Enterprise GRC Built Around the Controls You Actually Operate
Most GRC platforms organize work around frameworks, assessments, and modules. By contrast, Cyturus starts with the controls your organization actually operates.
This is especially valuable when you manage multiple frameworks, multiple entities, and separate compliance and risk functions. Instead of rebuilding the same work for each requirement, Cyturus connects each framework, evidence item, risk, owner, and organizational scope back to the existing control environment. As a result, one control environment supports multiple regulatory views.
Why does managing each framework separately create so much duplicate work?
A new regulation applies. A customer adds a contractual requirement. An acquisition introduces another control environment. A business unit needs to demonstrate compliance with a framework the rest of the organization does not use.
In most organizations, that becomes another workstream. The team maps the new requirements, collects evidence, updates documentation, assigns owners, and begins tracking remediation efforts. Yet much of that work may already exist elsewhere in the organization, making it difficult to discern what can be reused and what is actually new.
This is the limitation of managing compliance on a framework-by-framework basis. The underlying controls usually overlap. The programs do not. Cyturus changes the operating model by making the control the starting point.
What changes when the control becomes the system of record?
At the center of Cyturus CRT is the Living Control SetTM (LCSTM). The Living Control Set is the organization-specific subset of controls that reflects the controls it actually operates, based on its requirements, environment, risk posture, and existing implementation.
Instead of managing separate copies of the same control inside different compliance programs, the organization manages the operational control once and connects the relevant requirements back to it.
That control can carry implementation status, evidence, policies, procedures, ownership, associated risks and threats, remediation activity, framework-specific requirements (STRM), and the organizational scope.
The compliance team can still work from the framework perspective it needs. The risk team can still manage risk. Internal audit can still review evidence and history. What changes is the architecture underneath them: they are no longer working from disconnected versions of the same reality.
That is control-based governance.
What happens when a new framework or regulation applies?
A new framework should not mean a new compliance program. In CRT, the new requirement is added as a Conformity Assessment and compared against the organization’s Living Control Set. The system identifies which controls are already in place, which existing controls support the new requirement, and what evidence can be carried forward, where additional controls or Assessment Objectives are required, and what work represents a genuine gap.
The organization can evaluate the delta before deciding what to add to the Living Control Set. This is materially different from a static crosswalk. A crosswalk indicates that two requirements are related; Cyturus shows how that relationship manifests within your actual control environment: what is implemented, what evidence supports it, where the gaps are, what risks are associated with those gaps, and which organizational scopes are affected.
Cyturus shows how that relationship behaves within your actual control environment: what is implemented, what evidence supports it, where the gaps are, what risks are associated with those gaps, and which organizational scopes are affected. The framework becomes a view of the control environment rather than a separate universe of work.
Can evidence be reused without losing framework-specific requirements?
Yes. Evidence should be reusable when the same control supports multiple requirements. But that does not mean every framework expects the same proof, wording, frequency, or assessment treatment.
CRT allows both. Evidence can be reused across applicable controls and frameworks, while framework-specific requirements remain visible within each Conformity Assessment.
That matters because reuse without context creates its own problems. A policy may support several frameworks, yet each may have different review expectations. For example, a control may be implemented consistently but require different supporting language in a SOC 2 assessment, a CMMC SSP, or a regulatory examination.
Cyturus allows the organization to reuse what is truly reusable without pretending that the requirements are identical.
How does compliance connect directly to enterprise risk?
This is where control-based governance becomes more than multi-framework compliance.
In many organizations, compliance and risk still operate as separate programs. A compliance gap is identified in one system, while a risk manager updates the risk register elsewhere. Eventually, someone reconciles the two manually.
That creates a fundamental problem: the risk picture can be disconnected from the actual state of the controls. CRT connects them through the same control architecture. Controls in the Living Control Set can be associated with risks and threats, ownership, evidence, and remediation. When a control is deficient, the organization can see the risk context surrounding that deficiency and the remediation associated with it, rather than treating it as an isolated compliance finding.
The goal is not to combine the compliance and risk teams, but to provide both functions with a shared operational source of truth. That direct connection between compliance and risk is one of the core architectural differentiators of CRT.
What does this look like across a complex organization?
Enterprise governance rarely occurs in a single environment. A financial institution may have subsidiaries, acquired companies, business units, and international operations. A university may have a central IT department, research institutes, individual schools, medical operations, and separate campuses. A service provider may manage dozens of clients with different requirements and operating environments.
