GRACE

250+Frameworks crosswalked

34Security domains

1,534Controls

The two questions

“Are you compliant right now?
Could you prove it today?”

Most GRC tools can’t answer either without a fire drill, because their status fields are writable — someone typed “compliant” into a box. GRACE removes the box. Status is a projection over the evidence graph, recomputed as evidence arrives, expires, or fails. The answer is always current, and the proof is always attached.

The operating model

Compliance changes tense.

Not a better spreadsheet — a different way of operating. Four shifts define it.

periodic→continuous

Control status is recomputed as evidence arrives, not reassessed at quarter-end.

asserted→derived

A verdict is only as strong as its evidence — and GRACE grades that strength explicitly.

framework-siloed→cross-framework

One piece of evidence, collected once, satisfies every obligation it maps to across ISO 27001, SOC 2, PCI DSS, HIPAA, NIST, GDPR, DORA, FedRAMP, and more.

audit crunch→audit readiness

The audit package is a projection of the ledger, available any day of the year.

The ontology

One graph. Every layer connected.

The constellation above isn’t decoration — it’s the actual shape of the platform. Evidence flows left to right, and each layer only ever asserts what the layer before it can prove.

Assets

Discovered continuously across AWS, Azure, GCP, and your SaaS estate. Every piece of evidence knows which real system it describes.

Evidence

An append-only ledger. Evidence is collected, versioned, and expired — never edited in place — so every past attestation stays reconstructible.

Controls

The unit of truth. A control’s verdict is computed from its live evidence — it has no writable status field, by design.

Frameworks

250+ frameworks — ISO 27001, SOC 2, NIST CSF, PCI DSS, GDPR and more — crosswalked onto 1,534 controls across 34 domains. Map once, attest everywhere.

Findings & Risk

Gaps become findings; findings become quantified risk. Grace-Q turns posture into loss expectancy, not a color on a heat map.

Derived, never typed. If a claim can’t be traced through this graph to evidence, GRACE won’t assert it — and neither should your auditor.

Why teams switch

Built like a ledger, not a spreadsheet.

Evidence

An append-only evidence ledger

Every artifact is immutable once written. Reviews, verdicts, and expirations stack on top — nothing is silently overwritten, so audit history is a fact, not a reconstruction.

collect once · attest everywhere

Discovery

First-party, continuous discovery

Fifteen built-in discovery providers sweep your cloud and SaaS estate on a schedule, turning live configuration into evidence streams — no agents to babysit, no screenshots to chase.

15 providers · aws / gcp / azure CSPM

Grace-Q

Risk you can defend

Monte Carlo simulation over your actual control posture produces annualized loss expectancy with confidence bands. AI answers are grounded in your graph or clearly marked advisory — never the decision of record.

Cyber Risk Quantification · Annual Loss Expectancy · Monte Carlo

Choose your door

One ledger. Two front doors.

Both experiences read the same control-truth ledger — pick the one that fits how your team works today.

Recommended · v2

The graph-native platform: unified compliance universe, continuous discovery, evidence intelligence, and Grace-Q risk quantification.

app.grace.ampcuscyber.com Launch GRACE → Legacy

GRACE Classic

The original workflow-first experience your team already knows. Same data, same ledger — retiring as v2 becomes the single front door.

classic.grace.ampcuscyber.com Access Classic →