--- title: 03 Product Page Copy (English) --- # 03 Product Page Copy (English) > Pages: Home `/en`, Product overview `/en/product` > Chinese source: [03-product-page-copy.md](03-product-page-copy.md) > `[Screenshot #N]` refers to the screenshot list in [01 inventory](../1-requirement/01-product-inventory.md) ยง3. `๐ŸŸก` marks features that are finished but not yet released; the decision maker decides whether to keep them at launch. `๐Ÿ”ต` marks features committed and in development (built-in ISO 27001 framework), to be finished before the site launches. --- ## Home `/en` > Voice (set by the decision-maker on 2026-10-22, applies site-wide): a working auditor talking. Short sentences, concrete scenes, no adjectives; say what the product does not do; name tools, framework versions and numbers. The headline is a slogan; the definition sentence right under it is what search engines and AI use to identify the product. ### Hero **Headline** > Compliance, as part of the everyday **Definition** (first line under the headline, for SEO/GEO, do not remove) > Guidant AI is a compliance audit management platform deployed in your own data center, supporting CMMC 2.0, ISO/IEC 27001:2022 and the EU CRA. **Subheadline** > Evidence is where you left it. Findings are on record. What you fixed last year is still visible this year. Every control's status, evidence and remediation live in one place, so the day the auditor arrives, nobody is digging through folders. **Buttons**: [Book a demo] [See the product] ### Frameworks strip > Built-in frameworks and standards ### Three scenes **The audit date is set. The evidence is still missing.** Policies on a shared drive, screenshots on a colleague's laptop, last year's scan report buried in an inbox. Two or three weeks later, what you found may not even be the right version. **Last year's findings, and nobody remembers them** The report listed twelve items to fix. How far they got, and where the evidence is, lived with the person who handled it. They moved on, and so did the record. **This evidence was never meant to leave the building** Network diagrams, vulnerability reports, your customers' controlled information. Upload that to someone else's cloud, and your security team will be the first to say no. ### How one audit cycle runs here - Plan: pick the framework and scope; every control gets an owner - Execute tasks: owners upload evidence and answer questionnaires; technical items go to the scan Agent - Internal audit: check yourself first, by the auditor's standard - External audit: the auditor rules on each control with status, evidence and scan results on one screen - Remediate: non-conformities go straight into a remediation plan with an owner and a deadline - Close and report: generated from the audit data; the consultant writes only the summary - Next cycle: controls, evidence and open findings carry over; only what changed gets re-verified ### Four highlights **AI evidence classification** Drop in a few hundred files. The AI reads each one, proposes which requirement it belongs to, and puts the low-confidence ones first. It suggests; it never decides. Nothing is filed until you confirm it. **Scan results become evidence automatically** The scan Agent sits inside your network and runs eight tools, including OpenVAS, Nessus, ZAP and OpenSCAP. Reports land in the matching task automatically. It scans only the assets you registered, and nothing else. **Audit records carry over year after year** One project manages one framework for as long as you need. Each new cycle carries over the controls, evidence and open findings from the last one, with every past ruling intact. **The whole system in your data center** A complete installer, with evidence files stored wherever you specify. AI features pass through a built-in gateway that blocks prompt injection and improper requests. You choose the model and hold the keys. On an isolated network, connect an internal model or switch AI off entirely. ### To be clear > Guidant AI does not issue certificates and does not replace the auditor. Its job is to have your system security plan, evidence and remediation plan ready before the auditor walks in. ### Who it is for **Compliance consultants and audit firms** Every client you serve follows the same method. Turn your control selections, system security plan templates and audit procedures into a reusable library and apply it to the next engagement. Interview notes import as the client's system security plan; the closing report is generated from the data, and you write only the summary. **Enterprise security and audit teams** ISO 27001 and CMMC in the same year? Overlapping controls are done once and the evidence is shared. Management opens the GRC overview and sees which department is behind and which risk matters most, without another slide deck. ### Guides > Regulation guides ### Closing > **Bring the framework you are preparing for** > Thirty minutes, walked through with your controls and your evidence. Not a generic demo. > [Book a demo] [Talk to us] ### Search snippet - title: Guidant AI | Compliance audit management platform (CMMC, ISO 27001, EU CRA) - description: Guidant AI is a compliance audit management platform by Billows Technology, supporting CMMC 2.0, ISO 27001 and the EU CRA: evidence management, AI evidence classification, automated scanning, internal and external audits and closing reports, deployed on-premises. --- ## Product overview `/en/product` ### Hero **Headline** > One