Two ways to get compliant. Both run themselves.

Team 1: Starting from zero

Stares at a blank framework (SOC 2, ISO 27001, NIST CSF — pick one) with zero idea where to start. “We need to get certified. Where do we begin?” They’ve got nothing. Spreadsheets and scattered security docs, but no structure.

Team 2: Documented, but unproven

Has a compliance program — security policies, incident response playbooks, access controls, everything written down. But they don’t know what it proves. Their policies satisfy which controls? Are they audit-ready? Nobody knows.

Mode 1

Framework-Based Workflows

You pick a framework (SOC 2, NIST CSF, ISO 27001, CMMC, HIPAA — any of the 25+ supported). Optionally upload existing docs. Cleo AI guides you through every control question with context-aware prompts. For each control, Cleo shows:

• What the control requires
• Why it matters
• Questions to answer (Cleo suggests answers based on your docs if you uploaded them)
• Evidence to attach

Cleo generates a remediation plan as you go. Questions you can’t answer become Planner cards. By the end, you have a path to certification and a prioritized list of work.

Best for: Audit prep, new frameworks, organizations heading to certification.

Mode 2

Evidence-Based Workflows

You upload your existing security policies, procedures, certs, SOC 2 report — whatever you’ve got. Cleo reads them and auto-maps them to controls. For each framework control, you see:

Covered  Your policies satisfy this control fully

Partial  Your policies cover some of it; gaps exist

Gap  No coverage; new work needed

Evidence auto-stages for your review. You can accept the mapping, override it, or add more docs.

Best for: Instant ROI, organizations with existing security programs, audit defense, multi-framework translation.

Cleo AI Guidance (Both Modes)

Cleo doesn’t just give you a list of controls. It walks you through each one with context awareness. It knows your industry, your framework, your docs. Suggested answers are based on your reality, not generic best practices.

Dynamic Task Generation

As you work through a workflow, gaps automatically become Planner cards. Remediation tasks are pre-linked to controls. You don’t have to manually track “which task closes which gap?”

Multi-Framework in One Pass

Answer controls for SOC 2. Cleo translates answers to NIST CSF, ISO 27001, and CIS Controls simultaneously. No redundant work.

Evidence Auto-Staging (Evidence-Based)

Upload policies. Cleo catalogs them and links them to the controls they satisfy. You review and approve. Full evidence chain with version history.

Dependency Tracking

Some controls depend on others (“you can’t have incident response without defining incident severity first”). Cleo flags dependencies so you don’t waste time on prerequisites that haven’t been resolved yet.

Framework Health as You Work

Live dashboard shows: “SOC 2: 34% complete. NIST: 28% complete. Overdue tasks: 3.” You see progress in real time.