Home / Governance

Human-in-the-loop GRC

Governance & compliance

Governance gates, risk scoring, and compliance validation are part of every action, not bolted on after the fact.

On this page

02Governance / Risk / Compliance

Autonomy you can actually sign off on

RODEO doesn't bolt compliance on after the fact. Every detection, decision, and response flows through governance gates, risk scoring, and compliance validation — with human-in-the-loop controls at every stage.

Human-in-the-loop approval: Autonomous playbooks stay approval-gated — a person signs off before high-impact actions execute.
Audit-ready by default: Every action is logged with who approved it and why. Evidence is collected continuously, not scrambled at audit time.
Plugin sandboxing: Restricted CPU and memory access, with mandatory RSA-2048 signing on every plugin.
Access control: JWT authentication, bcrypt hashing, role-based access, and tenant-scoped data with optional row-level security.

Talk to the team

control_mapEnforced

Frameworks

NIST 800-53·800-171·CMMC 2.0·ISO 27001·SOC 2

Mapped

Plugin integrity

RSA-2048 mandatory signing

Signed

Authentication

JWT·bcrypt·RBAC

Enforced

Isolation

Tenant-scoped·optional row-level security

Isolated

Response

Human-in-the-loop approval gate

Gated

Control-level compliance

Mapped at the control level, not the dashboard

Ten frameworks, cross-mapped in one engine — 138 controls and 602 cross-references, every one resolving. Compliance becomes a property of each action, with an SPRS score a defense contractor can actually file.

138

Cross-mapped controls

One engine, not ten spreadsheets.

602

Cross-references

Every one resolving to a real control — 100%.

Frameworks

Federal, defense, and commercial.

110

SPRS baseline

Provisional until a human verifies it.

NIST SP 800-53 Rev 515 controls

Federal information-systems security and privacy controls.

NIST SP 800-171 Rev 218 / 110

CUI protection for the defense industrial base — all 14 families represented, catalogue expanding.

CMMC 2.0 (L1–L2)19 practices

Cybersecurity Maturity Model practice lineage for defense contractors.

ISO/IEC 27001:202215 controls

International information-security management.

SOC 2 Type II13 criteria

Service-organization trust-services criteria.

PCI DSS v4.017 controls

Payment-card data-security standards.

HIPAA Security Rule10 controls

Healthcare data protection and privacy safeguards.

CIS Controls v816 controls

Prioritized defensive safeguards.

NIS2 Directive10 controls

EU network-and-information-security obligations.

EU GDPR5 controls

Data-protection and privacy requirements.

These are control-level cross-mappings, not certifications. The SPRS scorer produces the 110-point score a contractor files but keeps it provisional until a human verifies the point weights against the DoD Assessment Methodology — RODEO will not label its own number official.