The Modern CISO’s Compliance Stack: Frameworks, Automation and AI webinar 

Introduction: What should a modern CISO compliance stack actually look like?

CISOs are being asked to protect the business across more frameworks, more regulatory expectations and more third-party assessments than many compliance programs were built to handle. 

The pressure is not theoretical. PwC’s Global Compliance Survey 2025 found that 85% of respondents said compliance requirements have become more complex in the last 3 years.  

At the same time, regulators are sharpening their focus on cyber resilience, operational disruption and third-party oversight. The SEC’s 2026 examination priorities, for example, include operational resiliency and supervision of third-party/vendor-provided services, while UK regulators have introduced new operational incident and third-party reporting requirements for financial services firms. 

Yet many compliance programs still rely on manual evidence gathering, spreadsheets, repeated questionnaires and point-in-time reviews. That model may have worked when compliance was slower and more contained. It is harder to defend when controls, vendors, frameworks and risks are changing faster than teams can manually assess them. 

That is why CoreStream GRC has brought together Paul Cadwallader, Anders Söberg and Tom Cornelius for a candid discussion on what actually works in modern compliance. 

This is not another AI marketing webinar. It is a practical conversation about the modern CISO’s compliance stack: the frameworks, automation and AI capabilities that can help teams reduce duplication, improve defensibility and focus on higher-value compliance work. 

“Modern CISO Compliance Stack” webinar condensed transcript

Lucy Montague

Welcome to today’s discussion on the Modern CISO’s Compliance Stack. Let’s start with a broad question.

Tom, how does the Secure Controls Framework help security teams have more meaningful conversations with auditors, regulators, and business stakeholders?

Tom Cornelius

Most organizations today operate across multiple laws, regulations, and frameworks. You rarely see a company working solely against ISO 27001 or a single standard. A hospital, for example, may need to address HIPAA, PCI DSS, NIST requirements, state regulations, and international privacy laws simultaneously.

The Secure Controls Framework helps organizations establish a common control set that addresses security, compliance, and resilience requirements across these different obligations.

It also introduces risk weighting. Not all controls are equally important. A missing firewall presents a significantly different level of risk than missing annual awareness training. By understanding control importance and risk impact, organizations can have much more meaningful discussions around risk acceptance, remediation priorities, and compliance posture.

Lucy Montague

Anders, what do you believe is keeping CISOs awake at night?

Anders Søborg

I don’t think regulations themselves are what’s keeping CISOs awake.

The challenge is assurance. CISOs want confidence that controls are actually operating as intended, and they need to demonstrate that confidently to customers, regulators, auditors, and third parties.

Regulations can generally be translated into controls. The complexity arises when organizations are dealing with multiple frameworks and multiple customer requirements at the same time.

At the same time, security and compliance teams haven’t grown at the same pace as regulatory expectations. Most CISOs are heavily outnumbered given the volume of work they’re expected to deliver, and that creates significant pressure.

Lucy Montague

Paul, what warning signs suggest a compliance program has become a checkbox exercise rather than a genuine risk management function?

Paul Cadwallader

One of the biggest indicators is when metrics focus on activities rather than outcomes.

Organizations track policy review percentages, training completion rates, and audit activities instead of measuring risk reduction, remediation effectiveness, or operational resilience.

Policies exist but aren’t operationalized. Training becomes repetitive. Risk assessments are static and don’t drive business decisions.

Another warning sign is vendor due diligence becoming a one-time onboarding exercise with no ongoing monitoring. Self-attested controls without independent verification are another concern.

Perhaps most importantly, board reporting becomes backward-looking and reassuring by design rather than providing insight into emerging risks and residual exposure.

The difference is simple: compliance should be about understanding and reducing risk, not just passing audits.

Lucy Montague

Tom, what’s the biggest misconception boards and executives still have about compliance programs?

Tom Cornelius

Many still believe they can postpone improvements and defer difficult decisions.

That mindset is becoming increasingly dangerous.

Regulations such as NYDFS and others are introducing requirements that force executives and CISOs to formally attest to the effectiveness of their programs. Personal accountability is increasing.

Organizations can no longer afford to simply maintain compliance programs without progressing them. The expectation is shifting toward demonstrable improvement, evidence, and accountability.

