Find the gaps early, before an auditor does.
Compliance readiness reads the documents your team already has, checks them against the controls of a public framework, and shows where evidence is missing. Every gap becomes a risk in your work register, so there is somewhere concrete to start.
Enterprise plan only
Readiness only, not a legal opinion
Frameworks
| Framework | Version |
|---|---|
| OWASP ASVS | 5.0 |
| OWASP Top 10 | 2021 |
| NIST SSDF | 1.1 |
| CIS Controls | v8.1 |
| CSA Cloud Controls Matrix | v4.0.12 |
| SOC 2 Readiness | 2026.1 |
Controls come from the frameworks' published catalogues. Need another framework? Tell us.
Run a scan
Open Compliance in the project
Compliance sits in the project's sidebar. Project admins manage its frameworks.Choose a framework
Press Browse Frameworks and track the one you want to check against.See the cost, then scan
Preview Cost estimates the credits for free. The scan charges them when it starts, and refunds them automatically if it fails.
Each control is checked against each document: does this document actually meet the control, not just mention it? The cost depends on how long your documents are and on the framework.
Reading the results
Each framework shows its readiness as Healthy, Tracking, Needs attention or Not assessed. Below it, every control a document does not meet is a finding, with the document and the passage the check relied on.
| Finding status | Meaning |
|---|---|
| Open | A gap nobody has dealt with yet |
| Mitigating | Work is under way to close it |
| Verified | Someone has checked the gap is closed |
| Accepted | The risk is accepted, with a date to review it (30, 60, 90 or 180 days) |
| False Positive | The check was wrong; the control is met |
| Stale | No longer current |
Gaps become work
Every gap a scan finds becomes a Risk in the project's work register, titled with the control, linked to its finding, and ready to assign. Filter the register by source to see only the items compliance raised.
Scan again
Rescan checks the documents that still have open findings. Pairs of a control and a document that have not changed reuse their earlier result, so a rescan costs far less than the first scan.
When your organisation runs scans on its own AI, they use no credits.
What it is not
- An auditor. The output is a checklist for your team, not an attestation.
- A certificate. Stable Baseline does not issue certifications or reports. Those come from accredited bodies.
- A policy library. The frameworks set the controls; your team writes the evidence.
- Proof that a control works. A result reflects what your documents say, not whether your systems do it. Treat every result as something to verify.