Keep the mapping version.
Conformance packets record the catalog version used to associate their evidence with framework references.
Connect the requirement to the record.
Bring governance evidence into AI, security, and privacy reviews, with a clear view of what is mapped and what still needs assessment.
Compliance frameworks
Selected catalog mappings and architecture alignment, with scope made explicit.
Start with the framework your review depends on.
Each page explains the relevant product records, the limits of coverage, and the work that remains with your organization and reviewers.
Selected catalog mappings
Product records are associated with selected framework references.
Catalog 2026.09.2AI regulation
EU AI Act
Logging, oversight, and disclosure records for selected AI Act references.
Explore EU AI Act Voluntary AI risk frameworkNIST AI RMF
Selected Govern, Measure, and Manage references with evidence gaps visible.
Explore NIST AI RMF AI management system standardISO 42001
Event, oversight, and documentation records for AI management reviews.
Explore ISO 42001Architecture alignment
Relevant controls and data practices, without a current receipt-catalog crosswalk.
Independent assurance
SOC 2
Access and action records to support an independent assurance review.
Explore SOC 2 Information security management standardISO 27001
Access, protection, and accountability within security management.
Explore ISO 27001 Data protection regulationGDPR
Scoped collection, temporary source processing, and deliberate data lifecycles.
Explore GDPRMake evidence traceable from the action onward.
A useful review connects the event, the control reference, and the scope of what was captured.
01
Recorded action
Actor, verdict, policy, and basis
02
Catalog reference
Version 2026.09.2
03
Scoped review
Evidence, integrity, and coverage
Keep the coverage visible.
Enforced, observed, and not-evidenced records remain distinct. A catalog reference alone does not establish evidence.
Keep the assessment in context.
Reviewers determine whether the record is sufficient for the requirement and scope under examination.
Orcinta Attest
Give reviewers a defined record to examine.
Where Attest is available, conformance packets bring together scoped history, integrity checks, selected control references, and evidence coverage.
Explore reconstruction and auditA review starts with its scope.
- Who
- Organization or registered agent
- When
- A defined review window
- What
- Recorded decisions and supporting evidence
- Coverage
- Enforced, observed, or not evidenced
Packet availability and evidence scope are confirmed for the deployment.
Understand what the mapping means.
What does a catalog mapping tell us?
It identifies the product records associated with selected framework references. A mapping can exist even when no qualifying activity appears in the packet’s scope or review window. It is an advisory reference rather than a compliance finding.
What is included in architecture alignment?
It describes relevant product mechanisms, such as scoped access, audit history, and temporary source processing. SOC 2, ISO 27001, and GDPR are not currently mapped in the receipt catalog.
Can we use conformance packets in a review?
Where Attest is available, a packet brings together scoped records, integrity checks, selected control references, and evidence coverage. The reviewer must assess whether the material is sufficient for the specific requirement.
Does verification establish compliance?
No. Verification checks the integrity of the recorded history. It does not establish the correctness of a decision, the adequacy of a control, or compliance with a framework.
Bring a real requirement to the review.
Walk through the evidence your team needs and where the product can contribute.