Assessment records
Every control answer keeps its reviewer, its date and the material behind it.
Qatar NIAP focused
From first analysis to audit day.
Business impact analysis, data classification, control assessment and the evidence behind every answer, held in one place so the work done in month one still stands up in month eleven.
C0Public
C2Restricted
C4Secret
Impact score by business process
Illustrative interface
AzbersInnovations
AzbersInnovations
Why it exists
A national framework asks for order before it asks for controls.
Most teams begin at the control list, which is the wrong end. Until you know which processes actually matter and which data actually needs protecting, control selection is guesswork with a template attached.
01
Impact analysis
Which processes cannot stop, and what it costs when they do.
02
Data classification
What the organisation holds, and how sensitive each category really is.
03
Control assessment
Controls chosen against that picture rather than against a generic list.
04
Evidence
Proof attached at the point it is produced, not gathered later.
05
Gap tracking
Shortfalls become owned work with dates rather than notes in a report.
06
Audit readiness
The submission is assembled from live records instead of rebuilt by hand.
Where it sits
Regional depth beside the flagship platforms.
ComplianceVault is deliberately specific. It knows one framework well rather than many frameworks loosely, which is exactly what a team in the middle of a NIAP programme needs from it.
Where an organisation grows beyond a single regime, the broader mapping problem is the one ControlGraph is built for, and the verification and remediation lifecycle is where CyberNexus takes over.
Evidence handling
Attachments stay linked to the control they justify rather than to a folder.
Gap register
Shortfalls carry an owner, a target date and a visible state.
Audit pack
The submission is generated from the same records the team worked in.
What it covers
The whole programme, in order.
Most teams start at the control list, which is the wrong end. This follows the order the framework actually expects.
Business impact analysis
Which processes cannot stop, what it costs when they do, and which of them the rest of the programme should be built around.
Data classification
What the organisation holds and how sensitive each category really is, so protection follows value rather than habit.
Control assessment and evidence
Controls chosen against that picture, with the proof attached at the moment it is produced rather than gathered later.
The audit pack
Assembled from the same records the team has been working in all year, so submission day is a export rather than a rebuild.
Questions we get asked
Before you get in touch
The questions that come up most often, answered the way we would answer them on a call.
Is this only for Qatar NIAP?
It is built around that programme specifically, and it knows it well rather than knowing many frameworks loosely. Organisations answering to several regimes at once are usually a better fit for ControlGraph.
Where does it fit against CyberNexus?
ComplianceVault carries a single programme from first analysis to audit day. CyberNexus is the verification and remediation lifecycle underneath, and is built for oversight across many organisations.
Can we start part way through a programme?
Most people do. Tell us which stage is currently stuck, because that is usually a more useful starting point than the beginning.
What happens to our evidence?
It stays linked to the control it justifies rather than sitting in a folder near it, and it stays under the same isolation and access rules as everything else we build.
Working through a NIAP programme?
Tell us where you are in it. The useful conversation usually starts with whichever stage is currently stuck.