---
title: 05 Solutions Page Copy (English)
---

# 05 Solutions Page Copy (English)

> Pages: `/en/solutions/cmmc`, `/en/solutions/iso-27001`, `/en/solutions/cra`, `/en/solutions/consultants`, `/en/solutions/enterprise`
> Voice (set 2026-10-22, site-wide): a working auditor talking. Short sentences, concrete scenes, no adjectives; say what the product does not do; name tools, versions and numbers. The live copy is `guidant-ai-website/src/i18n/*.json`; this file is the source draft.
> Chinese source: [05-solutions-copy.md](05-solutions-copy.md)
> Framework pages: hero → what the framework asks of you → how Guidant AI maps to it (table) → workflow → FAQ → call to action. Role pages: hero → your day → three scenarios → call to action.
> `🟡` finished but unreleased, `🔵` in development.

---

## 1. CMMC `/solutions/cmmc`

### Hero

**Headline**
> Entering the US defense supply chain starts with managing 110 controls

**Subhead**
> Guidant AI ships with CMMC 2.0 built in — system security plan, evidence, self-assessment and C3PAO readiness on one line.

### What the framework asks of you

1. **Write a system security plan**: for all 110 Level 2 controls, state how you do it today. It's the first document an assessor reads.
2. **Produce evidence**: every assessment objective (AO) needs proof — policies, configuration screenshots, logs.
3. **Plan remediation (POA&M)**: list what isn't done yet, schedule it and close it within the allowed window.

> Read more: *What is CMMC*

### How Guidant AI maps to it

| CMMC requirement | Guidant AI |
|---|---|
| 110 controls, 320 assessment objectives | Built-in CMMC 2.0 Level 2 framework; controls tree with every AO and suggested evidence |
| System security plan | Recorded per control; exports to Word |
| Evidence | Tasks bound to AOs, direct upload, AI batch classification, agent-collected technical evidence |
| Self-assessment rulings | Rule each assessment objective as met or not met, with the ruling on record |
| POA&M | Non-compliant items flow into the remediation plan with reminders; closing requires evidence |
| Year over year | Each cycle inherits the last; surveillance updates only what changed |

### Workflow

Inventory objectives → write the system security plan → collect evidence → internal self-assessment → remediate → C3PAO readiness → closing report

### FAQ

**We're a Taiwanese manufacturer. Does CMMC apply to us?**
If your customer sits in the US defense supply chain, the contract will require the matching level. Level 1 is self-assessed; most Level 2 needs a third-party assessment.

**Will Guidant AI get us certified?**
No. Guidant AI isn't a C3PAO and doesn't certify. We get your system security plan, evidence and POA&M ready before the assessor arrives.

**Can we manage CMMC and ISO 27001 at the same time?**
Yes. Run a project per framework; where controls overlap, evidence can be reused.

### Call to action

**Bring your current system security plan and see the gap.**
[Book a demo]

---

## 2. ISO 27001 `/solutions/iso-27001`

### Hero

**Headline**
> Evidence for 93 controls, ready every single year

**Subhead**
> Guidant AI ships with ISO/IEC 27001:2022 built in 🔵 — from the Statement of Applicability through evidence, internal audit and annual surveillance, without starting over.

### What the framework asks of you

1. **Decide which controls apply**: for all 93 Annex A controls, record whether they're adopted or excluded and why (the Statement of Applicability, SoA).
2. **Keep controls operating, with records**: certification checks that the policy is running, not just that it exists.
3. **Internal audit and management review every year**: surveillance audits annually, recertification every three years.

> Read more: *What is ISO 27001*

### How Guidant AI maps to it

| ISO 27001 requirement | Guidant AI |
|---|---|
| Annex A, 93 controls | Built-in ISO/IEC 27001:2022 framework 🔵, four themes, assessment objectives per control |
| Statement of Applicability | Each control's applicability and rationale recorded in the system security plan; exportable |
| Operating evidence | Tasks assigned to owners; recurring tasks reopen quarterly 🟡; evidence attached to tasks |
| A.8 technological controls | Scanning agent runs vulnerability and configuration checks; reports become evidence |
| Internal audit | Audit plan, verdicts, nonconformities and corrective actions on one platform |
| Management review | Closing report 🟡 and GRC overview 🟡 for the management review meeting |
| Annual surveillance | New cycle inherits the last; only changed evidence is refreshed |

### Workflow

Scope and risk assessment → Statement of Applicability → implement controls and collect evidence → internal audit → corrective action → certification audit → annual surveillance

### FAQ

**We already have a consultant. Do we still need a platform?**
The consultant designs and coaches the ISMS; the platform keeps it running and keeps the evidence. Most consultants use Guidant AI to serve several clients at once.

**Is risk assessment done in the platform?**
The risk register and heat map are in the GRC module 🟡; ISO-specific asset risk assessment ships with the built-in framework 🔵.

**Will the certification body accept exported documents?**
Yes. SoA, system security plan and internal audit reports export to Word, Excel and PDF in the same formats consultants deliver.

### Call to action

**Bring your SoA and see it inside the platform.**
[Book a demo]

---

## 3. EU CRA `/solutions/cra`

### Hero

**Headline**
> From December 2027, digital products sold in the EU must comply with the CRA

**Subhead**
> Guidant AI ships with the EU Cyber Resilience Act framework built in 🟡 — Annex I requirements, technical documentation and vulnerability handling in one place. We run our own product through it.

