HodeiShield®

Upload the evidence once and count it in every framework.

Every piece of evidence has an owner, a validity date and a status, and once expired it stops counting. A crosswalk ties each control to its equivalents in other frameworks, and a roadmap orders what is missing.

For: Compliance leads who carry several audits at once (ISO 27001, ENS, NIS2, DORA, GDPR, SOC 2) with the same controls repeated in each.

Request a demoRead the compliance docs (opens in a new tab)
  • 17 frameworks, with coverage measured against the canonical controls
  • Evidence is uploaded or linked by hand; it is not collected from the cloud on its own

Evidence engineThree pieces of evidence

Sample data

  • Encryption policy

    Current

    Head of security2027-03-31

    Counts towards: ISO/IEC 27001ENSNIS2One upload, three frameworks.

  • Penetration test report

    Expiring soon

    Operations2026-11-15

    Counts towards: ISO/IEC 27001DORASOC 2Reminds you before it lapses.

  • Continuity plan

    Expired

    IT management2026-06-30

    Counts towards: ISO/IEC 27001DORANIS2Stops counting until it is renewed.

ENS · measured coverage

52 of 74 controls

Measured against HodeiShield's 74 controls based on ENS Annex II. Not a clean bill.

Sample data: the evidence, dates and coverage are fictional.

Where it sits in the cycle

Compliance is where the four phases are measured against a rulebook.

  1. SENSE · collect evidence

    Evidence with an owner, validity and status, plus the endpoint agent's signed observations.

  2. PREDICT · quantify and simulate

    Per-framework posture measured against the canonical controls, a crosswalk across frameworks and a prioritised roadmap.

  3. ACT · propose and approve

    Risk-register proposals that a person with a write role approves, and reminders before evidence expires.

  4. ATTEST · prove it to third parties

    Per-framework maturity bands that the Trust Center attests; never scores.

From the frameworks that apply to you to the roadmap

The order in which someone running several audits works, with each step in the same system.

  1. You declare which frameworks apply

    You pick your frameworks and, where the rule asks for it, the system profile. For the ENS: category and security dimensions, with HodeiShield's 74 controls based on ENS Annex II (Royal Decree 311/2022), by basic, medium and high level.

  2. Each framework breaks into controls

    NIS2 into its Article 21(2) measures, the ENS into HodeiShield's 74 controls, DORA into the ICT provider register, the incident classifier and the indicators. Every control is tied to the evidence that backs it.

  3. Evidence carries an owner and a date

    Owner, validity date and status (current, about to expire, expired). Expired evidence is not dropped silently: it is flagged and stops counting until you renew it.

    Scope. You upload or link document evidence yourself. Cloud collectors (Microsoft 365, AWS, Google, Azure) are planned, not live.

  4. The crosswalk stops you answering twice

    The same technical control, say encryption in transit, shows up in several frameworks. The crosswalk ties it to every obligation it meets, and one answer propagates to the equivalent controls.

  5. You see the posture, measured

    Per framework: what share of the controls is covered, which has expired evidence and which has none. Coverage is reported against each framework's canonical controls.

    Scope. «Audit-ready» depends on your evidence. HodeiShield does not guarantee passing an audit.

  6. The roadmap orders the work

    Which control to tackle first by its weight in the framework and its estimated effort, so you go from «no evidence» to «ready to audit» in the useful order, not the alphabetical one.

What it does, with its proof and its scope

Each claim carries, in the margin, where to check it and where it stops.

Source of proof

  • Public documentation
  • Open source
  • In the demo

Scope: what the claim does not cover

SENSE · collect evidence

The evidence behind each control, with the date after which it stops being valid.

  1. Every piece of evidence has an owner, a validity date and a status; once expired it stops counting towards the framework's posture until renewed.1

    Docs · Compliance (opens in a new tab)

    Scope. Evidence is uploaded or linked by hand; there is no automatic collection from the cloud.

  2. The compliance role gets a reminder before evidence expires, with time to renew it.2

  3. The endpoint agent's signed observations supply technical evidence from your machines, and a machine that stops reporting stops counting as compliant.3

    Docs · Endpoint agent (opens in a new tab)

    Scope. Covers the agent's own checks. The open baselines (level L1) are shown as detail and do not yet feed the compliance score.

Applies inEndpoint security

PREDICT · quantify and simulate

Turns evidence into a per-framework posture and a work order.