Lucy Montague

Paul, everyone agrees compliance should be automated. Why are so many organizations still dependent on spreadsheets and manual evidence collection?

Paul Cadwallader

There are several reasons.

Spreadsheets have almost no barrier to entry. There’s no procurement process, implementation project, or budget approval required.

Many organizations also have fragmented control environments, separate taxonomies, disconnected ownership structures, and multiple reporting models. Automation becomes difficult when underlying processes lack consistency.

Evidence requirements often evolve faster than enterprise systems can be updated. Adding a new column to a spreadsheet is easier than reconfiguring a platform.

There’s also institutional scepticism. Many organizations attempted automation years ago, had poor experiences, and remain reluctant to invest again.

Finally, auditors still accept spreadsheets as evidence. Combined with their perceived flexibility, that encourages organizations to stay with manual methods despite the long-term inefficiencies.

Tom Cornelius

The challenge is that spreadsheets are not evidence management systems.

As regulatory scrutiny increases, organizations will need to produce defensible evidence for the claims they make.

A spreadsheet may show a compliance status, but it rarely demonstrates the evidence trail needed to support that status during an audit or investigation.

Lucy Montague

Anders, how can CISOs distinguish genuine AI capabilities from marketing hype?

Anders Søborg

I encourage CISOs to ask four questions.

First, does the AI actually perform compliance assessment work, or is it simply generating text?

Second, can it explain how it reached its conclusions and provide an audit trail?

Third, would an auditor produce a similar result consistently?

Fourth, would you be comfortable presenting the output to regulators, assessors, or your board?

Many solutions offer an attractive user experience but are fundamentally just a large language model underneath. That does not automatically make them suitable for compliance.

Lucy Montague

If AI is reviewing evidence and recommending outcomes, where does human judgement still matter?

Anders Søborg

AI should not replace professionals.

It should remove repetitive work.

AI can review evidence, analyse documentation, validate controls, and identify inconsistencies. However, human practitioners understand organizational context, business priorities, and risk appetite.

We often describe AI as performing the first review. Skilled professionals must still interpret the findings and make decisions.

The benefit is that automation frees up significant time for CISOs and compliance teams to focus on managing risk and supporting the business.

Tom Cornelius

It’s important to distinguish between generative AI and what I would describe as intelligent pattern matching.

Using generative AI to write policies, procedures, and evidence documentation can create significant risk because the output may not accurately reflect reality.

The real value comes from AI analysing documents, identifying relevant evidence, mapping information to control requirements, and presenting findings to compliance professionals for review.

That’s where AI can eliminate a substantial amount of manual effort while maintaining accountability and auditability.

Anders Søborg

Traditionally, a full assessment could require 100 to 150 hours over several weeks.

With purpose-built compliance intelligence, those activities can often be completed within hours if the evidence is readily available.

The same applies to contract reviews. What might take a professional several days can often be analysed in minutes, with explanations showing what evidence exists, what is missing, and where gaps remain.

That’s where genuine compliance AI delivers value.

Lucy Montague

If a CISO says they have too many frameworks, too many assessments, too many spreadsheets, and not enough people, what should their ideal compliance stack look like?

Paul Cadwallader

Most organizations don’t have a framework problem or a tooling problem.

They have a mapping and automation problem.

Map controls to frameworks once. Automate evidence collection. Prioritize assessment activity according to risk.

If you do those things successfully, you create more capacity without necessarily increasing headcount.

Tom Cornelius

I agree.

Organizations need to move away from managing frameworks in isolation.

With a meta-framework approach, you assess once and report many times. That significantly reduces duplication and makes compliance far more scalable.

Anders Søborg

The efficiencies generated through automation can often fund the transformation itself.

Many compliance teams continue to duplicate effort because work is being performed manually over and over again. Technology helps eliminate that waste and redirect resources toward higher-value activities.

Lucy Montague

Paul, what’s the single most important metric a CISO should take to the board?

Paul Cadwallader

Rather than presenting compliance percentages, I’d focus on risk exposure and remediation effectiveness.

The most useful metric is time-to-remediate findings weighted by risk severity.

A compliance score can look excellent while critical risks remain unresolved for months. What matters is how effectively an organization identifies, prioritizes, and closes risk.