platform for every step of the compliance audit **Subheadline** > From frameworks to final reports โ€” twelve core capabilities that let consultants, audited teams and auditors work in the same place. `[Screenshot #1]` --- ### 01 Frameworks and libraries **Turn regulations into reusable work templates** Regulations are long. What teams actually need is "what do we check for this requirement, and what evidence proves it." Guidant AI ships with major frameworks and lets consultants package their expertise into libraries the next client can reuse. - **Built-in frameworks**: CMMC 2.0, ISO/IEC 27001:2022 ๐Ÿ”ต, EU CRA ๐ŸŸก; we update them when the regulations change - **Libraries**: control selections, system security plan templates, audit workflow templates and form settings โ€” build once, reuse across projects - **Assessment objectives**: each control is broken into concrete, checkable objectives with suggested evidence and audit guidance `[Screenshot #2]` --- ### 02 Projects and the audit lifecycle **One project per framework, managed cycle after cycle** A project doesn't close when an audit ends. Each cycle moves through planning, internal audit, external audit, remediation and closing. Items that fail go into a re-verification cycle, and next year's cycle picks up where this one left off. - **Stage navigation**: see at a glance where you are and what comes next - **Internal and external audit in one cycle** ๐ŸŸก: audit internally, fix, then go to the external audit - **Re-verification cycles**: failed items are automatically re-scoped and re-checked, with full history preserved `[Screenshot #1]` --- ### 03 System security plan **Explain, control by control, how you do it today** The system security plan is the first document an auditor reads. Guidant AI lets you record the implementation status and description of every control, link procedures, and keep it current year after year. - **Control-by-control status**: implementation status, description, responsible department, referenced procedures - **Consultant interview fields** ๐ŸŸก: gaps, recommended fixes and suggested attachments, imported straight from interviews - **Excel and Word import/export**: keep the formats you know; Word export can use the consultant's own template ๐ŸŸก `[Screenshot #3]` --- ### 04 Tasks, evidence and review steps **Every requirement has an owner, evidence, and someone who signs off** Break assessment objectives into tasks and assign them to the people who actually do the work. Owners upload evidence and fill in questionnaires; managers and consultants review in turn, and every approval or rejection is recorded. - **My tasks**: everyone sees their own to-do list the moment they sign in - **Review steps** ๐ŸŸก: owner โ†’ manager โ†’ consultant, with as many steps and reviewers as you need - **Recurring tasks and reminders** ๐ŸŸก: monthly or quarterly checks reopen automatically; owners are reminded before due dates `[Screenshot #4]` `[Screenshot #5]` --- ### 05 AI evidence classification **Drop in a batch of files โ€” AI puts them in the right place** The slowest part of evidence work is deciding which requirement each document supports. Guidant AI reads the content โ€” PDFs, images, Word, Excel, slides โ€” and suggests the matching assessment objective. You confirm, and it's filed into the task. - **Batch upload**: handle hundreds of files at once - **Human in the loop**: AI suggests, you decide โ€” every result can be corrected - **Safe by design**: injection attempts and improper requests are blocked before anything reaches the AI `[Screenshot #6]` --- ### 06 Automated scanning **Vulnerability and configuration scans that become evidence on their own** Deploy the Guidant AI detection agent in your environment and assign scans from the platform. The agent runs them inside your network, and reports flow back to the matching task. - **Eight scanning tools**: network vulnerability scanning (OpenVAS, Nessus), web application scanning (ZAP), host configuration compliance (CINC Auditor, OpenSCAP, Taiwan GCB), port discovery (Nmap), source code security (SonarQube) - **Authorized scope only**: scans are limited to the devices and network ranges you've registered - **Multi-agent dispatch**: different agents cover different network segments in a single run > Nessus and SonarQube require your own licenses. Nmap must be installed on the execution host. `[Screenshot #7]` --- ### 07 Third-party component risk ๐ŸŸก **See which components carry known risk โ€” no coding background needed** Upload source code or an SBOM. Guidant AI produces a standard software bill of materials, checks it against known vulnerabilities with three tools, and flags what's actively exploited (KEV) and how likely exploitation is (EPSS). - **Standard SBOMs**: CycloneDX and SPDX, as required by the EU CRA - **Facts, not verdicts**: each tool's result is shown side by side; missing data is labeled "cannot be determined," never shown as zero - **Scan-to-scan comparison**: see what's new and what's fixed; get notified when a new high-severity issue appears `[Screenshot #8]` --- ### 08 Audit work: plan, assess, remediate **Auditors assess item by item; failures go straight into the remediation plan** The audit plan sets out the method and the people and assets in scope for every objective. Auditors see the system security plan narrative, evidence and scan reports on one screen and record their assessment. Anything marked not met flows into the remediation plan with an owner