One assessment, mapped to 22 compliance frameworks

What’s new

In June 2026 Kapālins built a compliance crosswalk that registered 22 frameworks and mapped 69 controls in 19 of them to one bank of assessment questions. The rest were added later.

The crosswalk maps each framework’s obligations to the platform’s assessment questions. It then scores each control two ways: self-attested from assessment answers and, where the platform can measure it, live-verified from platform signals. In June a minority of controls had a live signal; today 93 of 217 do.

Why it matters

The crosswalk keeps what a person declared apart from what the platform measured, so a reader can see which one stands behind each control.

Because the questions and signals are shared, one set of assessment answers and one set of platform signals count towards every framework that maps to them.

How it works

On kapalins.com today, each control is proved by assessment answers, by a live signal from the platform, or by both. A live signal that contradicts the answers wins, and a control with no evidence reads not assessed and still counts against the framework.

The site follows one control through the chain. OWASP LLM01, prompt injection, leads to a control that blocks injection attempts before they reach a model, then to an assessment question that asks whether such a layer exists, then to two live signals: the firewall block rate and the injection probe pass rate.

Availability

The crosswalk was completed on 3 June 2026 and became available in production when the Kapālins platform went live on 26 July 2026. Kapālins now maps controls across 42 compliance frameworks in 15 jurisdictions plus global standards, with 217 controls, 93 of them read live from the platform.

Compliance & Evidence is included in the Growth plan, and Fortress adds assurance on top.