Core concepts
Common Controls Framework (CCF)
The canonical control library underpinning Halo. Each control has a unique ID, a description, implementation guidance, and cross-framework mappings.
Zones
Controls live in one of four zones — Approved, Staged, Experimental, Archived — representing their governance state, visible and distinct at all times.
Human-governed AI
AI may observe, infer, recommend, and stage proposals. Only humans may approve changes to canonical control state.
Control lifecycle
Controls move through a defined lifecycle — draft → staged → approved — with every transition requiring human sign-off via the Review Centre.
Platform capabilities
- ✓Control library browser with cross-framework mapping visibility
- ✓Governance workflow — propose, review, and approve control changes
- ✓Artefact management — evidence and documentation attached to controls
- ✓Maturity assessment and rubric scoring
- ✓Review Centre — a unified queue for every pending human decision
- ✓AI Workbench — AI-assisted drafting and gap analysis, human approval required before promotion
Who Halo is for
Security and compliance teams at technology companies, financial institutions, and regulated industries operating across multiple regulatory frameworks and jurisdictions. The primary buyer is a compliance-naive scaleup (50–500 people, Series A–C) facing their first enterprise procurement gate or regulatory deadline — typically needing SOC 2, ISO 27001, MAS TRM, DORA, or EU AI Act coverage, often in combination. Halo is not a tool for getting one certificate fast — it is the platform for running a multi-framework control programme over time, where evidence and controls carry across frameworks automatically.