Stage 0
Where most teams start
Controls live in people's heads. You're shipping—but you couldn't hand an auditor a clear answer tomorrow.
SOC 2 · NIST 800-53 · ISO 27001
Compliance shouldn’t start at audit time. Make every control a living practice.
Foundation Compliant turns honesty into leverage. Capture the control you run today, tie it to evidence, and grow maturity without pretending you are further along than reality.
No demo decks. No copy-paste controls. Just your policies, mapped to real evidence cadences.
CC 6.1 · Change Control
Mapped Framework: NIST SP 800-53 Rev. 5 · CM-3 (Configuration Change Control)
Goal: Mature from ad-hoc deploys → controlled, reviewed, approved, and continuously audited changes.
Each level builds upon prior practices toward full CM-3 alignment.
012345
Policy Viewing
All production changes are documented and tracked through a ticketing system.
Every tracked change must receive peer review that considers security and privacy impact.
Procedure
Each deployment begins with a ticket describing the change.
Tickets serve as implicit approval and create a record of what was changed.
Tickets are marked complete when change is moved to production.
Changes are merged through pull requests and are reviewed by another engineer before merge.
Reviewers confirm security/privacy implications and note impact within the ticket.
Evidence Collection
Retain tickets with linked commits and deployment timestamps for every release.
Archive reviewed PRs and associated impact notes with their originating tickets.
PRs and commits include ticket number to link changes to documentation.
Where your team is
Honesty first. Progress you can prove.
Name the stage you’re at today. Grow toward auditor-ready without pretending you’re further along.
Stage 1
One real improvement
Pick the next practice you can actually keep. Write it as policy your team will follow.
Stage 2
Running with proof
Evidence on a repeating cadence. The improvement shows up in operations—not just a binder.
Stage 3 — Goal
Ready for an auditor
Versioned policy and procedure an auditor can follow. No scavenger hunt.
What an auditor wants to see
The policy on the page. The evidence you’d keep.
Tap a level below — the preview panel fills with the policy wording and evidence an auditor would expect at that maturity.
Closing the loop
Your controls, your cadence, your compliance.
Step into a workspace that keeps auditors, boards, and engineers aligned. Honest maturity today becomes confidence at renewal.