Governance, risk & compliance
One connected system of record,
from strategy to control.
Governance, risk and compliance on a single data model, so every objective shows what it costs, what threatens it, and which controls stand underneath it. Built for organisations wherever they operate.
Runs on your own infrastructure or hosted. Tenant isolation is enforced in the database either way.
In the library today · your regulator loaded the same way, wherever you operate
Control library
Frameworks are views, not silos
One control carries a graded mapping to every standard that references it, with one standard marked primary and your own internal standard sitting alongside the published ones.
Frameworks and controlsControl
Privileged access is reviewed each quarter by the system owner
PPTDF applicability
One owner · one procedure · one evidence trail
Architecture
Four decisions that shape everything else
Jurisdictions and authorities are data
Model the regulator that supervises you, wherever you operate, then map controls to it. Nothing about the engine is hard-coded to one rulebook or one market.
Framework coverageTenant isolation at the database
Row-level security enforces company boundaries below the application, on every query, for every module. Application code cannot leak across tenants.
Security and trustNo code, but real logic
Every lifecycle-bound module ships with a system flow you can copy and change: structured conditions, scheduled triggers, escalation ladders, approvals.
Workflow DesignerRuns on-premise or as SaaS
Single-tenant on your own infrastructure, or multi-tenant hosted in an agreed region. Every change lands in an append-only audit log either way.
Platform architecturePlan
From the objective the board approved to the task someone finishes on Friday
Strategy, objectives, initiatives, tasks, budgets and the risks that threaten them are one chain of records. Walk it in either direction, and see which objectives nothing is delivering.
- StrategyTechnology & cyber resiliencev3 · published
- ObjectiveResidual cyber risk within appetiteweight 10% · 2 risks
- InitiativeCyber defence modernisationfunded · on track
- ProjectPAM completionmilestone 31 Oct
- TaskMigrate service accountsdue Friday
- PersonSarah Whitfieldassignee
Assess
Scored against written descriptors, not opinion
Every question in the library defines what each maturity level actually means, so two assessors reach the same number.
Level 3: Well Defined
A standard process is defined and followed across the organisation.
Every question in the control library carries its own written descriptor at each level.
Govern
Ten asset states, each separately permissioned
A coordinator moves an asset to review. Only an approver can approve it. The split is enforced by the permission model, not by convention.
Draft·asset-coordinator creates
Monitor
Indicators that know what they are attached to
Thresholds resolve to within, warning, or critical, and each indicator links to the controls and findings it bears on.
Privileged accounts without review
KRI · monthly · owner: Security Operations
Control
Segregation of duties you can actually evidence
Permission bundles operate at the level of individual lifecycle transitions, with declared conflict rules and logged exceptions.
| Action | asset-viewer | asset-coordinator | asset-approver | asset-admin |
|---|---|---|---|---|
| View | Allowed | Allowed | Allowed | Allowed |
| Create and edit | Not allowed | Allowed | Not allowed | Allowed |
| Submit for intake | Not allowed | Allowed | Not allowed | Allowed |
| Send to review | Not allowed | Allowed | Not allowed | Allowed |
| Send back | Not allowed | Allowed | Allowed | Allowed |
| Approve | Not allowed | Not allowed | Allowed | Allowed |
| Activate | Not allowed | Not allowed | Allowed | Allowed |
| Module settings | Not allowed | Not allowed | Not allowed | Allowed |
Every module ships bundles at this granularity. Segregation-of-duties conflicts are declared as rules, with logged exceptions.
Automate
No code, but real logic
Every lifecycle-bound module ships with a flow you can copy and change: conditions, scheduled and date-field triggers, approvals and escalation ladders, drawn as a flowchart and run by the engine.
- Finding created · severity ≥ HighTrigger
- owner.department = TechnologyCondition
- Remediation plan → Head of TechnologyApproval
- No decision in 5 days → CISOEscalation
- Set state: In progress · notify assigneesAction
Versioned, simulated before publish, run by the engine with every step logged
In the platform
What each module actually does
Strategy & Execution
Is anything actually delivering this?
Coverage and orphan views show which objectives have an initiative, a metric, funding and a benefit, and which have nothing.
Explore the module- StrategyTechnology & cyber resiliencev3 · published
- ObjectiveResidual cyber risk within appetiteweight 10% · 2 risks
- InitiativeCyber defence modernisationfunded · on track
- ProjectPAM completionmilestone 31 Oct
- TaskMigrate service accountsdue Friday
- PersonSarah Whitfieldassignee
Reporting
The pack the board reads comes from the same record
Reporting draws directly from the register, so the number in the board pack and the number in the platform cannot drift apart between quarters.
