ComplyPilot AI follows one workflow: framework, control, evidence, assessment, gap, risk, remediation, audit readiness.
CMMC Level 2 and NIST SP 800-171 ship with domains, controls, assessment objectives and evidence requirements. Controls are mapped across frameworks, and the data model accepts new frameworks without redesign.
Every control carries an owner, implementation status, evidence status, risk level and review dates. Control detail pages hold implementation notes, linked evidence, findings, risks, POA&Ms and a full activity history.
Evidence is stored privately and isolated per organization. Files are never served from public URLs. Each item tracks type, owner, review status, expiration and linked controls.
Findings carry severity, owner, status and due date, and convert into risks, remediation tasks or POA&M entries. Risks use a 5×5 likelihood × impact methodology with inherent and residual scoring.
Generate executive, readiness, gap, risk, POA&M and evidence reports from live data. Every significant action is written to an append-only activity log that the interface cannot edit.
Encryption in transit and at rest, role-based access control, strict tenant isolation enforced in the database, private storage, session management and audit logging. Secrets never live in frontend code.