Compliance controls
Controls mapped to several frameworks at once, owners, evidence that expires, checks and reminders.
Records: controls
Kibo / Kits / Governance, risk & compliance (GRC)
Governance, risk and compliance in one kit.
Controls mapped once to every framework they serve, evidence checked every week, risks treated and accepted by the right people, and a mock audit before the real one.
Sample conversation
You
Add a backup control to the register: nightly backups of the file server, restore test done in October, owner Tom Becker.
Kibo
I will add the control with ISO 27001 A.8.13 (information backup) and the October restore report as evidence. Please check the card first.
New control: file server backups
ControlNightly backup of the file server, restore tested once a yearFramework referencesISO 27001 A.8.13OwnerTom BeckerStatusimplementedEvidence date14 Oct 2026
1 · What it runs
The processes in this kit.
Ready-made processes for compliance work: a controls register mapped to several frameworks at once (ISO 27001, SOC 2, NIST CSF, CIS v8, NIS2, DORA, GDPR) with evidence that expires, a risk register, policy management with staff acknowledgements, audit findings and corrective actions, mock audits, exceptions and waivers with an approver and an expiry, and the compliance framework structure: authority documents, their citations (loaded from ISO 27001, NIST CSF 2.0, CIS v8, DORA or Annex 11), control objectives and controls linked in one chain, entities, and compliance % per document, citation, objective, policy and entity with a dashboard per role. Each is set up in one step, with its reminders; figures always come from the records.
Risk register
Risks with owners, likelihood x impact, treatment, acceptance by an approver and review reminders.
Records: risks
Policy management
Policies with owner, approver and yearly review; staff acknowledge them and see only their own.
Records: policies, policy acknowledgements
Audit findings
Findings from every audit, owners, corrective actions and due dates, closed only when verified.
Records: findings
Mock audit
Plan audits, test like an auditor before the real one, findings into the findings table, readiness a month before.
Records: audits, findings
Exceptions and waivers
Policy exceptions, control waivers and risk acceptances: owner, reason, compensating control, approver, expiry.
Records: exceptions
Compliance framework
Authority documents, their citations, control objectives and controls linked in one chain, policies linked to what they serve, entities with parents; compliance % per document, citation, objective, policy and entity with roll-up and drill-down; a dashboard per role.
Records: authority documents, entities, policies, citations, control objectives, controls
2 · Examples
Real requests, and the card each one produces.
Sample conversation
You
Add a backup control to the register: nightly backups of the file server, restore test done in October, owner Tom Becker.
Kibo
I will add the control with ISO 27001 A.8.13 (information backup) and the October restore report as evidence. Please check the card first.
New control: file server backups
ControlNightly backup of the file server, restore tested once a yearFramework referencesISO 27001 A.8.13OwnerTom BeckerStatusimplementedEvidence date14 Oct 2026
Sample conversation
You
We write no software ourselves. Mark secure development as not applicable.
Kibo
I found SD-02 (ISO 27001 A.8.25, secure development life cycle). A not applicable control needs a reason, which will go into the statement of applicability.
SD-02 set to not applicable
Control idSD-02Framework referencesISO 27001 A.8.25Statusnot applicableNot applicable reasonThe company develops no software; bought software is covered by supplier controls
Sample conversation
You
Log a risk: our old ERP server is out of support, Ravi owns it. Likelihood 4, impact 4. We will accept it until the migration in June.
Kibo
The score is 4 x 4 = 16, which is high, so accepting it needs a yes from the risk management group. I will add the risk and ask them once you confirm.
Unsupported ERP server
RiskERP server without vendor security updates could be compromisedOwnerRavi MenonScore16TreatmentacceptNext reviewFeb 2027
Sample conversation
You
New risk: ransomware on the file server, owner Tom Becker. Likelihood 3, impact 5, we want to reduce it.
Kibo
3 x 5 = 15 is a high risk: it needs a treatment plan with an owner and a date, and is reviewed every quarter. I will add it for your confirmation.
Ransomware on the file server
CategorysecurityOwnerTom BeckerLikelihood3Impact5Score15
Sample conversation
You
Put the new remote work policy up for approval. Version 1.0, Tom Becker wrote it, Lena Hoffmann approves.
Kibo
I will add it as a draft in review. It applies to everyone only once Lena has approved it.
Remote work policy v1.0
PolicyRemote work policyVersion1.0OwnerTom BeckerApproverLena HoffmannStatusin review
Sample conversation
You
I have read the information security policy.
Kibo
You have an open request for version 3.1. I will record that you read it today.
