Forta Compliance
Frameworks and requirements (GRC)
Measure once, prove it to everyone who asks
A guided assessment gives you an A-F grade and a maturity level from 0 to 5 on the framework that matters to you. The same work then serves 40+ frameworks: a control validated once advances every framework that requires it, with your gaps, a costed roadmap and a file for the auditor.
40+
Frameworks covered
A-F
Maturity grade, CMMI 0 to 5
1,534+
Pivot SCF controls
Seven audits, seven binders, the same controls asked again under a different number.
Answering framework by framework is the most expensive way to do compliance: the same question comes back seven times, and between two audits nobody can say where the organization actually stands. US automation tools treat compliance as checkboxes; enterprise GRC is out of budget and out of time for a mid-sized company.
Outcomes your team will feel.
A defensible number in days
A-F grade, CMMI maturity, chosen target: enough to answer the board without waiting for an audit.
One effort, several frameworks
Cross-framework leverage is shown control by control: you know what each hour advances.
A dossier auditors accept
Professional export, consistent with the screens, backed by evidence and published policies.
Key capabilities
A measurement that starts without an external questionnaire
The assessment is guided, one question per control, with three possible answers: yes, partial, no. You get an A-F grade and a CMMI maturity level from 0 to 5, per domain and overall. Six approaches are available depending on the time you have, from a fast baseline to an exhaustive evidence-backed assessment.
Assess against the framework that matters to you
ISO 27001, SOC 2, CIS Controls, PCI DSS, NIST CSF 2.0, NIST Privacy Framework, ISO 42001, OWASP: nine frameworks are assessed natively by questionnaire, and you can define your own. Each profile gets its framework assignment, its scope and its target, so you can measure a subsidiary, a plant or a service line separately.
The assessment screen is an audit workstation
For every control you see what to verify (5,956 assessment objectives), what to provide (evidence levels, 316 artifact types) and which alternatives are acceptable (compensating controls). Evidence lands in a single register, reusable by compliance.
History, trend and forecast maturity
A snapshot is taken every day. You read your 30-day delta, your trajectory, and the forecast maturity if the current pace holds. A grade with no date is worthless in front of a board; this one is dated and comparable.
A NIST CSF 2.0 reading on top, whichever framework you assessed
Whichever framework you assess against, your posture can be read converged on the 6 NIST CSF 2.0 functions and their 22 categories, with a configurable target and a radar view. It is the language an executive committee understands, obtained by projection from the SCF baseline: an extra reading, not a starting constraint.
40+ frameworks, including DORA, NIS2 and GDPR
NIST CSF 2.0, ISO 27001, ISO 42001, ISO 27701, SOC 2, PCI DSS 4.0, CIS v8, NIST SP 800-53, IEC 62443, HIPAA, NERC CIP, SWIFT CSCF, Quebec Law 25, PIPEDA, OSFI B-13, CRA and the rest. Each with its compliance rate, materiality, readiness, gap count and costed compliance path.
Comply once, comply many
This is the heart of the module. A control validated once advances every framework attached to it, and the interface shows the leverage: "this work also advances ISO 27001 and PCI DSS". With a small team and several frameworks to satisfy, every hour of work counts several times.
A roadmap costed in person-days
Every gap becomes an estimated effort, adjusted to the size of your organization, with a realistic floor per control. The plan is ordered into deterministic phases: quick wins of five days or less, critical gaps, what remains to reach the threshold, then beyond. Two milestones stand out: audit-ready, then full compliance. Duration is computed from the pace you can sustain.
Exportable auditor dossier and policies as evidence
A professional dossier is generated server-side, consistent with the screens by construction. Document management ships 25 bilingual policy templates with a full lifecycle, and a published policy automatically becomes evidence for the SCF controls it covers.
A compliance gap becomes a dated action.
Every gap goes to the Action Center with an owner and a deadline, and to the risk register as regulatory risk. The same control that advances three frameworks stays one action, never three.
Three examples, three situations
- Example · Manufacturer
A customer asks for proof within three weeks
You assess your maturity against the framework the customer requires. You get a grade, your gaps ranked and a file to hand over, without waiting for a full audit.
- Example · Multi-site company
One assessment, several obligations
Law 25 for your personal information, ISO 27001 for a customer, your insurer's requirements: a control validated once moves all three forward. You see what every hour of work advances.
- Example · Prime contractor
Preparing a certification required by contract
A Defence contract requires CPCSC. You measure your gap to the required level, follow the costed roadmap and export the file for the assessor. The subcontractors concerned follow the same path.
