Secani links requirements, measures, evidence, risks and assets as typed relations. Document a measure once, reuse it across frameworks, and let the graph work out what is met and what is missing.
Every framework, risk and audit reads from the same connected records.
01
A measure is stored once and linked to every requirement it serves, in any framework. No second spreadsheet per standard.
Requirements link to measures as implements, supports or compensates; evidence links as supports, contradicts, qualifies or contextualizes.
02
Whether a requirement is met is computed from applicability, implementation, evidence and assessment. Nobody keeps a traffic-light column up to date.
There is no default path to satisfied: without a satisfied assessment and sufficient evidence, the result stays unknown.
03
Measures a provider or a parent unit already runs flow down to the units that rely on them, with a rule for who wins on conflicts.
Inheritance follows explicit edges only, never graph proximity, with source-wins, consumer-override or strict-union policies.
Each row is a step your team does by hand today.
Documenting the same measure again for each framework
One measure, linked to every requirement it serves
Updating a status column per requirement by hand
Status computed from applicability, implementation, evidence and assessment
Copying controls from the provider or parent unit to every child
Inherited along explicit edges with a conflict rule
Reconstructing who changed what before an audit
Every change in a hash-chained history with its actor
How often does your team document a measure again for another framework?
Hours per year spent on duplicates
40
Your numbers, multiplied: duplicates × minutes. Nothing of ours goes into the result.
The graph only knows what someone linked and approved.
A requirement-to-measure link is requested, decided or withdrawn like any other change, and every decision is recorded.
Each change is a SHA-256-chained event that covers every stored column, including who made it: a person, the agent on someone's behalf, or the system.
Edits carry a content hash. If the record changed underneath you, the edit fails instead of overwriting someone else's work.
Yes. A measure is stored once in the workspace and linked to requirements in as many frameworks as it serves. Each link says whether it implements, supports or compensates the requirement.
It evaluates applicability, implementation, evidence and assessment, plus exceptions, in a fixed order. Satisfied needs a satisfied assessment, sufficient or partial evidence and no active exception. Anything less stays not satisfied or unknown.
No. The agent can propose links. A person approves them, and the history records the agent as the actor together with the person it acted for.
The history is an append-only SHA-256 hash chain, and its integrity can be verified. Each event keeps the actor, the time and what changed.
Let one connected model answer for every framework.