Cornerstone is the entry point to the Aegis AI™ ladder: one legal entity, one framework of your choosing, on a monthly cycle. Aegis AI runs read-only against your AWS, Azure, Microsoft 365, Okta, or CrowdStrike telemetry and refreshes your control matrix, evidence binder, risk register, and POA&M every 30 days against the framework you name. It costs about what a compliance platform costs. The difference is that a platform hands you a dashboard and an empty evidence list, and Cornerstone hands you the work already done, for your approval before anything leaves.
What Cornerstone covers
- One framework, the one you name. Choose SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF, or HIPAA at intake, and every cycle maps your controls to it. This is the one place the ladder is carved on framework count: Cornerstone carries one, Sentinel and above carry all five. Your evidence is collected once and already maps to the others internally, so adding a second framework is a tier change, not a re-implementation.
- Monthly control validation cycle. Aegis AI runs your full control matrix on a 30-day rhythm. Each cycle produces a refreshed evidence binder, an updated risk register, and a POA&M with target close dates.
- One legal entity. Cornerstone scope is a single corporate entity: one EIN, one production tenant per cloud, one Okta org. If your control plane spans subsidiaries, Vanguard or higher is the right starting point.
- Email support during business hours. Reach
support@ai4ciso.aifor any question about the work product. Same-business-day reply, Monday through Friday. - Audit-ready binder. Each control objective mapped to the evidence artifact, the source system, the responsible owner, and the last validation timestamp. Your CPA, certification body, HIPAA assessor, or PCI QSA opens it and starts validating, not asking for clarification.
The 30-day cycle, in plain English
- Minute 0. Stripe processes your subscription. Welcome email + intake link.
- Minutes 5–15. Intake. Connectors. Read-only, revocable in 30 seconds.
- Hours 1–8. First scan. First deliverable bundle: control matrix mapped to your chosen framework, evidence binder, risk register, POA&M, executive summary. All reviewed before send.
- Day 30. Second cycle. Drift since the last cycle is flagged; new evidence is captured; the POA&M reflects what closed and what slipped.
- Every 30 days thereafter. Same cycle. Card on file charged $1,995 monthly, or $19,950 once a year on the annual term. Billing is managed in your Stripe portal.
What Cornerstone is good for
The person who owns the audit at a company with one production environment and one framework in scope, whether or not their title says security. A customer or a contract has asked for SOC 2, PCI DSS v4.0, ISO 27001, NIST CSF, or HIPAA, and the realistic alternatives are buying a compliance platform and operating it yourself, or paying consulting hours. Cornerstone sits at platform pricing and delivers the work instead of the tooling. When a second framework or a second entity enters scope, Sentinel picks up the same evidence without re-implementation.
What Cornerstone is not
- Not a substitute for your auditor. SOC 2 attestations come from CPA firms; ISO 27001 certifications come from accredited certification bodies; HIPAA and PCI from independent assessors and QSAs. Aegis AI is the readiness software you use before they arrive.
- Not multi-framework. One framework per Cornerstone subscription. When a second one enters scope, Sentinel and above carry all five.
- Not multi-entity. One legal entity per Cornerstone subscription. If your control plane spans more than one corporate entity, see Vanguard (up to 3) or Fortress (up to 10).
- Not weekly or continuous. If you need a tighter cycle, see Guardian (bi-weekly), Vanguard (weekly), or Fortress / Sovereign (continuous).
Start your subscription
$19,950/year on the annual term, two months free against the monthly rate. $1,995/month month-to-month. See the Refund Policy for billing terms. If you ran the $1,995 Multi-Framework Readiness Snapshot in the last 30 days, it credits 100% to month one.
OFAC and Authorized Signatory certification required at intake. Service is for organizations not subject to U.S. sanctions and signed by an officer authorized to bind the company.