Pages:
/en/solutions/cmmc,/en/solutions/iso-27001,/en/solutions/cra,/en/solutions/consultants,/en/solutions/enterpriseVoice (set 2026-10-22, site-wide): a working auditor talking. Short sentences, concrete scenes, no adjectives; say what the product does not do; name tools, versions and numbers. The live copy isguidant-ai-website/src/i18n/*.json; this file is the source draft. Chinese source: 05-solutions-copy.md Framework pages: hero → what the framework asks of you → how Guidant AI maps to it (table) → workflow → FAQ → call to action. Role pages: hero → your day → three scenarios → call to action.🟡finished but unreleased,🔵in development.
/solutions/cmmcHeadline
Entering the US defense supply chain starts with managing 110 controls
Subhead
Guidant AI ships with CMMC 2.0 built in — system security plan, evidence, self-assessment and C3PAO readiness on one line.
Read more: What is CMMC
| CMMC requirement | Guidant AI |
|---|---|
| 110 controls, 320 assessment objectives | Built-in CMMC 2.0 Level 2 framework; controls tree with every AO and suggested evidence |
| System security plan | Recorded per control; exports to Word |
| Evidence | Tasks bound to AOs, direct upload, AI batch classification, agent-collected technical evidence |
| Self-assessment rulings | Rule each assessment objective as met or not met, with the ruling on record |
| POA&M | Non-compliant items flow into the remediation plan with reminders; closing requires evidence |
| Year over year | Each cycle inherits the last; surveillance updates only what changed |
Inventory objectives → write the system security plan → collect evidence → internal self-assessment → remediate → C3PAO readiness → closing report
We're a Taiwanese manufacturer. Does CMMC apply to us? If your customer sits in the US defense supply chain, the contract will require the matching level. Level 1 is self-assessed; most Level 2 needs a third-party assessment.
Will Guidant AI get us certified? No. Guidant AI isn't a C3PAO and doesn't certify. We get your system security plan, evidence and POA&M ready before the assessor arrives.
Can we manage CMMC and ISO 27001 at the same time? Yes. Run a project per framework; where controls overlap, evidence can be reused.
Bring your current system security plan and see the gap. [Book a demo]
/solutions/iso-27001Headline
Evidence for 93 controls, ready every single year
Subhead
Guidant AI ships with ISO/IEC 27001:2022 built in 🔵 — from the Statement of Applicability through evidence, internal audit and annual surveillance, without starting over.
Read more: What is ISO 27001
| ISO 27001 requirement | Guidant AI |
|---|---|
| Annex A, 93 controls | Built-in ISO/IEC 27001:2022 framework 🔵, four themes, assessment objectives per control |
| Statement of Applicability | Each control's applicability and rationale recorded in the system security plan; exportable |
| Operating evidence | Tasks assigned to owners; recurring tasks reopen quarterly 🟡; evidence attached to tasks |
| A.8 technological controls | Scanning agent runs vulnerability and configuration checks; reports become evidence |
| Internal audit | Audit plan, verdicts, nonconformities and corrective actions on one platform |
| Management review | Closing report 🟡 and GRC overview 🟡 for the management review meeting |
| Annual surveillance | New cycle inherits the last; only changed evidence is refreshed |
Scope and risk assessment → Statement of Applicability → implement controls and collect evidence → internal audit → corrective action → certification audit → annual surveillance
We already have a consultant. Do we still need a platform? The consultant designs and coaches the ISMS; the platform keeps it running and keeps the evidence. Most consultants use Guidant AI to serve several clients at once.
Is risk assessment done in the platform? The risk register and heat map are in the GRC module 🟡; ISO-specific asset risk assessment ships with the built-in framework 🔵.
Will the certification body accept exported documents? Yes. SoA, system security plan and internal audit reports export to Word, Excel and PDF in the same formats consultants deliver.
Bring your SoA and see it inside the platform. [Book a demo]
/solutions/craHeadline
From December 2027, digital products sold in the EU must comply with the CRA
Subhead
Guidant AI ships with the EU Cyber Resilience Act framework built in 🟡 — Annex I requirements, technical documentation and vulnerability handling in one place. We run our own product through it.
