compliance & proof
Prove the fleet is healthy, not just claim it.
MentatNOC records evidence as work happens: every privileged action, every access event, every approval. When an auditor asks for proof, it already exists.
the evidence substrate
An audit log built so it cannot be rewritten.
Every privileged action and every access event writes to an append-only, hash-chained audit log with immutable, WORM retention. Evidence is captured as the work happens, not reconstructed after the fact.
Hash-chained entries
The log proves its own integrity. Tampering with it is evident, which is the point.
WORM retention
Write once, read many. There is no edit path and no delete path.
audit prep
Evidence, packaged for the people who ask for it.
An audit log is only useful if someone can hand it over. MentatNOC turns it into packages built for audit, not raw data an auditor has to interpret.
One-click evidence packs
Pull the relevant slice of audit log, action history, and access records into a single package built for handoff.
Audit-ready exports
Structured exports line up with what auditors request, without manual reformatting on your end.
Point-in-time posture attestation
Capture the state of controls at a specific moment and stand behind it later, whenever the question comes up.
framework readiness
Evidence mapped to what auditors ask for.
MentatNOC maps fleet evidence, the audit log, evidence packs, and posture attestations, to the control questions asked under each framework. It helps you prove controls. It does not certify you.
MentatNOC is pursuing SOC 2 attestation; reports will be published when issued.
camera requirements by framework
What each framework actually asks of your cameras.
Most frameworks never require cameras by name. They require a control, and cameras are how most organizations implement it. These field notes read each rule from its source text and show what an auditor will ask to see.
SOC 2 camera evidence
What counts as evidence that physical security controls operated across the period.
hipaaHIPAA compliant security cameras
Facility access controls under 45 CFR 164.310, and when footage becomes PHI.
cmmcCMMC physical security
The 3.10 practices, where cameras land in the SSP, and what cannot sit on a POA&M.
nerc cipNERC CIP-006 cameras
Monitor, alert in 15 minutes, log for 90 days, test every 24 months.
banksBank security cameras
The Bank Protection Act, 12 CFR Part 21, and the annual report to the board.
pci dssRetail security cameras
Coverage, evidence, and uptime for retail fleets, including PCI DSS sensitive areas.
Retention by industry and state is in the video retention requirements reference. The questions that come up in every review are in what auditors ask about camera systems.
see it in the log
Watch the evidence trail build in real time.
The interactive demo walks a staged action end to end, including the audit trail it leaves behind.