Controls come from security benchmarks. Those benchmarks are then crosswalked onto the frameworks your customers and auditors actually ask about—so one fix credits in several places at once.
No tool can make you SOC 2 compliant, and any that says so is selling you a false sense of security. A requirement shows as covered here when the Workspace or Microsoft 365 controls mapped to it are passing—which is a real, checkable input to an audit, and only ever part of one.
These crosswalks are informative. We say so on the page and in the exported pack, because an auditor who finds an overstatement in your evidence will start doubting the rest of it.
Every requirement, the controls mapped to it, their current status and the remediation for anything failing. Branded, print-to-PDF, one per framework.
Every control with its framework references, service, severity, latest status, evidence and remediation, plus the scan timestamp. The format an auditor can actually work through.
Roughly a third of any benchmark is procedural—documented policies, periodic reviews. Attest with a note, a policy excerpt or a link, and it carries that evidence into the export instead of sitting permanently red.
Score over time and a daily diff, so you can show a control has been passing for months rather than that it happens to be green on the morning of the audit.
Security-awareness training is a requirement in most of these frameworks, and completion data from the training modules feeds the same evidence export—so the people half is covered by the same pack rather than a separate spreadsheet.