Compliance Mapper

Overview

Compliance Mapper systematically maps your entire document corpus against regulatory and industry frameworks, producing an interactive compliance matrix that shows exactly where you have coverage, where you're partially addressed, and where critical gaps exist.

Unlike point-in-time compliance assessments, this matrix updates automatically as new documents are ingested — turning compliance from a periodic audit exercise into continuous monitoring.

The Problem

• The global compliance market exceeds $40B — organizations pay consultants enormous fees for framework mapping that goes stale immediately
• Compliance teams manually cross-reference hundreds of documents against framework requirements, a process taking weeks to months
• Gap identification happens reactively during audits rather than proactively during operations
• Multiple overlapping frameworks (SOC 2, ISO 27001, GDPR, HIPAA, PCI-DSS) create exponential complexity
• Coverage quality is subjective without systematic evidence evaluation

How It Works

1. Framework library — Maintain taxonomies for major frameworks: SOC 2, ISO 27001, GDPR, HIPAA, NIST CSF, Basel III, PCI-DSS, and custom user-defined frameworks
2. Semantic mapping — For each framework requirement, perform semantic search across the corpus for relevant content
3. Coverage evaluation — LLM assesses coverage quality per requirement: full (evidence directly addresses it), partial (related but not specific), or gap (no supporting documentation)
4. Interactive matrix — Assemble into a drill-down compliance matrix with source document links and evidence excerpts
5. Trajectory tracking — Monitor coverage trends over time: improving, declining, or stable per requirement
6. Signal integration — Fire alerts when coverage drops below configurable thresholds or when regulatory framework updates are detected

User Story

A CISO selects "SOC 2 Type II" and "ISO 27001" as target frameworks. Condelo analyzes all documents in the space and produces a compliance matrix: green (covered with evidence), yellow (partially addressed), red (no coverage). "Requirement CC6.1 (Logical Access Controls) is covered by 3 documents with strong evidence. Requirement CC7.2 (System Operations Monitoring) has no supporting documentation." When the security team uploads a new monitoring policy, the matrix updates automatically — CC7.2 shifts from red to yellow. The CISO exports the matrix for their next board presentation with confidence that it reflects the current state.

Complexity & Timeline

Target Clients

• Personas: CISOs, Compliance Officers, GRC Managers, Audit Partners, Legal Counsel
• Verticals: Financial Services, Healthcare, Technology, Government, any regulated industry
• Pitch: "See your compliance posture in real time — not once a year when auditors arrive."

Revenue Potential

Enterprise-tier feature with clear ROI: replaces consultant-led gap analyses costing $50K–$200K per engagement. This capability alone can justify an enterprise subscription for GRC teams. Opens new buyer personas (compliance officers, audit firms, legal departments) who aren't typical knowledge management customers. Natural bundling with Blindspot Detector for a "coverage & compliance" package. The $40B+ compliance market represents a massive expansion opportunity.

Feature Synergies

• Blindspot Detector — Framework gaps are the most actionable type of blindspot; shared infrastructure for gap analysis
• Live Intelligence Feeds — Monitor regulatory agency feeds to detect framework updates that affect compliance status
• Source Trust Scoring — Weight compliance evidence by source reliability; flag requirements covered only by low-trust documents

Risks & Open Questions

• Framework taxonomy library requires ongoing maintenance as regulations evolve
• Coverage evaluation by LLM introduces subjectivity — "partial coverage" assessments may not match auditor expectations
• Organizations may treat the matrix as a substitute for professional compliance assessment, creating liability concerns
• Multi-framework overlap analysis (showing which documents satisfy requirements across multiple frameworks) adds significant complexity