOC 2 and ISO 27001 together, a single piece of Microsoft, AWS, or Google Cloud security evidence can satisfy the related control in both, because the crosswalk already knows they are equivalent.

Yes. Kyūdō supports SOC 2 (System and Organization Controls 2), ISO 27001, the Cybersecurity Maturity Model Certification (CMMC), and the NIST Cybersecurity Framework, among more than 80 frameworks. Controls for each are derived from one Secure Controls Framework crosswalk, so evidence collected from your Microsoft Security estate applies across all of them at once. Kyūdō prepares and supports readiness for these frameworks with continuous evidence and provenance; certification itself is granted by an independent auditor or assessor.

Yes. Kyūdō supports the EU AI Act, ISO 42001 (the AI management-system standard), and the NIST AI Risk Management Framework, governing them in the same Compliance Graph as your cyber controls. You can classify AI systems by risk, assign the relevant controls, and collect governance evidence continuously inside your tenant. Because these AI frameworks share Kyūdō's control crosswalk, the work you do for one contributes to the others, and your AI-governance posture stays connected to the security controls underneath it.

Kyūdō prepares you for SOC 2 (System and Organization Controls 2) by mapping the Trust Services Criteria to one control set through the Secure Controls Framework crosswalk and collecting supporting evidence continuously from Microsoft Defender XDR, Sentinel, Purview, Entra ID, and Azure Policy inside your tenant. Each artifact carries a hash, lineage, and confidence score your auditor can verify. Kyūdō supports readiness; the SOC 2 report itself is issued by an independent auditor.

Kyūdō supports ISO 27001 readiness by mapping the standard's controls into its Secure Controls Framework crosswalk, so work done for other frameworks carries over, and by collecting evidence continuously from your Microsoft Security estate inside your own tenant. Control status, ownership, and linked evidence stay current between surveillance audits rather than being rebuilt each cycle. Certification is granted by an accredited certification body; Kyūdō keeps the evidence ready for it.

Kyūdō supports the NIST Cybersecurity Framework (CSF) by mapping its functions (Govern, Identify, Protect, Detect, Respond, Recover) to one control set through the Secure Controls Framework crosswalk. Evidence flows continuously from Microsoft Defender XDR, Sentinel, Purview, Entra ID, and Azure Policy, so your CSF posture reflects the current state of your estate. Because CSF overlaps heavily with other frameworks, the same controls and evidence also serve SOC 2, ISO 27001, and CMMC.