ZAGOS

Live workspace. Durable storage schema active — live connectors, billing, and AI automation are activation-gated.View Activation Status

Signed out

Evidence traceability

Evidence-to-framework traceability view

One evidence item can support multiple frameworks. This view shows how local evidence maps to controls, findings, and remediation workflow recommendations.

Evidence: browser

Findings: browser

Missing evidence gaps

Weak evidence gaps

Expired evidence

Reused evidence

Evidence coverage by framework

Controls with at least one linked evidence item in the sample catalog.

ISO 42001

1/2 controls with evidence -1 verified evidence records

50%

EU AI Act

0/2 controls with evidence -1 verified evidence records

NIST AI RMF

0/1 controls with evidence -0 verified evidence records

GDPR

4/5 controls with evidence -1 verified evidence records

80%

ISO 27001

2/3 controls with evidence -0 verified evidence records

67%

SOC 2

1/2 controls with evidence -0 verified evidence records

50%

ISO 28000

2/5 controls with evidence -0 verified evidence records

40%

Cloud/API Guard

2/5 controls with evidence -0 verified evidence records

40%

Controls with missing evidence

Detected by required evidence type.

AI system inventory

high

A.6.2.2 needs system config

Human oversight

high

Art.14 needs policy document

Human oversight

high

Art.14 needs attestation

Transparency and provision of information

medium

Art.13 needs policy document

Transparency and provision of information

medium

Art.13 needs screenshot

AI system impact assessment

high

A.8.3 needs risk assessment

Controls with weak evidence

Linked evidence exists but confidence is low.

Storage limitation / data retention

high

Linked policy document exists, but it is not verified high-confidence evidence.

Security of processing

high

Linked scan result exists, but it is not verified high-confidence evidence.

Access control

high

Linked log export exists, but it is not verified high-confidence evidence.

Use of cryptography

high

Linked scan result exists, but it is not verified high-confidence evidence.

AI usage & billing anomaly detection

high

Linked log export exists, but it is not verified high-confidence evidence.

Supplier security assessment

high

Linked vendor doc exists, but it is not verified high-confidence evidence.

Expired evidence

Evidence needing refresh before audit review.

Storage limitation / data retention

high

1 linked policy document item(s) are expired.

Evidence reused across frameworks

Professional audit readiness depends on reusable evidence packs, not duplicated spreadsheets.

AI Inventory export (ZAGOS Governance)

Snapshot of 14 registered AI systems with risk classification from the Governance module.

Supports 2 frameworks and 2 controls

Verified

Encryption configuration scan

TLS 1.2+ enforced; at-rest encryption enabled on primary datastore.

Supports 2 frameworks and 2 controls

Collected

Records of Processing Activities (RoPA)

Current RoPA covering 22 processing activities with lawful basis mapping.

Supports 1 frameworks and 2 controls

Verified

IAM policy export

Exported IAM bindings for review of least-privilege adherence.

Supports 3 frameworks and 3 controls

Pending review

Supplier security questionnaire — Acme Logistics

Partially completed supplier questionnaire — sections on encryption missing.

Supports 1 frameworks and 2 controls

Pending review

Traceability graph

List-style graph: evidence to frameworks, controls, findings, and workflows.

Evidence	Frameworks	Controls	Findings	Workflows
AI Inventory export (ZAGOS Governance) May 20, 2026	ISO 42001 EU AI Act	A.6.2.2	Missing AI system inventory coverage	Review AI system classification
Encryption configuration scan May 25, 2026	GDPR ISO 27001	Art.32 A.8.24	No linked findings	No workflow mapped
Data retention policy v3 Mar 1, 2026	GDPR	Art.5(1)(e)	Missing / expired data retention policy	Request missing evidence
Records of Processing Activities (RoPA) Apr 10, 2026	GDPR	Art.6 Art.30	No linked findings	No workflow mapped
IAM policy export May 26, 2026	ISO 27001 SOC 2 Cloud/API Guard	A.5.15 CC6.1 CAG-5	Risky service account with long-lived key	Review AI system classification
Supplier security questionnaire — Acme Logistics May 5, 2026	ISO 28000	SC-1 SC-3	Incomplete supplier security evidence	Request missing evidence
AI provider usage log (sample) May 27, 2026	Cloud/API Guard	CAG-4	AI billing spike anomaly	Investigate AI billing spike