One loop that turns requirements into finished work.
The engine runs the same four stages every cycle: map what applies, execute the checks, attach the proof, and chase every failure until it passes. You review outcomes instead of doing the legwork.
- Access review - quarterlyAC-02Queued
- Data encryption at rest verifiedSC-28Queued
- Vendor risk assessmentSR-06Queued
- Backup restoration testCP-09Queued
- MFA enforced on admin accountsIA-02Queued
- Change approvals recordedCM-03Queued
Each stage hands a concrete artifact to the next.
Nothing in the loop depends on someone finding a free afternoon.
Map
Kmetog starts from the frameworks you answer to and resolves them into a single control set. Where SOC 2, ISO 27001 and PCI DSS ask for the same thing, you run the check once and the result counts everywhere it applies.
Output: a de-duplicated control register with owners and test frequency
Execute
Each control has a test definition: what to read, from which system, and what a pass looks like. Tests run on their schedule, quarterly, monthly or continuously, without someone remembering to start them.
Output: a pass or fail result for every control, every cycle
Evidence
When a test completes, the engine writes the proof: the data it read, the rule it applied, the result, and when it ran. The record is hashed and attached to the control so it cannot drift from what was tested.
Output: timestamped, integrity-checked evidence per control
Remediate
A failure is never just a red cell. It becomes a ticket with an owner, a due date based on severity, and an automatic re-test once a fix is claimed. The ticket only closes when the control passes again.
Output: a tracked item that closes on verified evidence
Five areas, one record.
Automated Control Testing
Checks run against your systems every cycle
ExploreAudit Evidence Generation
Timestamped proof attached to every control
ExploreRemediation Tracking
Failed controls followed through to closure
ExplorePolicy & Procedure Management
Policies kept current and tied to controls
ExploreFramework Coverage
What is mapped today, and what is next
ExploreRuns every cycle
The loop repeats on the schedule each control needs, so readiness is a standing state, not a project.
Connects to what you already run
Cloud accounts, identity providers, ticketing and document stores are read through scoped connections.
People stay in the loop
Some controls need a human attestation. Kmetog requests it, records it and attaches it like any other evidence.
Every action is visible
Each test run, evidence record and ticket change is logged, so you can show exactly how a result was reached.
See the loop run on your own control set.
In a demo we map your frameworks, walk through the first checks and show the evidence an auditor would receive.