The control itself may be common, but the implementation may not be. CRT supports that distinction, enabling organizations to manage controls across multiple entities while preserving differences in implementation, evidence, ownership, scope, and applicability with respect to frameworks.
This makes it possible to answer questions that are difficult in a framework-centric system:
How is the same control implemented across our subsidiaries?
Which acquired entity is operating differently?
Where are we duplicating evidence?
Which business units inherited the corporate control?
Where is a local implementation creating additional risk?
The point is not to force every entity into the same implementation, but to make the differences visible and govern them deliberately.
Control-based governance is not another common-controls framework
Common controls reduce duplication by identifying similar requirements. That is useful. But identifying common controls is only part of the problem. The harder question is what happens after the mapping is complete: how can you evaluate the nuances between the common controls language and the framework intent?
Cyturus is designed to operationalize those relationships. The Living Control Set becomes the working control environment. Conformity shows how external requirements relate back to it. Evidence is connected to the controls it supports. Risks and threats remain connected to deficiencies. Different organizational scopes can inherit or implement controls differently.
The architecture is dynamic rather than static. The FASCR model behind CRT refers to this as Threading: relationships between operational controls, Assessment Objectives, frameworks, evidence, risks, threats, and work effort are maintained as part of the operating model rather than as one-dimensional control-to-control mappings.
Built for organizations where complexity is the problem
Cyturus CRT is designed for organizations that have moved beyond managing one or two isolated compliance requirements. It is particularly relevant when you are dealing with subsidiaries, acquisitions, campuses, business units, or client environments; recurring evidence and audit requirements; significant overlap between compliance programs; manual reconciliation between compliance and risk; expanding regulatory requirements, service-provider dependencies, and growing pressure for executive visibility.
If your primary problem is checking off one framework, there are simpler tools. If your problem is governing a complex control environment across many requirements, the Cyturus architecture is designed to work.
What does a new requirement actually change?
That is the question organizations should answer before starting another compliance project. Bring us the frameworks and requirements you manage today, along with the new requirement you are evaluating. We can show you what your existing control environment already covers, what can be reused, where the real control delta exists, what evidence supports those controls, which risks and threats are associated with the gaps, and where the impact changes across entities or organizational scopes. Then use the analysis to decide what changes, what carries forward, and where the impact lands.
What can be reused?
Where does the real control delta exist?
What evidence supports those controls?
Which risks and threats are associated with the gaps?
Where does the impact change across entities or organizational scopes?
See how control-based governance works inside CRT.
Frequently Asked Questions
What is control-based governance?
Control-based governance is an operating model in which the organization manages its actual controls as the primary governance layer and connects regulatory, contractual, risk, evidence, and organizational requirements back to those controls.
Instead of managing each framework as a separate program, manage them as different views of the same underlying control environment.
What is a Living Control Set?
A Living Control Set is the organization-specific subset of controls selected from a Master Control Library that reflects the organization’s actual operating environment, applicable requirements, implementation, and risk posture. It is designed to change as the organization changes. We recommend using the Secure Controls Framework as the Master Control Library, but you may use any other framework.
How is this different from cross-mapping frameworks?
Cross-mapping identifies relationships between requirements. Cyturus uses those relationships operationally. The controls are connected to evidence, implementation status, risks, threats, ownership, remediation, and organizational scope, while each framework can still retain its own requirements and language.
Can Cyturus manage multiple compliance frameworks?
Yes, over 250 frameworks. CRT is designed specifically for organizations managing multiple frameworks and obligations simultaneously. Any new requirement is evaluated against the existing Living Control Set to identify overlaps and gaps before creating additional work.
Can evidence be reused across frameworks?
Yes, yet the CRT also preserves framework-specific evidence expectations and reporting requirements, allowing clear separation between obligations and limitations on reuse when needed.
Does Cyturus connect compliance to risk?
Yes. The same control architecture used for compliance can also connect deficiencies to associated risks and threats, ownership, remediation, and the enterprise risk program.
Does Cyturus support multi-entity organizations?
Yes. CRT can support multiple entities, subsidiaries, business units, campuses, acquired organizations, scopes, or client environments while maintaining visibility across them.
Is Cyturus a traditional GRC platform?
Cyturus provides enterprise governance, risk, and compliance capabilities, but its architecture differs from traditional framework-centric GRC. CRT starts with the organization’s control environment and uses frameworks as Conformity perspectives over those controls.