and a due date. - **Audit plan**: method, interviewees and assets, planned item by item - **Item-by-item assessment**: met / not met / not applicable, with findings, risk severity and recommendations - **Remediation plan (POA&M)**: not-met items are carried over automatically with actions and deadlines - **Excel round-trip**: export a four-sheet workbook for offline work, then import it back `[Screenshot #9]` `[Screenshot #10]` --- ### 09 Closing reports ๐ŸŸก **When a cycle ends, the formal report is ready** Every chapter โ€” project overview, overall conformance, key findings, remediation summary โ€” is generated live from the audit data. Only the "summary and recommendations" section needs a consultant's hand. - **One click**: download as Word or PDF - **Report package**: the evidence and cross-reference table as they stood at closing, bundled and re-downloadable any time - **Finalize and revise**: finalized reports are locked; revisions are tracked `[Screenshot #11]` --- ### 10 GRC: governance and risk ๐ŸŸก **The one page leadership wants: compliance and risk across the company** Once compliance is under way, leadership asks: "Which department needs attention? What's our biggest risk?" Guidant AI brings ownership and risk into the same platform. - **GRC overview**: overall risk posture, 5ร—5 heat map, department scorecards and a 12-month review schedule; export as a slide deck - **Risk register**: one register for the whole company; failed audit items create draft risks automatically - **Ownership (RACI)**: which department owns each control, who does the work, who's informed `[Screenshot #12]` `[Screenshot #13]` --- ### 11 AI assistant and AI dashboard **Ask how the system works, ask how to meet a requirement, or build a chart in one sentence** - **AI assistant**: available on every page, answering questions about the system and compliance topics (ISO 27001, CMMC, controls, evidence, audit practice) - **AI dashboard**: type "number of not-met items by project" and get charts and tables instantly - **AI gateway**: every AI call is screened for injection and inappropriate requests, enforces usage quotas and is logged `[Screenshot #14]` `[Screenshot #15]` --- ### 12 Enterprise administration and on-premises deployment **Meets enterprise IT requirements, installed in your data center** - **On-premises deployment**: a complete installation package for your own servers; evidence files can be stored wherever you choose - **Access management**: who, which role, which scope, until when โ€” clear permissions that expire automatically - **Enterprise integration**: LDAP, multi-factor authentication, security policies, log forwarding to your SIEM (Syslog / GELF), email and instant notifications - **Multi-tenant and departments**: group, subsidiary and department hierarchies with isolated data - **Code protection**: the installed edition is compiled and checks itself for tampering `[Screenshot #16]` --- ### More features | Feature | Description | |---|---| | Questionnaires | Design questionnaires and attach them to tasks for audited teams to answer | | Announcements and feedback | In-app announcements; issue reports can sync to GitLab or GitHub | | Cloud integration | Pull evidence from Google Drive folders | | Asset inventory | Information systems and devices, including versions and support periods | | Languages | Traditional Chinese and English interfaces | | Light and dark themes | Switch to suit your preference | --- ### Deployment | | On-premises | |---|---| | Where it runs | Your own servers or private cloud | | Where data lives | Entirely in your environment; evidence files on local disk, SeaweedFS object storage or a designated file agent | | Installation | Complete installation package, manuals and video tutorials | | Outbound connections | AI features connect to an AI service; other features can run in a closed network [to be confirmed] | | Licensing | Licensed by module; enable modules in stages | --- ### Our security commitment - We use Guidant AI to run an EU CRA self-assessment of our own product [to be confirmed] - Public vulnerability disclosure policy and security advisories โ†’ [Product security](/en/trust/security) - An SBOM for every release --- ### Closing CTA > **How much audit-prep time could Guidant AI save your team?** > Tell us which framework you're preparing for, and we'll set up a 30-minute demo. > [Book a demo] [Talk to us] --- ## Appendix: short copy for feature pages (`/en/product/*`) | Page | Headline | Subheadline | |---|---|---| | Compliance and audit management | From first assessment to final report, on one platform | Frameworks, system security plans, tasks and evidence, audits and remediation โ€” every step owned and on record. | | AI capabilities | AI does the sorting. People make the calls. | Evidence classification, an AI assistant and AI dashboards โ€” with every AI call screened by the gateway. | | Automated scanning | Stop uploading scan reports by hand | The detection agent runs eight scanning tools inside your network, and the results become audit evidence automatically. | | GRC: governance and risk | Start with compliance, then see ownership and risk across the company | Department ownership, a company risk register with heat map, and a one-page view for leadership. | | Deployment and security | Your compliance data stays in your data center | On-premises deployment, access management, enterprise integration and code protection that meet IT and security requirements. |