Platform · Prove
A green tick is a claim. Read-back is evidence.
Most governance tools show a control as on. Govern360 reports it as one of three things - compiled into an enforcement plane, marked applied by a person, or verified by reading the live configuration back - because only the third is evidence, and an auditor who asks one follow-up question will find out which you meant. Every control maps to the frameworks you are held to, and the evidence accrues continuously rather than in the week before a review.
Three honest states
Demonstration tenantOnly Verified is evidence. It is claimed where a platform exposes a read-back path and confirmed the state — and nowhere else.
Prove answers one question: can you show a regulator, an auditor or your board that the control was actually applied? Continuous evidence mapped to the frameworks you are held to, traceable from any number back to the configuration behind it.
Today’s reality
A dashboard that is green because nothing was measured is worse than no dashboard.
Most compliance tooling reports a control as satisfied when a policy exists saying it should be. The policy is a statement of intent. Whether the platform actually applied it, and still applies it today, is a different question and usually an unasked one.
Auditors and boards are increasingly asking the second question. Answering it means reading state back from the platform that enforces it, recording what was read and when, and reporting not assessed where nothing could be read rather than defaulting to a green tick.
What prove covers
Eight things, named as the modules that do the work rather than the outcomes they promise.
Compiled, marked applied, verified
Three honest states for every control, never collapsed into one tick. Verified is claimed only where a platform exposes a read-back path and confirmed the state.
A tool that shows green without saying which is asserting something it never checked.Action lineage
A policy traced through to its compiled artifact and then to its applied state, so a control can be followed end to end rather than asserted at the endpoint.
Answers the auditor question: show me how this got there.Hash-chained audit log
Decisions, approvals and changes written to a chain that can be verified, so integrity is checkable rather than taken on trust.
An audit log you cannot verify is a text file with good intentions.Six frameworks, plus CIS
Evidence mapped to the EU AI Act, ISO/IEC 42001, NIST AI RMF, SOC 2, HIPAA and GDPR, and CIS Controls v8 - each control traceable to the finding that satisfies it.
Mapped, not marketed - including the controls that map to nothing yet.Evidence packs
Token, governance and posture evidence exported as coherent packs across more than forty measured controls, rather than screenshots assembled the night before.
Reproducible for any past period.Board pack
A six-page export: the score with its band, coverage, what moved, top findings, decisions outstanding and the honest limits.
Written to survive a follow-up question.SIEM streaming
Governance events streamed to Splunk, Sentinel, Datadog or wherever you already look, so AI governance stops being a separate console.
Your existing detection content keeps working.Not measured, stated
Dimensions that could not be assessed are named and excluded rather than scored zero, and the coverage fraction is published beside every number.
Showing the gap beats colouring it in.How it works
Four stages. The order matters more than the speed.
Each control requirement across the six frameworks is mapped to the finding or configuration that would satisfy it - including, explicitly, the requirements nothing currently satisfies.
Evidence accrues continuously from configuration readings, decisions and read-backs rather than being assembled in the weeks before an audit.
Where a platform exposes a read path, the applied state is read from that platform and the control moves to Verified. Where it does not, the control stays Compiled and says so.
Evidence packs, the Agent Passport and the six-page board pack export on demand, each traceable from the number to the configuration behind it.
Evidence, not assertions.Control state read back from the platform that enforces it, with the date attached and the gaps named.
Get my AI Exposure ScoreThe three states, and why the distinction is the product
This is the smallest idea on the site and the one most worth understanding, because it is what separates evidence from assertion.
- Compiled. The control was written into an enforcement plane. Govern360 knows it sent it. Nothing yet confirms the plane accepted or is enforcing it.
- Marked applied. A person asserted that the control is in force. That is a human record, useful and auditable, but it is testimony rather than measurement.
- Verified. The applied state was read back from the platform that enforces it, and matched. This is the only state that is evidence, and it is available only where the platform exposes a read path - which is why some controls will never reach it, and the matrix says which.
- Why it matters commercially. Every competitor can show a green tick. Almost none will tell you which of these three it means. An auditor asking one follow-up question is where that difference gets expensive.
Know what you know — and what you do not
A governance product that produces false confidence is worse than none, because it moves risk from visible to invisible. Where a platform is not connected or a dimension cannot be measured, Govern360 reports not measured rather than assuming there is nothing there — so you can always tell the difference between measured and safe and simply not measured.
Prove measures evidence coverage across more than forty controls, the share of controls that reach Verified rather than stopping at compiled, audit-chain integrity, and framework mapping completeness. It is often the highest-scoring dimension on first measurement, which is worth reading carefully: strong compliance posture beside weak control posture usually means the paperwork is ahead of the enforcement.
Where this sits in the platform
Five stages, in order. Each depends on the one before it, which is why an unconnected source weakens everything downstream rather than only its own dimension.
What this page does not claim. Verified is available only where a platform exposes a read-back path; where it does not, the control is reported as compiled or marked applied rather than shown green. Evidence covers the sources you connect. The AI Exposure Score measures governance state and is not validated against incident outcomes. Figures cited here come from a connected demonstration tenant, not a customer estate.
Questions, answered
What does Verified mean here?
That the applied state was read back from the platform enforcing it and matched what was intended. Not that a policy was written, and not that somebody said it was on.
Which frameworks are covered?
The EU AI Act, ISO/IEC 42001, NIST AI RMF, SOC 2, HIPAA and GDPR, plus CIS Controls v8. Each control maps to the finding that satisfies it, and controls that nothing currently satisfies are shown as such.
Is Govern360 itself certified?
It is built to SOC 2 controls with an audit in progress. Not certified, and not claimed. Our infrastructure providers hold their own SOC 2 Type II, which covers their platforms rather than our controls - certifications are not inherited.
Can evidence be reproduced for a past period?
Yes. Evidence packs and cost allocations are replayable for any past period, which is the difference between an audit answer and an audit exercise.
What stops the audit log being edited?
Entries are hash-chained and the chain can be verified. That proves integrity rather than asking an auditor to trust the vendor.
Does this replace our GRC platform?
No. It supplies AI-specific evidence into the GRC process you already run, and streams governance events to your SIEM. Replacing your GRC platform is not the product.
What happens to a control you cannot verify?
It is reported as Compiled or Marked applied and named as such, and the coverage fraction is published beside the score. It is never shown as verified and never counted as zero.
Is the AI Exposure Score validated against incidents?
No. It measures governance state, not incident likelihood, because no incident corpus exists to validate it against. A risk officer will trust that answer more than a confident one, and the methodology page says it plainly.
Go deeper
The detail behind this page, in the form it is usually asked for.
Real output from a tenant: every point traceable, and what the model deliberately excludes.
FrameworkEU AI Act readinessContinuous audit-ready evidence mapped to the EU AI Act, ISO 42001 and NIST AI RMF.
MethodHow the score is builtOne explainable 0-100 measure. Unmeasured dimensions are excluded, never scored zero.
White paperAI Exposure Management 2026Discover every agent, assign ownership, map exposure paths, and prove control.
Evidence, not assertions.
Connect read-only and see which of your AI controls are actually verified, which are only compiled, and which frameworks you could evidence today. Thirty minutes to connect, first evidence within twenty-four hours.