Lighthouse

The problem

Every small-to-mid SaaS company that wants ISO 27001 or SOC 2 hits the same wall. The enterprise GRC tools are priced and scoped for organisations with a compliance department. What's left is a folder of spreadsheets: a risk register in one, a control matrix in another, vendor reviews in a third, and evidence scattered across Drive, Slack, and screenshots taken the week before the audit.

That arrangement fails in a specific and predictable way. The register goes stale because updating it is nobody's job. Controls get mapped to one framework, then re-mapped by hand when a customer asks for a different one. And evidence is collected reactively, in a scramble, which is exactly when it's least trustworthy.

I've sat on the auditor's side of this table for ten enterprise clients. The gap is almost never the control itself — it's that nobody can produce evidence the control ran.

The approach

Lighthouse is deliberately opinionated rather than configurable. Enterprise GRC platforms are flexible enough to model any programme, which means every customer has to design their own — and small teams don't have anyone to do that. Lighthouse ships with a working programme already shaped, and lets you adjust it.

Three decisions drive the design:

• One control, many frameworks. Controls are modelled once and mapped to ISO 27001, NIST CSF, and SOC 2 simultaneously. Answering "are we SOC 2 ready?" doesn't mean rebuilding the matrix.
• Evidence is collected continuously, not at audit time. Integrations pull evidence on a schedule so the audit trail accumulates as a by-product of normal operation.
• Risk is threat-informed, not imagined. A MISP plugin feeds real threat intelligence into the risk register, so likelihood ratings reference observed activity rather than a workshop guess.

What Phase 1 covers

Plugins for AWS Security Hub, MISP, and Slack are in scope for Phase 1; further integrations are deferred until the core is proven.

Where it stands

Phase 1 is in active build against an August 2026 target. The data model, control-mapping engine, and risk register are implemented; evidence integrations and the reporting layer are in progress. I'm building it alone, which is a deliberate constraint — it forces the scope to stay honest.

I'll publish measured outcomes when there are real ones to publish. Until then this page describes design intent and shipped scope, not results, because a GRC tool that overstates its own maturity would be a poor advertisement for the person building it.

What it proves