### What the framework asks of you

1. **Meet the Annex I security requirements**: secure by default, update mechanism, vulnerability handling, SBOM.
2. **Prepare technical documentation and a declaration of conformity**: Annex VII technical file, Annex V declaration.
3. **Set up vulnerability handling**: a reporting contact, security advisories, a support period of at least five years; from 11 September 2026, actively exploited vulnerabilities must be reported within 24 hours.

> Read more: *What is the CRA*

### How Guidant AI maps to it

| CRA requirement | Guidant AI |
|---|---|
| Annex I Part I (product security) | Built-in CRA framework 🟡, each requirement broken into objectives with suggested evidence |
| Annex I Part II (vulnerability handling) | Templates for vulnerability disclosure policy, security advisories, support period statement |
| SBOM | Third-party component risk module 🟡 generates CycloneDX/SPDX and cross-checks known vulnerabilities |
| Annex VII technical documentation | System security plan exports to Word with chapters mapped to Annex VII |
| Declaration of conformity | Annex V draft generated from project data 🟡 |
| Ongoing maintenance | SBOM vulnerability check before every release; alerts on high-severity components |

### Workflow

Classify the product (default / important / critical) → inventory Annex I requirements → technical documentation → vulnerability handling process → SBOM → declaration of conformity → maintain every release

### FAQ

**We make hardware. Does firmware count?**
Yes. The CRA covers all "products with digital elements," including firmware and embedded software.

**Does a Taiwanese company need an EU representative?**
The CRA doesn't mandate an authorized representative; reporting obligations follow the importer, then the distributor. Confirm the details with legal counsel.

**Does Guidant AI itself comply with the CRA?**
We self-assess our own product with Guidant AI's CRA framework; our vulnerability disclosure policy, support period statement and SBOM are published in the Trust Center. [to be confirmed whether to say publicly]

### Call to action

**Start with an Annex I gap check on your product.**
[Book a demo]

---

## 4. Compliance Consultants and Audit Firms `/solutions/consultants`

### Hero

**Headline**
> One consultant, ten clients, every one in order

**Subhead**
> Package your expertise as a library and apply it to each client in one click; import interview sheets directly; generate reports automatically.

### Your day

Morning: open the dashboard and see progress and overdue tasks across ten client projects.
Late morning: interview at client A; the completed sheet imports straight into the system security plan 🟡 — no retyping back at the office.
Afternoon: client B uploaded two hundred files yesterday; AI has already sorted them, twenty minutes to confirm.
End of day: client C is closing; the report generates itself 🟡 and you write only the conclusion.

### Three scenarios

#### Libraries: build once, use ten times

Control selections, system security plan templates, audit workflows and form settings become your firm's library. Pick it when starting a new client project and it's set up in three minutes. Update the library when a framework changes; projects in flight aren't disturbed.

#### Many clients, many tenants

Each client is a tenant with fully isolated data; you switch between them with one account. Client staff see only their own projects.

#### Deliverables generated for you

System security plan (Word), audit plan and results (Excel), remediation plan, closing report (Word/PDF) 🟡 — all generated from system data, consistently formatted, no layout work.

### FAQ

**Is the platform installed at our firm or at the client?**
Either. Multi-client management usually runs at the firm; clients with data-residency requirements install it in their own data center and you sign in remotely with a restricted account.

**Can other consultants see my library?**
No. Libraries belong to your tenant unless you share them.

### Call to action

**Bring a real client case and we'll build it in front of you.**
[Book a demo]

---

## 5. Enterprise Security and Audit Teams `/solutions/enterprise`

### Hero

**Headline**
> Many frameworks, many years, many departments — one platform, the whole picture

**Subhead**
> Shared controls, shared evidence, continuity year over year; executives see accountability and risk; data never leaves your data center.

### Your day

Morning: the GRC overview 🟡 shows IT has three open high risks; click through to the remediation plans.
Late morning: the ISO 27001 surveillance audit is next month; last year's evidence is all there, only this year's changes to add.
Afternoon: legal asks about CRA readiness; open the CRA project dashboard and send a screenshot.
End of day: quarterly checks open automatically for each department 🟡; the system reminds them before the due date.

### Three scenarios

#### Shared controls across frameworks

Run ISO 27001, CMMC and CRA as separate projects; where controls overlap, evidence is shared. One vulnerability scan report serves all three.

#### Cross-department ownership

Map the department tree to controls; every control has an owner. Review gates 🟡 run doer → manager → auditor; the responsibility matrix (RACI) 🟡 goes into the closing report.

#### Data stays on premises

Installed as a whole on your Linux host, connected to your LDAP, SIEM and notification systems. Only the frontend is exposed; evidence is unpacked in a sandbox; AI calls go through the gateway.

### FAQ

**We have five business units. Do we install five copies?**
One. Use five tenants or five department trees, depending on how much isolation you need.

**Can we connect the vulnerability scanner we already use?**
The scanning agent supports eight tools; reports from other tools can be uploaded manually as evidence.

### Call to action

**Bring security, audit and IT for thirty minutes.**
[Book a demo]