Kyora IQ Compliance Control Reference Server

A searchable, cross-framework reference for security, privacy, and AI-governance controls — built to be queried both by humans (web UI) and by AI assistants (over the Model Context Protocol).

You search a risk, control, or keyword once, and Kyora IQ returns the relevant controls with every related control in every other framework shown alongside. The same normalized data powers a web interface and an MCP server, so an AI assistant can pull authoritative, cited control text instead of guessing.

What this is: a trustworthy reference — the rulebook. What this is not (yet): an automated audit of your environment. An AI assistant can use this reference while reviewing a system, but the checking of a real environment is a separate, later capability.

Frameworks tracked (13)

Ingested in waves. Each framework is handled according to how its source is licensed — see docs/SOURCING-POLICY.md.

Wave	Framework	Source handling
1	NIST SP 800-53 Rev. 5	Verbatim (public domain, official OSCAL JSON)
1	NIST AI RMF (AI 100-1)	Verbatim (public domain)
1	NIST AI 600-1 (Generative AI Profile)	Verbatim (public domain)
1	HIPAA Security Rule (45 CFR 164)	Verbatim (public domain, US regulation)
1	OWASP Top 10 for LLM Applications	Paraphrased + attributed (CC BY-SA)
1	OWASP API Security Top 10	Paraphrased + attributed (CC BY-SA)
1	OWASP Top 10 (Web)	Paraphrased + attributed (CC BY-SA)
2	MITRE ATLAS	Paraphrased + attributed (MITRE terms)
2	MITRE ATT&CK	Paraphrased + attributed (MITRE terms)
3	SOC 2 / AICPA Trust Services Criteria	Own wording (AICPA text licensed)
3	ISO/IEC 42001	Own wording (ISO text licensed)
3	EU AI Act	Article references + own summaries

Crosswalk

Controls are grouped into control domains so you can see how the same theme is addressed across every framework at once. There are 28 domains: 12 covering general security and privacy (access control, audit logging, encryption, risk assessment, incident response, and so on) and 16 covering AI-specific security risks across the five AI layers (input, output, model, infrastructure, agentic), including prompt injection, sensitive information disclosure, model theft, unbounded consumption, excessive agency, and MCP and connector tool abuse.

Cross-framework mappings connect individual controls to their equivalents in other frameworks. Mappings are hand-authored Kyora IQ interpretations, clearly tagged as such, and the community can suggest more through a pre-filled GitHub issue from any control's page. Mappings are not official crosswalks; they are a reasoned starting point, the same way any GRC team builds its own.

Repository layout

kyora-iq/
  data/
    raw/          downloaded source files (gitignored; reproduced by ingestion)
    normalized/   the canonical normalized JSON the whole project reads
  ingestion/      scripts that turn official sources into normalized JSON
  web/            the human-facing site (search-primary, inline expand)
  server/         the MCP server (tools over Model Context Protocol)
  validation/     agent that re-checks normalized data against current sources
  docs/           data model, sourcing policy, architecture
  mockups/        static HTML design prototypes

Build chunks

Each chunk ends with files saved to disk so work is never lost mid-build.

• Chunk 0 — Project map: this README, PROGRESS, data model, sourcing policy.
• Chunk 1 — Real data, wave 1 (7 frameworks) normalized to the schema.
• Chunk 2 — Ingestion scripts that reproduce wave-1 data from official sources.
• Chunk 3 — Web interface (search-primary, inline drop-down detail, left-aligned).
• Chunk 4 — MCP server exposing the data as tools.
• Chunk 5 — Validation agent (re-checks data vs. current publications).
• Chunk 6 — Open-source packaging (license, sourcing statement, deploy docs).

Phases (product arc beyond this build)

• Phase 1 — Trustworthy, searchable, AI-connectable reference (this build).
• Phase 2 — More frameworks, richer mappings, optional environment checks.
• Phase 3 — Security hardening: gateway + authorization in front of the server.

License

See LICENSE (code) and docs/SOURCING-POLICY.md (data/content). Code is open source; framework content follows each source's license as documented.