- Board rollup snapshots generated from the live register, not re-keyed
- Hierarchy aggregates so a group view and an entity view agree
- Report jobs, schedules, and saved presets for recurring packs
- Share links, webhooks, and BI export where the pack has to leave the platform
- Executive dashboards: which objectives are exposed, what it costs, whether it is working
Products
24 modules on one data model
Grouped as the application groups them. Every module reads and writes the same underlying record, so a strategic objective, a vendor engagement, a policy exception and an audit finding all point at the same control.
Govern
Organization
Entities, locations, departments, functions, RACI
Business Catalog
Domains, capabilities, services, processes
Asset Management
Inventory, CIA ratings, ten-state lifecycle
Policy Management
Lifecycle, clause-level mapping, exceptions
Frameworks Management
Unified control library, any standard imported
Strategy & Objectives
Versioned strategies, objectives, coverage
Measurement
Metrics, targets and readings
Execution
Initiatives, programs, projects, tasks
Finance
Budgets, commitments, actuals, benefits
Documents & Evidence
Collect once, cite everywhere, retain by policy
Assure
Compliance Management
Assessments, maturity scoring, control tests
Findings Management
Remediation activities, dependencies, evidence
Enterprise Risk
Registers, appetite, treatment, board roll-up
Operational Risk
RCSA cycles and loss events
IT Risk
Service dependency, DR readiness, capacity
Cyber Risk
Threats, vulnerabilities, event ingestion
Third-Party Risk
Tiering, contracts, due diligence, monitoring
Risk Indicators
KRI / KPI thresholds that open the review
Cyber Field Assessment
Recurring campaigns that propose risks
Who it is for
Organisations that get inspected
Supervised sectors where a control failure is a reportable event, and where the same programme has to satisfy several authorities at once.
- Banking & FinanceVendor tiering, contract obligations, and group-wide assurance under continuous supervision.
- GovernmentNational digital programmes, asset governance, and permissioned approval chains.
- Energy & UtilitiesOT and IT risk on one register, with deep supply chains and critical asset inventories.
- TelecomInfrastructure-scale third-party risk and converged operational and cyber exposure.
Frameworks
Every standard in one model
International baselines, national regulations, and your own internal standards live in the same control model, mapped to each other rather than maintained in parallel.
- Control library imported and mapped
- Assessment templates and questionnaires
- Maturity scoring per framework
- Evidence reuse across mapped controls
| Framework | Scope | Type |
|---|---|---|
| ISO/IEC 27001 | Information security management system, Annex A controls | International |
| NIST CSF 2.0 | Govern → Identify → Protect → Detect → Respond → Recover | International |
| NIST SP 800-53 | Control catalogue with families and baselines | Control catalogue |
| PCI DSS | Payment card data security requirements | Industry |
| CSA CCM | Cloud Controls Matrix for cloud service assurance | Cloud |
| GDPR | Data protection obligations modelled as controls | Privacy |
| Your regulator | Define the authority, its domains, and its controls, then assess against it | Configurable |
Writing
Notes from the compliance trenches
Practitioner notes on the problems that recur across programmes, written for people who already run one.
Practitioner Guide
Everybody Is at Level 3
Run a maturity self-assessment across a large organisation and the results cluster in the middle with suspicious consistency. It is not that everyone is genuinely at the same level. It is that the middle is the safest place to stand. Here is what the levels are supposed to mean and why the jump to level 4 is the one that actually costs something.
8 min read
Practitioner Guide
Red, Amber, Green Is Not a Number
Someone on the board asks what the exposure is worth, and the heat map cannot answer. It was never built to. Here is what goes wrong when ordinal scales get treated as arithmetic, what quantifying a risk actually involves, and which risks are not worth quantifying at all.
9 min read
Practitioner Guide
The Supplier You Never Signed a Contract With
Three of your critical vendors go down on the same morning. None of them are competitors, none share an owner, and nothing in your register connects them. They were all running on the same platform underneath. Here is why fourth-party concentration is invisible to most vendor programmes, and what it takes to see it.
9 min read
See it running on a fully populated demonstration tenant
Objectives, risks, controls, findings, budgets and workflows already in motion across a multi-entity group. Bring the standards you are held to and we will walk the chain end to end against them.