Someone Will Ask for Evidence Sooner Than You Think

Something happened while building Cadres that I didn’t plan for.

I needed tools to run the business: compliance tracking, access management, basic financial controls. Every company needs them once it has contracts, costs and access worth protecting.

I looked at what was out there and decided I’d rather build it than pay for it.

That decision cost me months. I’m not going to pretend otherwise.

It also made me think hard about what “operationally mature” means for a company that’s small but serious. Most teams get the timing wrong. They treat it as something to sort out once the company is big enough, and by then it’s expensive.

Yes, this is a pivot

The first four posts were about Cadres as an RMM. That’s still the core, but Cadres is bigger now.

When I started building compliance and access tools for myself, the same problem showed up as with RMM. The products on the market are built for large enterprises and too thin for everyone else. They assume a dedicated GRC team, a procurement process and someone whose job is to keep the compliance platform running. Most companies have one person covering four jobs, and they need the tool to work without becoming a fifth.

So I kept building: GRC, accounting, identity and access governance. None of it is exciting, and all of it matters once someone outside the company has to trust you.

Cadres is a suite now. Meridian is the compliance and audit product, and this post explains why it exists.

The question always comes at a bad time

Every company gets there eventually.

A prospect asks for a security packet. A customer asks how you review access. A partner wants proof that a control is running, not just written down. An auditor asks a reasonable question and the honest answer is “let me go through some spreadsheets and get back to you.”

The process isn’t what failed. The information exists; it’s spread across six systems, three people’s memories and a folder structure that made sense eighteen months ago.

Answering the question isn’t the hard part. Pulling the answer together from pieces that were never meant to fit is. You’ll do that every time someone asks, under more pressure each time, until you fix how the information is kept.

Mature doesn’t mean heavy

This is where people get the wrong idea about the fix.

You don’t need an $80k-a-year GRC product and a consultant to install it. You don’t need a compliance department.

You need a few things to be true at once. Someone owns each thing. Access can be explained and reviewed. Controls are tied to what your systems do as well as what the policy says. Evidence comes from systems, not from whoever remembers. Findings become tracked work that gets closed.

That’s about it.

The overhead comes from doing it badly. When controls, evidence, reporting and remediation live in one system, you spend much less time reconstructing what happened.

Why I built Meridian

The enterprise compliance tools assume more process than most growing companies have. The lighter ones are mostly documentation tools with compliance screens on top. They tell you what to do, but they don’t connect to the systems that prove you did it.

I wanted controls that update themselves. Evidence collected because systems are connected, not because someone ran a quarterly export. A finding that opens a tracked remediation item on its own instead of landing in a spreadsheet.

I couldn’t find that at a price or complexity that made sense for a company Cadres’ size, so I built it.

Building Meridian alongside the core platform pushed back the date anything reached customers. That’s a real cost and I chose to pay it. I wasn’t willing to ask customers to trust Cadres with their operations while I ran my own on a collection of disconnected tools.

If you wouldn’t sell your own stack to someone else, you probably shouldn’t be running on it either.

How Meridian works

Meridian has four building blocks: programs, controls, evidence and findings.

A program is a framework such as ISO 27001, SOC 2, NIST CSF or your own internal standard. Controls are the requirements under it. Evidence shows a control is working. A finding is raised when it isn’t.

What makes it more than documentation is the link to the rest of Cadres. When Relay patches a server, Meridian sees it. When the PAM vault rotates a credential, Meridian records it. When a compliance scan runs, its findings go straight into remediation work linked to the right control.

Certification isn’t the point. The point is that when someone asks a hard operational question, the answer is already there, because the systems were connected the whole time.

Waiting costs more

Teams think they’re putting this work off. They’re not.

They’re signing up to do more of it later, under more pressure and with worse inputs: access that was never scoped properly, controls never mapped to real systems, and evidence that exists somewhere but not anywhere you can point to.

Operational maturity starts when someone outside the company needs to trust it, and that usually happens earlier than teams expect. The companies that handle it well treat it as an engineering problem, not an admin task.

That’s what Meridian is for.

If your team answers basic operational questions with screenshots, side conversations and whoever happens to remember, start a trial.