Read more: What is the CRA
| CRA requirement | Guidant AI |
|---|---|
| Annex I Part I (product security) | Built-in CRA framework 🟡, each requirement broken into objectives with suggested evidence |
| Annex I Part II (vulnerability handling) | Templates for vulnerability disclosure policy, security advisories, support period statement |
| SBOM | Third-party component risk module 🟡 generates CycloneDX/SPDX and cross-checks known vulnerabilities |
| Annex VII technical documentation | System security plan exports to Word with chapters mapped to Annex VII |
| Declaration of conformity | Annex V draft generated from project data 🟡 |
| Ongoing maintenance | SBOM vulnerability check before every release; alerts on high-severity components |
Classify the product (default / important / critical) → inventory Annex I requirements → technical documentation → vulnerability handling process → SBOM → declaration of conformity → maintain every release
We make hardware. Does firmware count? Yes. The CRA covers all "products with digital elements," including firmware and embedded software.
Does a Taiwanese company need an EU representative? The CRA doesn't mandate an authorized representative; reporting obligations follow the importer, then the distributor. Confirm the details with legal counsel.
Does Guidant AI itself comply with the CRA? We self-assess our own product with Guidant AI's CRA framework; our vulnerability disclosure policy, support period statement and SBOM are published in the Trust Center. [to be confirmed whether to say publicly]
Start with an Annex I gap check on your product. [Book a demo]
/solutions/consultantsHeadline
One consultant, ten clients, every one in order
Subhead
Package your expertise as a library and apply it to each client in one click; import interview sheets directly; generate reports automatically.
Morning: open the dashboard and see progress and overdue tasks across ten client projects. Late morning: interview at client A; the completed sheet imports straight into the system security plan 🟡 — no retyping back at the office. Afternoon: client B uploaded two hundred files yesterday; AI has already sorted them, twenty minutes to confirm. End of day: client C is closing; the report generates itself 🟡 and you write only the conclusion.
Control selections, system security plan templates, audit workflows and form settings become your firm's library. Pick it when starting a new client project and it's set up in three minutes. Update the library when a framework changes; projects in flight aren't disturbed.
Each client is a tenant with fully isolated data; you switch between them with one account. Client staff see only their own projects.
System security plan (Word), audit plan and results (Excel), remediation plan, closing report (Word/PDF) 🟡 — all generated from system data, consistently formatted, no layout work.
Is the platform installed at our firm or at the client? Either. Multi-client management usually runs at the firm; clients with data-residency requirements install it in their own data center and you sign in remotely with a restricted account.
Can other consultants see my library? No. Libraries belong to your tenant unless you share them.
Bring a real client case and we'll build it in front of you. [Book a demo]
/solutions/enterpriseHeadline
Many frameworks, many years, many departments — one platform, the whole picture
Subhead
Shared controls, shared evidence, continuity year over year; executives see accountability and risk; data never leaves your data center.
Morning: the GRC overview 🟡 shows IT has three open high risks; click through to the remediation plans. Late morning: the ISO 27001 surveillance audit is next month; last year's evidence is all there, only this year's changes to add. Afternoon: legal asks about CRA readiness; open the CRA project dashboard and send a screenshot. End of day: quarterly checks open automatically for each department 🟡; the system reminds them before the due date.
Run ISO 27001, CMMC and CRA as separate projects; where controls overlap, evidence is shared. One vulnerability scan report serves all three.
Map the department tree to controls; every control has an owner. Review gates 🟡 run doer → manager → auditor; the responsibility matrix (RACI) 🟡 goes into the closing report.
Installed as a whole on your Linux host, connected to your LDAP, SIEM and notification systems. Only the frontend is exposed; evidence is unpacked in a sandbox; AI calls go through the gateway.
We have five business units. Do we install five copies? One. Use five tenants or five department trees, depending on how much isolation you need.
Can we connect the vulnerability scanner we already use? The scanning agent supports eight tools; reports from other tools can be uploaded manually as evidence.
Bring security, audit and IT for thirty minutes. [Book a demo]