Boards care about trajectory. They want to know whether risk exposure is improving or deteriorating over time.

Tom Cornelius

Ultimately, boards want answers to three questions:

• Are we secure?
• Are we compliant?
• Are we resilient?

The metrics and evidence should support those answers.

Lucy Montague

Are there any certifications or frameworks that organizations place too much faith in?

Tom Cornelius

SOC 2 and ISO 27001 are two examples.

Both can be heavily influenced by scope and implementation choices. Over time, many organizations have learned how to optimise for certification rather than genuine security outcomes.

Certification alone doesn’t necessarily provide a reliable measure of security maturity.

Anders Søborg

The real challenge is understanding what sits underneath those certifications.

Organizations often receive reports and questionnaires but don’t have the time to fully evaluate how the underlying risks are being managed.

Without deeper analysis, certifications can create a false sense of confidence.

Paul Cadwallader

The focus should always be on an organization’s ability to identify and reduce risk.

Any certification that encourages a purely checkbox approach can become problematic if it distracts from that objective.

Lucy Montague

Looking ahead to 2030, what will the modern compliance stack look like?

Paul Cadwallader

We’ll see continuous controls monitoring replacing point-in-time assessments.

Evidence collection will become AI-native. Regulatory changes will become machine-readable and automatically mapped to controls.

Third-party monitoring will become continuous, board reporting will become real-time, and compliance teams will increasingly evolve into compliance engineering functions focused on oversight rather than manual evidence gathering.

Tom Cornelius

Compliance information will increasingly be shared externally with regulators, government agencies, and supply-chain partners.

Continuous reporting and assurance are becoming the direction of travel.

Anders Søborg

I think we’ll go even further.

AI will increasingly orchestrate compliance activity, execute control testing, validate evidence, and escalate issues to human experts when intervention is needed.

The technology already exists. The challenge is implementing it responsibly and with the appropriate governance.

Lucy Montague

Finally, what’s one practical action attendees should take in the next 30 days?

Paul Cadwallader

Fix control mapping, automate evidence collection, and prioritize effort according to risk.

Anders Søborg

Look at how much time your teams spend reviewing documents, contracts, PDFs, and evidence. That’s usually the biggest opportunity for automation.

Tom Cornelius

Validate your assumptions. Make sure your control set genuinely addresses both your mandatory and optional requirements.

Lucy Montague

Thank you all for joining today’s discussion on automation, AI, compliance, and the future of the modern CISO’s compliance stack.

Why are traditional compliance programs under pressure? 

Traditional compliance programs are under pressure because the job has changed. 

CISOs and compliance leaders are no longer managing a neat set of isolated requirements. They are managing overlapping obligations across cyber, privacy, operational resilience, third-party risk and sector-specific regulation.  

Each framework may have its own language, but the underlying work often points back to the same question: can the organization prove that the right controls are in place, operating and supported by current evidence? 

That proof burden is getting heavier; 

• The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 65% of large organizations rank third-party and supply chain vulnerabilities as their greatest cyber concern. 
• A 2026 Data Breach Investigations Report also reported that third-party supply chain breaches now account for 48% of total breaches, up from 30% the year before. 

Regulators are responding to the same reality. The UK Financial Conduct Authority’s 2026 operational incident and third-party reporting rules set out new requirements for reporting operational incidents and material third-party arrangements. The direction is clear: firms are expected to understand where critical dependencies sit, how controls operate and when issues need to be escalated. 

This is where tick-box compliance starts to break down. A completed questionnaire, a mapped framework or an approved policy may show activity, but it does not always show control effectiveness. For CISOs, that gap matters. If an assessment cannot be traced back to evidence, reviewed by the right people and defended under scrutiny, it is not enough. 

The issue is whether the way organizations manage frameworks, evidence and assessments is still fit for purpose. 

What is the Secure Controls Framework? 

The Secure Controls Framework, or SCF, is described in the webinar as

“the heartbeat of compliance.” 

That is because SCF gives organizations a common controls foundation for managing overlapping security, privacy and compliance requirements. Instead of treating every framework as a separate project, SCF helps teams bring those requirements into 1 unified control architecture. 

