What is available today

Frameworks

Kanonik works with 17 frameworks: SOC 2, ISO/IEC 27001, HIPAA, GDPR, NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 2, NIST SP 800-171 Rev. 3, FedRAMP Rev. 5 baselines, GovRAMP Rev. 5 baselines, CCPA/CPRA, DORA, NIS2, NYDFS Part 500, EU AI Act, NIST AI RMF 1.0 and NIST SSDF.

NIST CSF 2.0 and GDPR come with every plan. SOC 2, ISO 27001 and HIPAA are the audited frameworks: Audit-Ready includes one of them, and you can add another for $3,000 a year. For ISO 27001, Kanonik uses the clause numbers with its own descriptions, never the standard's text, and asks you to confirm you hold a licensed copy before it builds your audit package. Plans and pricing has the details.

The record underneath is framework-agnostic. A control is authored once, and each activated framework projects onto it, so working to a second framework is mostly recognition of work you already did.

How we build it

We build Kanonik to NIST SP 800-53, the control set FedRAMP is built on. Our Go services run Go's FIPS 140-3 module, in FIPS mode. Our application services talk over mutual TLS.

The architectural controls an auditor would look for are built and running: the approval gate, the signed hash chain, the audit log that rejects edits and deletes, and signed container images. Nobody can change the record without the change showing. See Security for the mechanisms themselves.

If you need a specific answer for your review, email [email protected].

What your AI can do with it

Your AI drafts policies, controls and evidence, answers a buyer's security questionnaire from your record with the source beside each answer, and checks a planned change with Foresight. Approval requests can also reach you in Slack. Your auditor gets a Sealed Audit Package they can check offline.