The control map is an evidence map, not an assessment and not an opinion. It lists which artefacts Sentinelleai holds that bear on a control, and what each artefact stops short of proving. It never concludes that a control is implemented, operating effectively, or adequate; that judgment belongs to a qualified auditor working from a defined scope, a period of time, and tests this platform does not perform.
What the control map shows
For every control in a catalogued framework, the map states which of your own artefacts bear on it and reports one of five honest positions, never a verdict:
| State | Means |
|---|---|
| Evidenced | Every artefact this control could draw on actually produced something |
| Partial | Some artefacts produced evidence, others did not |
| No evidence | The artefacts were checked and came back empty |
| Cannot ask | At least one artefact could not be evaluated at all |
| Not reachable | No artefact exists, or could exist, that bears on this control today |
Frameworks catalogued
Two frameworks are catalogued in full — every control, including the ones this deployment cannot speak to at all, not only the favorable ones: SOC 2 (the AICPA's Common Criteria, all 33 of them) and ISO/IEC 27001:2022 (all 93 controls in Annex A). Reporting only the controls with good evidence would read to anyone comparing it against the real framework as if it covered the whole thing; the map is built against the whole framework instead, denominator included.
Audit evidence workflow
For an actual audit, evidence needs to span a period of time, not just prove something is true at the moment you looked. The audit workflow lets you declare an observation period, then reports, control by control, a real sample of rows that fall inside that period, the fulfilment state of every evidence request generated for it, and an honest count of how many controls have evidence that genuinely spans the declared period versus evidence that only proves a single point in time. A declared period longer than the time this installation has actually been running is flagged rather than silently accepted. The resulting package — the disclaimer, the declared period, the evidence requests and their fulfilment state, and the real samples — is what you would hand to an auditor as a starting point.
Risk register
The register does not just list formal risk acceptances. It reads every mechanism in the platform that can leave a risk uncorrected — including the ones that do so quietly, such as a finding suppressed as a false positive with no review date attached — and grades each one by how rigorous the decision behind it actually was, rather than counting only the ones made through the proper channel. A risk acceptance with no review date is treated as a permanent silence, not a resolved item: it is always shown, and it never ages out of view on its own.
Remediation tracking & SLA
A remediation deadline is derived from a finding's severity, and the clock starts at the moment the finding was first seen — re-scanning the same target does not reset it, so a defect cannot be kept perpetually fresh just by scanning it again. If a deadline is later negotiated by hand, that agreed date takes precedence over the computed default and is never silently overwritten. Severity can be re-rated later, which can legitimately extend a deadline going forward, but a breach that already happened stays on the record — a later downgrade cannot retroactively make a missed deadline disappear.
Governance page
Governance brings together the evidence that does not fit neatly into a single control: business-continuity objectives and whether real drills have met them, an underwriting-style questionnaire answered from what the platform can actually substantiate rather than asserted, your coordinated-disclosure posture, and backup verification and governance (whether a restore was actually proven, and whether your only copies live under one actor's control). Web3 protocols additionally get an upgrade-governance check: whether a declared timelock delay can actually be shortened by the same authority that proposes changes, which is the difference between a real delay and one that only looks like one in the function signatures.
What it stops short of
- The control map is an evidence map, not a certification, an audit, or an opinion — see the disclaimer above.
- A "cannot ask" control is not evidence of a problem; it means the platform could not evaluate it, which is itself worth fixing before an audit.
- Point-in-time evidence is not period evidence: a control substantiated today says nothing by itself about last quarter.
- The risk register and remediation tracking report what this platform can observe about your own environment; they are not a substitute for your own risk management process.