Controls tested on schedule, without a reminder.
Every control gets a test definition: which system to read, what rule to apply and how often to run. Kmetog executes those tests each cycle and records a clear pass or fail, so the checklist is worked, not just listed.
Each control knows exactly what a pass looks like.
Vague requirements like "review access regularly" become concrete, repeatable tests with a data source, a rule and a frequency.
- Source. The system the check reads from, such as your identity provider, cloud account or HR system.
- Rule. The condition that must hold, for example zero active accounts for offboarded staff.
- Frequency. Continuous, daily, monthly or quarterly, matched to what the framework requires.
- control
- AC-02 Access review
- mapped to
- SOC 2 CC6.2, ISO A.5.18
- source
- identity provider (read-only)
- test rule
- inactive > 90d = 0
- result
- pass
- collected
- at test completion, UTC
- sha-256
- 9f2c41e0b7d3...
One test counts toward every framework that asks for it.
Access reviews, encryption checks and backup tests appear in almost every framework. Kmetog maps each test to all the requirements it satisfies, so overlapping frameworks do not multiply your work.
- Shared control set. SOC 2, ISO 27001, PCI DSS and HIPAA requirements resolve into one register.
- Clear lineage. Every result shows which clauses it supports, visible to you and your auditor.
A quarterly access review, end to end
The control most teams postpone, run without anyone starting it.
- Scheduled run
The quarter opens and the access review test starts on its own.
run AC-02 / quarterly - Data read
Users, roles and last sign-in are read from the identity provider.
source: idp (read-only) - Rules applied
Inactive, offboarded and over-privileged accounts are checked.
inactive>90d = 0 / pass - Result recorded
Pass is logged and evidence attaches. A fail opens a ticket instead.
evidence: access_log_Q2.pdf
What teams usually ask
Does Kmetog change anything in our systems?
No. Tests read configuration and activity data through scoped connections. Kmetog reports what it finds and opens remediation tickets, but fixes are made by your team.
What about controls that cannot be checked automatically?
Some controls, such as a signed management review, need a person. Kmetog schedules those as attestation tasks, sends them to the right owner and records the response as evidence.
Can we adjust test rules and frequency?
Yes. Default rules follow common framework expectations, and you can tighten thresholds or change frequency where your policies or auditor require it.
Find out which of your controls can run on their own.
We review your systems and frameworks in a demo and show which tests Kmetog can execute from day one.