GRC and AI Governance Glossary

It determines whether AI output can be trusted for audit work. AI retrofitted onto disconnected records cannot trace its answers to verifiable sources.

An analyst asks which frameworks are affected by a failed access control and receives an answer that cites the specific control, evidence artifact, and framework mappings behind it.

Kyūdō implements this with Sensei AI Advisor, which retrieves deterministically from the Compliance Graph and cites its source nodes.

Evidence quality depends on signal fidelity. Reading the primary source removes the lag and loss that generic connectors introduce.

A conditional access policy change in Entra ID appears as refreshed control evidence without anyone exporting a report.

Kyūdō converts Defender XDR, Sentinel, Purview, Entra ID, and Azure Policy signals into scored evidence, and also ingests AWS, Google Cloud, and Oracle Cloud signals.

Compliance data describes an organization's weakest points. Regulated entities increasingly require that this data never sit in another company's cloud.

A defense contractor runs its full GRC stack inside its own Azure tenant, so no external party ever holds a copy of its control evidence.

Kyūdō deploys via Azure Managed Applications inside the customer's Azure tenant with no cross-tenant data plane and AI inference on in-tenant Azure OpenAI Service.

It changes who holds the data and who sets the security boundary. The customer's existing identity, network, and monitoring controls apply directly to the platform.

A bank deploys its GRC platform into its own subscription, puts it behind private endpoints, and audits it with the same tooling as any internal system.

Kyūdō ships as an Azure Managed Application that installs into the customer's tenant with private endpoints only.

Point-in-time testing leaves long blind windows between assessments. Continuous evaluation shows posture as it is now, not as it was at the last audit.

An encryption control flips to failing within hours of a storage account being misconfigured, rather than surfacing months later during audit preparation.

Kyūdō recalculates control status as Microsoft Defender XDR, Sentinel, Purview, Entra ID, and Azure Policy signals arrive.

Manual evidence gathering is the largest recurring cost in most compliance programs, and hand-collected artifacts go stale immediately.

Instead of screenshotting an MFA configuration each quarter, the platform pulls the setting from the identity provider and records it with a timestamp.

Kyūdō converts Microsoft security signals into evidence artifacts that each carry a hash, lineage, and confidence score.

Assessors discount evidence they cannot verify. Provenance turns a screenshot-grade artifact into a defensible record.

An access review artifact shows the exact query that produced it, when it ran, and a hash proving it has not been altered since collection.

Every artifact in Kyūdō carries a hash, lineage, and confidence score from the moment it is created.

Compliance questions are relationship questions: which risks does this control treat, which frameworks does this evidence satisfy. A graph answers them directly.

When a control fails, the graph immediately shows the affected risks, framework obligations, and vendor relationships connected to it.

Kyūdō's Compliance Graph is the substrate Sensei AI Advisor retrieves from, which is what lets its answers cite source nodes.

A vendor's security failure becomes your incident. Regulators and customers increasingly hold organizations accountable for their supply chain.

Before renewing a payroll provider, the security team reviews its assessment responses, certifications, and open findings in one place.

Kyūdō scores vendors on the same Compliance Graph as internal controls, so a vendor's weakness maps to the specific obligations it threatens.

Risk enters through any connected party, not only paid vendors. TPRM widens the assessment boundary to match the real attack and compliance surface.

A marketing agency with access to the customer database is assessed with the same rigor as a software vendor, because the exposure is equivalent.

Kyūdō models all external parties as entities in the Compliance Graph, linked to the systems and data they touch.

Your data may be processed by AI models you never evaluated and never contracted with. Standard vendor questionnaires rarely surface this layer.

A CRM vendor adds an AI assistant built on a third-party model, and customer records begin flowing to a model provider you have no agreement with.

Kyūdō's vendor assessments capture embedded AI usage and link it to the platform's AI governance controls in the Compliance Graph.

AI obligations are now dated regulatory requirements, with EU AI Act obligations applying from August 2026. Organizations need an inventory of AI systems and evidence of the controls around them.

A company classifies an internal hiring screener as high risk under the EU AI Act and documents the human oversight and logging controls attached to it.

Kyūdō ships 156 AI governance controls covering the EU AI Act, ISO 42001, and the NIST AI RMF, with AI systems as first-class entities in the Compliance Graph.

Most frameworks overlap heavily. Without inheritance, teams re-implement and re-evidence the same safeguard for every new obligation.

One MFA implementation, evidenced once, satisfies related requirements in SOC 2, ISO 27001, and CMMC simultaneously.

Kyūdō's unified catalog of 1,400+ controls maps each implementation across 80+ frameworks through the SCF crosswalk.

It converts multi-framework compliance from parallel projects into one program. The quality of the mapping determines how much work is actually saved.

A crosswalk shows that an access control requirement in ISO 27001 corresponds to specific requirements in SOC 2 and NIST 800-171, so one implementation covers all three.

Kyūdō uses the Secure Controls Framework crosswalk with STRM semantic mapping (NIST IR 8477) to relate 1,400+ controls across 80+ frameworks.

A control can look implemented while individual objectives inside it fail. Objective-level tracking shows readiness the way the assessor will actually score it.

A CMMC practice with five assessment objectives shows four met and one open, instead of a single misleading green checkmark on the practice.

Kyūdō tracks evidence against individual assessment objectives in the Compliance Graph, with CMMC Phase 2 enforcement beginning November 10, 2026 as a common planning anchor.

Security questionnaires stall deals. A current, self-serve posture page answers most diligence questions before they are asked.

A prospect reviews a vendor's control summaries and subprocessor list in its trust center and skips forty questionnaire items.

Kyūdō's Trust Center publishes posture drawn from the same live Compliance Graph that drives internal monitoring, so the public page and the internal state cannot diverge.

Auditors test whether policies are current, approved, and acknowledged. An unmanaged policy set fails all three quietly.

An acceptable use policy moves through review and approval, employees attest to it, and the system schedules its next review date automatically.

Kyūdō's Policy Center links each policy to the controls it mandates in the Compliance Graph, so a policy change surfaces the controls it affects.