  1. Posture against 17 frameworks: ENS, NIS2, DORA, GDPR, SOC 2, ISO 27001, ISO 42001, NIST CSF 2.0, PCI DSS v4.0, EU AI Act, HIPAA, CMMC 2.0, Cyber Essentials, UAE IA (NESA), SAMA CSF, Saudi ECC-1:2018 and Nigeria NDPA 2023.4

    Docs · Compliance (opens in a new tab)

    Scope. Coverage measured against each framework's canonical controls; never a clean bill of health.

  2. The crosswalk ties a control to its equivalents in the other frameworks, so you evidence it once and do not repeat the work.5

    In the demo · crosswalk view

    Scope. An equivalence does not replace the judgement of each framework's auditor.

  3. A roadmap prioritises which controls to tackle first by their weight in the framework and estimated effort.6

  4. Coverage is reported as «measured against the canonical controls»: what is missing shows as missing, never as a blank clean bill.7

    In the demo · posture panel

    Scope. Being audit-ready depends on the customer's evidence.

Applies inENSNIS2DORA

ACT · propose and approve

What gets governed once you know what is missing.

  1. HodeiAI can propose an entry in the risk register; only a person with a write role creates it, through a single-use approval valid for 15 minutes and bound to the proposal's hash.8

    In the demo · proposal and approval

    Scope. It is the only executable action today. It does not close controls or upload evidence for you.

  2. A policy library with versions and a record of every change, tied to the crosswalk controls, with an analysis of which controls each policy set covers.9

    In the demo · policy library

    Scope. A policy covered on paper does not prove it is applied.

Applies inHodeiAI

ATTEST · prove it to third parties

The part of your posture you can show a customer or an auditor.

  1. The Trust Center issues an ML-DSA-65 signed attestation with each framework's maturity band and the weakest band, verifiable offline.10

    Open source · ATTEST verifier (opens in a new tab)

    Scope. Four bands per framework, never scores or amounts. It is a signed self-assessment: it proves integrity, origin and time, not truth, and it replaces neither an audit nor a certification.

Applies inTrust Center and ATTEST

SENSE feeds PREDICT; PREDICT prioritises what ACT proposes; ATTEST proves it to third parties.

What it does not do

So you know where your own work begins.

  • It does not collect cloud evidence on its own: the Microsoft 365, AWS, Google and Azure collectors are planned, not live.
  • It does not guarantee passing an audit and certifies no one; «audit-ready» depends on your evidence.
  • It does not turn coverage into a guarantee: «audit-ready» depends on your evidence.
  • It does not turn endpoint baselines into a compliance score; today they are detail.
  • A crosswalk equivalence guides the work, but how each rule is read stays with your auditor.

How it connects to the other solutions

Compliance consumes what the others produce and hands over what is later attested.

Questions from whoever runs the audits

The usual objections, answered as they are.

Does it collect the evidence on its own?

No. Evidence is uploaded or linked by hand. Cloud collectors for Microsoft 365, AWS, Google and Azure are planned, not live. The endpoint agent does supply signed observations, within the checks it runs.

Which frameworks does it cover?

Seventeen: ENS, NIS2, DORA, GDPR, SOC 2, ISO 27001, ISO 42001, NIST CSF 2.0, PCI DSS v4.0, EU AI Act, HIPAA, CMMC 2.0, Cyber Essentials, UAE IA (NESA), SAMA CSF, Saudi ECC-1:2018 and Nigeria NDPA 2023. For all of them, coverage is reported as measured against each framework's canonical controls.

Does it guarantee I will pass the audit?

No. It measures your coverage over each framework's canonical controls, orders the work, makes what is missing visible and avoids repeating evidence, but being ready for an audit depends on the evidence you provide and on your auditor's judgement.

What happens when evidence expires?

It is flagged as expired and stops counting towards the framework's posture until you renew it. It is not silently dropped. Before it expires, the compliance role gets a reminder.

Does it work for the ENS if I am a local authority?

Yes: the ENS is measured with HodeiShield's 74 controls based on ENS Annex II (Royal Decree 311/2022), at basic, medium and high level. Hodeitek S.L. is certified at ENS Medium category with a scope that includes HodeiShield; that does not certify your organisation's ENS.

Does endpoint data score my compliance?

The agent's point-in-time checks do feed the endpoint posture. The 143 open baselines (level L1) are shown as per-machine detail and do not yet feed the compliance score.

Put your framework mix on the table

In the demo we load your frameworks and walk the evidence, the crosswalk and the roadmap with your case.

The compliance docs and the compliance-role guide are public.

Request a demoRead the documentation (opens in a new tab)