The Secure Controls Framework describes itself as the Common Controls Framework and a free cybersecurity and data privacy metaframework.  

It maps;  

• 1,400+ controls across 200+ laws,  
• regulations and industry frameworks, including;  
• ISO 27001,  
• NIST CSF,  
• PCI DSS, SOC 2,  
• GDPR and  
• HIPAA. 

For CISOs, that matters because compliance work often overlaps. The same control evidence may support multiple obligations, but without a shared structure, teams can end up collecting, testing and reviewing the same information again and again. 

SCF changes the starting point. It supports the idea of assessing once, then understanding where that assessment maps across multiple requirements. 

It also brings a stronger approach to framework mapping. SCF uses Set Theory Relationship Mapping, based on NIST IR 8477, to define the relationship between requirements and controls. Each mapping uses 1 of 5 relationship types and a strength score, giving teams a clearer way to explain coverage, gaps and overlap. 

For compliance leaders, that is the difference between saying “we think this maps” and being able to show how and why it maps. 

What is SANNOS AI? 

SANNOS AI is the intelligence layer in the modern compliance stack. 

It is designed to help teams analyze real evidence, support assessment work and reduce manual review. In other words, it is not generic AI sitting outside the compliance process. It is evidence-led AI built for GRC, audit and assurance work. 

The CoreStream GRC, SANNOS and SCF combination enables organizations to assess controls once and automatically map them across 200+ regulations and frameworks, including ISO 27001, NIST, DORA and PCI DSS. It also says SANNOS AI evaluates evidence, identifies gaps and delivers real-time compliance insights, helping reduce duplication and manual effort. 

That matters because CISOs do not just need faster answers. They need answers that can be reviewed, challenged and defended. 

The webinar explores how SANNOS AI can analyze large volumes of vendor evidence in minutes, accelerate assessment work and reduce the manual effort that slows down third-party risk, compliance and assurance teams.  

This can be seen in measurable outcomes, including up to 80% reduction in time and cost, 95% acceleration in TPRM assessments and testing against 3,000+ pages of SCF compliance documentation with zero false positives. 

The core point is simple: speed only matters if the output is explainable, reviewable and defensible. That is where evidence-led AI becomes useful for compliance teams. 

Where does CoreStream GRC fit? 

If SCF provides the common controls architecture, and SANNOS AI supports evidence analysis and assessment acceleration, CoreStream GRC provides the platform layer that turns that work into a managed process and effective reporting. 

That means workflows, ownership, evidence, reporting and assurance activity all sit in one place. Compliance work does not stay trapped in documents, inboxes or one-off assessments. It becomes something teams can assign, track, review and report. 

That matters because AI on its own does not solve compliance complexity. A faster assessment is only useful if the output can move into the operational GRC process: who owns the gap, what evidence supports the assessment, what needs remediation, what has been reviewed and what can be shown to leadership, auditors or regulators. 

The CoreStream GRC and SANNOS partnership was built around that connection. It combines SANNOS’ evidence-based compliance automation with CoreStream GRC’s enterprise governance and workflow platform, helping teams accelerate framework assessments, reduce manual assurance work and deliver audit-ready outputs with traceable evidence. 

CoreStream GRC has also been recognized for this approach.  

In 2025, CoreStream GRC won Michael Rasmussen’s GRC Innovation Award for Enterprise Integrated GRC Architecture & Platforms, recognizing its flexible, no-code platform and enterprise GRC architecture. 

That is the value of the stack. AI connected to controls, evidence, ownership, workflow and reporting, the way compliance work actually gets done and truly works for your business. 

What is Set Theory Relationship Mapping and why does it matter? 

One of the standout elements of the webinar is the first public demonstration of Set Theory Relationship Mapping, or STRM. 

Compliance mapping has often been treated as subjective. Teams compare frameworks, identify overlap and make judgment calls about which requirements relate to which controls. That work is important, but it can also become opaque. When a board, auditor, customer or regulator asks why 1 requirement maps to another, teams need more than a best guess. 

STRM brings a more transparent and defensible approach to that problem. 

