Enterprise GRC at Scale — Without Enterprise Complexity

Multi-Entity Architecture

Manage compliance across subsidiaries, business units and acquired entities. Each entity runs in its own isolated environment with consolidated reporting at the parent. Enterprise Plus links multiple licences under one umbrella — portfolio rollup, cross-environment benchmarking and a central admin console for holding companies and multi-subsidiary groups.

SSO/SAML & SCIM User Provisioning

Single sign-on through your identity provider via SAML; automated provisioning and de-provisioning via SCIM so access follows your directory. Every access event lands in the activity log — no manual account management at scale.

Cross-Framework Control Mapping

Run NIST CSF 2.0, ISO/IEC 27001:2022, SOC 2, HIPAA, CMMC 2.0, NIST 800-53, PCI-DSS and FedRAMP simultaneously. Work in one framework propagates credit to the others through cross-framework control equivalencies; expiring evidence flags every framework that relied on it.

AI Assessment Engine at Enterprise Scale

The same engine MSPs use to run hundreds of client assessments: it maps controls, scores maturity L1–L5, ranks remediation by computed impact and generates audit-ready reports. Not a chatbot — an assessment engine whose reasoning is explainable at every step. How continuous assessment works →

Continuous Compliance — Included

Automated evidence and tests from AWS, Azure, GCP, Microsoft 365, Google Workspace, Okta, Intune, Jamf, Iru, CrowdStrike, ConnectWise, Tenable, Qualys and Enclave, every 12 hours, with read-only access, envelope-encrypted credentials and a fixed egress IP you can allowlist. Included with Enterprise. See every integration → · Asset Inventory →

Advanced Reporting, Briefs and Board Dashboards

Executive dashboards by entity, framework, control category and risk severity with trend lines across quarters. Briefs — a Framework Brief per framework and a Board Review across all of them — stay current on their own and export to PDF. Live report widgets freeze when a version is sealed. Evidence & reporting →

Audits Run From a Request List

Seed requests from the framework's assessor requirements or a target maturity, assign owners and due dates, and let fulfilment be computed from evidence actually collected. Export a submission package organized by request with a SHA-256 manifest. A-LIGN auditors connect directly into the platform — rolling out to joint customers.

Vendor Risk at Enterprise Scale — Included

Classify vendors by tier, send AI-scored questionnaires through a branded portal, maintain an evidence vault, and connect vendor posture to the controls and risks each vendor affects. Included on Enterprise; unlimited vendors on Enterprise Plus. See third-party risk → · Trust Center →

Compliance Data Graph — The Intelligence Layer

Controls, risks, vendors, evidence, policies and people connected in one structured graph with maturity scores and ownership history on every edge. Bidirectional control↔risk mapping and multi-quarter maturity trajectory exist because the graph exists.

Immutable Audit Trail

Every report version, evidence item, assessment answer and quarterly revision is timestamped, actor-tracked and immutably stored — a full chain of custody for regulators, auditors and board inquiries. Revisions seal automatically; a revision showing no change is as much a finding as one with changes. Risk management →

Scoped to your portfolio

for holding companies, multi-subsidiary groups and federal programs

• Umbrella admin console across multiple licences
• Portfolio rollup reporting & cross-environment benchmarking
• TPRM unlimited · white-label Trust Center
• Custom SLA, roadmap input, dedicated CSM
• US Federal / DoD on-prem deployment option