SolutionsSovereigntyCostGovernanceRequest a pilot

Kibo / For compliance

GRC, audit-ready every week.

Controls mapped once to every framework they serve, evidence checked for validity every week, and a mock audit before the real one. Your compliance posture is current, not reconstructed before the auditor arrives.

Request a pilotMore examples
Sample conversation · evidence
Nina · Compliance
What is missing for ISO 27001 control A.5.15 before the audit?
Kibo
Control AC-03 covers A.5.15, but its evidence is 14 months old: the Q3 access review is not attached. I can ask Ravi Menon, the control owner, for it.
Request evidence · AC-03
ControlAC-03 · Access controlMissingQ3 access reviewOwnerRavi MenonDueIn 7 days
Send requestOpen control
1 · What it is

Controls, evidence, risks, findings and policies.

Kibo works on your controls, evidence, risks, audit findings, exceptions and policies. People ask in plain language; Kibo finds the control, the risk or the gap and shows what it will change before it does.

Records it works on:

  • Controls
  • Evidence
  • Frameworks
  • Risks
  • Findings
  • Exceptions
  • Policies
  • Acknowledgements
2 · What it does

Outcomes, not screens.

A control counts as compliant only when it is implemented and its evidence is valid, and one control can serve ISO 27001, SOC 2, NIS2 and DORA at once. A weekly check lists missing or expiring evidence, overdue checks and new high risks. Before a real audit, a mock audit grades each gap as an auditor would.

Sample conversation · a finding
Nina · Compliance
The auditor found that leavers keep VPN access for several days.
Kibo
This is ready to record as a minor finding against A.5.18, linked to the offboarding control, with a corrective action and an owner.
Record finding F-017
SeverityMinorRequirementISO 27001 A.5.18Corrective actionRemove access on the last dayOwnerIT · due 15 Dec
Record findingEdit
Sample conversation · a policy
Nina · Compliance
Roll out the new acceptable use policy to everyone.
Kibo
Version 3 is approved. Each person will be asked to read and confirm it, with a reminder after one week.
Request acknowledgements
PolicyAcceptable use · version 3People42ReminderAfter 7 daysOverdueAfter 30 days
Send requestsPreview
Policy

Approved once. Enforced every time.

Exceptions are a policy: the control owner and then the CISO approve, for six months at most. It is approved once, versioned and enforced by code, with every exception in the register.

Sample policy
Policy exceptions · version 1
Applies toPolicy exceptions and control waiversApproversControl owner, then the CISOMaximum duration6 monthsApproved byStefan Brandt, CISO · 20 Sep
Last applied today at 11:30: exception E-012, waiting for the CISO.
3 · Where it runs

Sovereign by design.

On your own servers, or hosted for you in a region of your choice, with an open-licence model. Your risks, findings and evidence are never sent to a third-party AI provider, and no telemetry is sent to anyone.

More: sovereignty · where Kibo runs · on-premise AI

4 · What it costs

Predictable cost.

Every owner, auditor and control is included in the same annual licence as the rest of the company, with no per-seat, per-token or per-module pricing.

More: total cost of ownership

5 · Why trust it

An audit trail by construction.

Every change to a control, a risk or a policy is in the audit record with a name, a time and a version. Approvals are enforced by code, and nothing is sent or changed without confirmation.

More: governance · security · policy as code

See it on your own processes.

Request a pilot