Acknowledgement by Nina
PolicyInformation security policyVersion3.1PersonNinaAcknowledged on7 Nov 2026Statusacknowledged
Sample conversation
You
The surveillance audit found that we skipped part of the internal audit programme. Minor, ISO 27001 clause 9.2, Ravi owns the fix, due 15 January.
Kibo
I will record a minor finding against clause 9.2 with Ravi as owner and 15 January 2027 as due date. A fix is closed only after someone else verifies the evidence.
Internal audit programme incomplete
Sourceexternal auditRequirementISO 27001 clause 9.2SeverityminorOwnerRavi MenonDue15 Jan 2027
Sample conversation
You
Ravi finished the access review. Lena checked the report. Close the finding on access rights.
Kibo
The evidence is the signed access review of 4 November, and Lena is not the owner, so she can verify it. I will mark the finding verified with her name.
Access rights review
FindingAccess rights not reviewed in the last 12 monthsStatusverifiedEvidenceSigned access review report, 4 Nov 2026Verified byLena Hoffmann
Sample conversation
You
Set up a mock audit of ISO 27001 for the head office, starting 11 January. Lena Hoffmann leads it.
Kibo
I will set up the audit with its scope and lead, then start from the facts: the controls, their evidence and the open findings for ISO 27001.
Mock audit ISO 27001, head office
AuditMock audit ISO 27001 head officeTypemockScopeInformation security management system, head officeLeadLena HoffmannStart date11 Jan 2027
Sample conversation
You
The mock audit found that backups were never restore-tested. Record it as a finding, Tom owns it, fix before the audit.
Kibo
The nightly jobs ran, but I found no restore test record, so I propose a minor finding against A.8.13 for Lena to confirm. It goes in only after you agree.
No restore test for backups
Sourcemock auditRequirementISO 27001 A.8.13SeverityminorOwnerTom BeckerCorrective actionRun and document a restore test of the file server
Sample conversation
You
The design team needs two laptops without disk encryption until the new CAD software is certified. Ask Stefan Brandt to approve an exception until 31 March.
Kibo
I will file a policy exception with a compensating control and an expiry of 31 March 2027. It is valid only once Stefan approves it.
Two laptops without disk encryption
ExceptionTwo design laptops run without disk encryptionTypepolicy exceptionCompensating controlNo customer data on the laptops, devices locked in the office overnightApproverStefan BrandtExpiry31 Mar 2027
Sample conversation
You
Record the acceptance of the ERP server risk until 30 June, with Lena Hoffmann as approver. The server is isolated from the internet meanwhile.
Kibo
The risk has score 16, so it is recorded here as a risk acceptance, linked from the risk register. It is valid only after Lena's yes.
Risk acceptance: unsupported ERP server
Typerisk acceptancePolicy or controlPatch managementCompensating controlServer isolated from the internet, access only from the office networkRisk16ApproverLena Hoffmann
Sample conversation
You
Add the NIS2 directive to our authority documents. It applies to the whole group, Lena Hoffmann owns it.
Kibo
NIS2 is not in the list yet. I will add it as a law, applicable, and its requirements can then be added as citations.
NIS2 directive
NameDirective (EU) 2022/2555 on measures for a high common level of cybersecurityShort nameNIS2TypelawApplicableyesOwnerLena Hoffmann
Sample conversation
You
Add our Lyon site as an entity under Hoffmann Logistik GmbH, so its score rolls up to the group.
Kibo
I will add the site with Hoffmann Logistik GmbH as parent. Its controls then count in the legal entity and in the group.
Site Lyon
EntityLyon siteTypesiteParentHoffmann Logistik GmbHCountryFranceCriticalityhigh
3 · Approvals and reminders
Rules it sets up, enforced by code.
- Reminder · controls: 14 days before “next check”
- Reminder · controls: 30 days before “evidence valid until”
- Report · A summary to the manager, every Monday at 9:00
- Approval · Risk acceptance
Step 1: the risk management group when “treatment” is accept, “score” is at least 15 - Reminder · risks: 7 days before “next review”
- Report · A summary to the manager, the 1st of each month at 9:00
- Reminder · policies: 30 days before “next review”
- Reminder · policy acknowledgements: 7 days after “requested on”
- Reminder · findings: 7 days before “due”
- Reminder · findings: 1 days after “due”
- Reminder · audits: 30 days before “start date”
- Approval · Exceptions and waivers
Step 1: the person named in “approver” - Reminder · exceptions: 30 days before “expiry”
- Reminder · exceptions: On the day of “expiry”