ControlWatch

ControlWatch is a web app (with optional lightweight desktop agent) that continuously checks whether your real-world cloud and SaaS configurations still match required controls for SOC 2, ISO 27001, and HIPAA. Instead of generating generic checklists, it monitors specific control signals (MFA enforcement, admin role sprawl, logging retention, encryption settings, vendor access) and maps them to your control library. When drift happens, it opens a ticket with exact remediation steps and automatically collects time-stamped evidence (screenshots, API snapshots, config diffs) for auditors. It’s a combination traditional + AI app: traditional rules and integrations do the monitoring; AI summarizes changes, drafts auditor-ready narratives, and flags suspicious exceptions. Realistically, the hard part is integrations and trust—so the MVP should focus on 5–8 high-value systems (Okta/Microsoft Entra, AWS, Google Workspace, GitHub, Jira) and do those very well.