What's included
Measurement & coverage
- A-F grade and CMMI maturity 0 to 5
- 40+ frameworks assessable, plus your own
- Framework assignment, scope and target per profile
- Optional NIST CSF 2.0 reading (6 functions, 22 categories)
- Assessed, mapped or unmapped coverage, never a false zero
- Daily snapshots, 30-day delta, forecast maturity
- One evidence register, reused by compliance
Gaps & remediation
- Gaps per domain and per function
- Quick wins isolated automatically
- Compensating controls accepted and traced
- Prioritized remediation plan
- Assessment sessions with assignment, review and approval
- Comparison across profiles and periods
- Every gap becomes a dated action in the Action Center
Frameworks
- NIST CSF 2.0
- NIST SP 800-53 rev5
- ISO 27001:2022
- ISO 27701
- ISO 42001
- SOC 2
- NIS2
- DORA
- GDPR
- CRA
- CIS Controls v8
- PCI DSS 4.0.1
- Quebec Law 25
- PIPEDA
- HIPAA Security Rule
- CPCSC (ITSP.10.171)
- OSFI B-13
- IEC 62443
- NERC CIP
- SWIFT CSCF v2025
- FedRAMP rev5
- and 22 more
- 1,534+ pivot SCF controls
Roadmap & dossier
- Effort costed in person-days, sized to your organization
- Phases: quick wins, critical gaps, threshold, beyond
- Audit-ready then full-compliance milestones
- Duration computed from the pace you sustain
- Cross-framework leverage shown control by control
- One plan per profile, never a misleading merged plan
- Exportable auditor dossier, generated from the same source as the screens
Security policies
- 25 bilingual policy templates
- Lifecycle: draft, review, published, archived
- Import DOCX, Markdown and text
- A published policy automatically becomes evidence for the controls it covers
- Review cadence and reminders
- Activity log per policy
Optional AI enrichment
AI speeds this module up, it does not replace it. Every capability described above works without it. Enrichment is enabled per workspace, and can be turned off without losing a feature.
In posture, AI targets preparation and reading: proposing an assessment answer from evidence already filed, drafting the trend commentary, explaining a maturity gap in plain language. The A-F grade, the CMMI level and coverage stay computed by an explicit model, verifiable control by control. In compliance, AI targets evidence collection and policy drafting: proposing the evidence expected for a control, extracting metadata from an imported document, suggesting policy text for a human to review. Validating a control stays a human, traceable decision.
Sovereignty: the platform is built and hosted in Canada, by a Canadian company. For AI, you decide whether enrichment is enabled, on which data and within which scope; deployment options are defined with you, according to your residency and confidentiality requirements. No customer data is used to train a model.
Compliance is not paperwork. It feeds risk and action.
Isolated compliance produces binders. Here every gap becomes a regulatory risk in the register and a dated action in the Action Center, and every validated control flows back into posture. Compliance and risk move forward together, in a single product.
Forta Compliance → Forta Exposure and Forta Radar
A detected exposure does not carry the same severity depending on your ability to detect and respond. Posture weighs urgency: the same exposed service is not handled the same way whether your Detect function sits at 1 or at 4.
Forta Compliance → Forta Suppliers
The 1,534+ SCF controls also serve as the vendor-side reference: questionnaire answers attach to the same controls, which gives NIST, ISO, SOC 2 and GDPR coverage with no extra work.
Forta Compliance → Forta Cockpit
A compliance gap enters the register as regulatory risk, distinct from the operational risk posture carries. No composite score mixes the two, because they do not call for the same decisions.
Forta Compliance → Forta Actions
A control that advances ISO 27001, SOC 2 and NIST stays one action in the queue, tagged with the number of frameworks it serves. And a "done" is only confirmed at the next assessment, otherwise the action reopens.
Explore the other modules.
30 minutes to know what to fix first.
A member of our team walks you through FortaRisks on threats relevant to your sector, and you leave with your priorities.
Frequently asked questions
What is the difference between maturity and compliance?
Posture measures your operational maturity: can you do it, and how well. Compliance measures your alignment to a given framework: do you meet the requirement. Both rest on the same SCF control baseline, but they never merge into a single score, because they carry two different risks, one operational, one regulatory.
How long before we have a first number?
A baseline assessment on essential controls takes a few days. The evidence-based assessment takes about two weeks, and the comprehensive one four to six weeks, at the level of rigor an ISO 27001 or a SOC 2 Type II expects. You pick the depth; the grade is produced on the first pass.
What happens to a domain we have not assessed?
It is marked as not covered, not as a zero. That is an engine rule: an unknown domain must never look like a failing one, nor inflate an average. Actual coverage is displayed next to the grade.
Is the grade comparable from one period to the next?
Yes. Daily snapshots are produced by the same service that renders the screens, which guarantees a report and a screen cannot diverge. So you compare like with like, and the 30-day delta is computed on that basis.
Do we have to go through NIST CSF?
No. You assess against the framework you choose, and nothing forces you to look at the NIST CSF reading. It is available because the SCF baseline lets any assessment be projected onto the 6 functions, and because it is the most widely shared vocabulary in the boardroom. If your organization speaks ISO 27001, stay on ISO 27001.
How do 40+ frameworks fit in a single assessment?
All of them attach to the Secure Controls Framework 2026.2.2 and its 1,534+ controls, which act as a pivot language. You assess the control once; its equivalents are marked across every linked framework, with a documented, auditable mapping you can disable if your auditor requires it.
Are DORA, NIS2 and GDPR really covered?
Yes, fully, with compliance rate, gaps and a costed compliance path like the others. Their rate is derived from your SCF assessment through crosswalk: that is exactly the "comply once, comply many" mechanism, not an approximation. A dedicated native questionnaire can be added on top for greater methodological depth.
Which compliance target should we aim for?
The target is configurable and defaults to 80%. Readiness reads in three states, ready, at risk or not ready, and the "audit-ready" milestone is distinct from full compliance: most organizations fund the first one first.
What does the auditor dossier contain?
The domain and control level detail, attached evidence, published policies covering controls, and remaining gaps with their effort. It is generated from the same source as the screens, which guarantees the auditor and you read the same number. It requires at least one completed assessment.