The Secure Controls Framework explains that STRM uses the NIST IR 8477 methodology for every SCF crosswalk. Each mapping uses 1 of 5 relationship types, including subset, superset, equal, intersects with and not related. This gives teams a clearer way to describe how requirements overlap, where they differ and how strong the relationship is. 

For CISOs, that matters because framework mapping is not just a back-office compliance exercise. It affects how teams explain coverage, identify gaps, prioritize remediation and defend their approach under scrutiny. 

STRM helps move compliance mapping from “we think this aligns” to “here is the relationship, here is the weighting and here is why it matters.” 

Who featured on the modern CISO webinar? 

This webinar brings together 3 perspectives across GRC strategy, control framework design and AI-powered compliance. 

Paul Cadwallader, GRC Strategy Director, CoreStream GRC 

With over 25 years of experience in the GRC space, and a background as a former Deloitte Partner, Paul brings deep expertise in helping organizations define what they need from their GRC platform and how to make it work in practice. 

In this webinar, Paul brings the CoreStream GRC perspective: how CISOs and compliance leaders can move beyond fragmented processes and build a more connected, operational approach to compliance. 

Tom Cornelius, Secure Controls Framework 

As Senior Partner at ComplianceForge, Tom has extensive experience helping organizations strengthen their security and compliance programs through practical control guidance, documentation and framework alignment. 

Through SCF, Tom focuses on reducing duplication across overlapping regulatory and industry requirements, giving compliance, risk and security teams a clearer foundation for defensible control mapping and assessment. 

In this webinar, Tom brings the framework perspective: why common control architecture matters, how SCF helps reduce duplication across overlapping requirements and why defensible mapping is becoming increasingly important for CISOs and compliance teams. 

Anders Söberg, Co-Founder and CEO, SANNOS 

With experience across governance, risk and compliance transformation, including as a former Chief Risk Officer, Anders brings a practitioner-led perspective to the role of AI in modern compliance programs. 

At SANNOS, Anders focuses on helping organizations move beyond manual assessments and fragmented evidence reviews by using domain-built intelligence to support faster, more consistent and more defensible compliance outcomes. 

In this webinar, Anders brings the AI and assessment perspective: how evidence-led intelligence can help organizations move beyond manual assessments, fragmented evidence reviews and slow compliance processes, while keeping outputs explainable, reviewable and defensible. 

Who should watch? 

• This webinar is designed for leaders who are expected to manage more compliance work, with more scrutiny, without adding more manual process. 
• It’s especially relevant for: 
• CISOs managing growing security and compliance expectations. 
• Compliance leaders responsible for multiple frameworks. 
• GRC teams looking to reduce repeated assessment work. 
• Third-party risk teams reviewing large volumes of vendor evidence. 
• Internal audit teams looking for stronger evidence and traceability. 
• Risk leaders exploring AI, but concerned about hype, defensibility and oversight. 

If your team is trying to modernize compliance without losing control of evidence, ownership or assurance quality, this session is a must watch. 

What does the webinar cover? 

The discussion focused on what a modern compliance stack should look like in practice, not just in theory. 

The panel covered: 

• Why CISOs need to rethink the compliance stack. 
• Whether tick-box compliance frameworks are still delivering value. 
• How SCF supports common control mapping. 
• How SANNOS AI can accelerate evidence review and assessment work. 
• How CoreStream GRC connects workflows, evidence, ownership and reporting. 
• Why STRM could change how teams compare and defend framework mapping. 
• What practical AI-powered GRC looks like beyond sales promises.

The aim was simple: give CISOs, compliance teams and risk leaders a clearer view of what works, what does not and where AI can genuinely support better GRC outcomes. 

Conclusion: Modern compliance needs more than another framework 

CISOs need a compliance stack that connects controls, evidence, automation, workflow and defensible reporting. They need tools that reduce repeated work, but still give teams the visibility and control they need to explain decisions under scrutiny. 

That is where SCF, SANNOS AI and CoreStream GRC come together. SCF provides the common controls foundation. SANNOS AI supports evidence-led assessment. CoreStream GRC brings that work into a managed platform layer, where teams can assign owners, track remediation, manage evidence and report with confidence. 

This webinar is for teams that want a practical view of what modern compliance can look like in 2026 and beyond. 

Frequently asked questions about SANNOS, SCFR and CoreStream GRC