Everyone reads the framework differently
Hundreds of bodies assess themselves in spreadsheets, each interpreting the same control in its own words. Two organisations can describe identical work and reach opposite conclusions.
Live demonstration on request
From self assessment to a certificate anyone can check.
CyberNexus is the platform we built for assessing compliance with the Pakistan Information Security Framework. An organisation assesses itself against every control that applies to it, with evidence attached. The national Authority reviews that work control by control. An accredited organisation receives a certificate that a bank, a partner or a member of the public can verify in seconds.
Real product screen, sample data
AzbersInnovations
AzbersInnovations
Real product screen, sample dataAzbersInnovations
AzbersInnovations
Real product screen, sample dataAzbersInnovations
AzbersInnovations
Real product screen, sample dataAzbersInnovations
AzbersInnovationsScreens from the CyberNexus demonstration environment. The organisation, its scores and the certificate are sample data.
13PISF domains, built into the platform in full
238controls, each broken down into statements an assessor can test
1,428determination statements answered yes, partly or no
3portals with separate sign in, for organisations, the Authority and the operator
Why we built it
Pakistan has a national framework. It has not had a national way to assess it.
PISF now reaches federal and provincial bodies, autonomous organisations and critical infrastructure. When we sat with the teams preparing for it, the same three problems came up every time, and none of them were about the controls themselves.
Evidence has no common standard
One team attaches a signed policy, another a screenshot, a third nothing at all. Results built on that cannot be compared with each other, and a reviewer has no reason to trust them.
Review leaves no trail
When review happens over email and in meetings it is slow, and afterwards nobody can reconstruct why a decision went the way it did. That is exactly what an appeal will ask about.
How it is organised
Three portals, each with its own front door.
The organisation doing the work, the Authority judging it and the operator running the platform need different things, and none of them should be able to reach into the others. So each has its own portal and its own sign in, and a session in one carries nothing into another.
Organisation portal
Self assessment against every applicable control, an evidence library, control ownership, corrective action plans, a readiness check before submission, and the team and its roles.
Six roles
Authority portal
Review queues scoped by sector, case audit control by control, findings, clarifications, appeals, directives, the certificate lifecycle and a national view of posture.
Four roles
Operator console
Approving organisations, AI settings, security policy, the PISF catalogue and the platform audit log. The operator runs the system without ever seeing what an organisation has assessed.
Authenticator code required
The national workflow
Ten steps, one system, one audit trail.
Every step is taken by someone in a specific role, and every step is written to a record that cannot be edited afterwards. Here is the path a case takes from the day an organisation registers to the day its certificate can be checked.
01 · Organisation
Register
Email confirmed with a one time code.
02 · Operator
Approve
The operator checks the body is who it says it is.
03 · Organisation
Open a cycle
Every control that applies to its profile is seeded.
04 · Organisation
Assess with evidence
Scope each control, answer it, attach the proof.
05 · Organisation
Remediate
Every gap gets a plan with an owner and a date.
06 · Organisation
Submit
The finished cycle is frozen and sent to the Authority.
07 · Authority
Case audit
An auditor records a verdict on every submitted control.
08 · Authority
Sector review
The sector head approves, returns or rejects the case.
09 · Authority
Decide
The Authority head accredits, asks for changes or declines.
10 · Public
Certificate
Issued with a number and a QR code, and publicly verifiable.
We ran this whole chain end to end on the real software before we showed it to anyone, down to a certificate number that verifies on the public page. If a decision is declined, the organisation can appeal inside the platform, and the appeal is handled with the same record in front of everyone.
Inside the product
What each person actually sees.
These are the screens people work in every day, taken from the demonstration environment. Nothing here is a mock up.
Organisation portal
Three signals, never one flattering number.
Compliance, confidence and risk health are shown separately and never averaged together. A score built on weak evidence looks different from the same score backed by strong evidence, and leadership can see which one they have.
- Scores calculated from the answers, never typed in
- A control is capped while its mandatory evidence is missing
- A domain by domain breakdown that is always current
- An executive view that leaves out working detail
Real product screen, sample dataAzbersInnovations
AzbersInnovations
Control workspace
The guidance sits beside the answer.
Each control opens with its statement, its purpose, what it is meant to achieve and how to implement it. The person answering never has to go and find the framework text, and the reviewer later reads exactly what they read.
- Requirement by requirement determinations
- Evidence, findings and recommendations in one place
- Comments and a full history of every change
- Risk exposure shown while a requirement is still weak
Real product screen, sample dataAzbersInnovations
AzbersInnovations
Authority portal
The claim, the text and the proof, side by side.
The case auditor sees the authoritative control, the organisation's answer and every file behind it on one screen, and records a verdict for each control. The Authority's verified score sits next to the organisation's own, so a difference is visible rather than argued about.
- Expected evidence types listed for every control
- Evidence reviewed file by file
- Findings and clarifications sent back formally
- A second auditor for cases that warrant one
Real product screen, sample dataAzbersInnovations
AzbersInnovations
National view
The country's posture on one screen.
The regulator sees every submission, decision and gap across the country, by sector and by domain, instead of assembling the picture from reports that arrive in different shapes. The weakest domains are visible nationally, which is where guidance and training should go first.
- The pipeline from submission to decision
- Weakest domains nationally and by sector
- Corrective action oversight across every body
- Exports for reporting upward
Real product screen, sample dataAzbersInnovations
AzbersInnovations
Integrity by design
Rules no user can skip.
These are enforced by the software on every request, not by hiding a button. Each one closes a gap we have seen in assessments run by hand, where a deadline quietly turns a rule into a suggestion.
A compliant answer is refused until its mandatory evidence has been uploaded.
A control cannot be completed while any gap in it lacks a corrective action plan.
A cycle cannot be submitted while any control in scope is still open.
The organisation's administrator runs the process but can never answer or approve its own assessment.
An Authority auditor cannot close a case until every control sent back for changes has a written finding.
A sector head can decide only the cases that belong to their own sector.
Nothing the AI drafts changes an answer, a finding or a decision until a person accepts it.
Repeated failed sign ins lock the account and alert the administrators.
Segregation of duties
Six roles, each with a line it cannot cross.
The roles mirror how assessment actually works inside an organisation. The limits are checked by the server on every request, so nobody reaches past their line by guessing a link.
| Role | What it does | What it can never do |
|---|---|---|
| Administrator | Runs the cycle, invites the team, assigns ownership and submits | Answer or approve assessment work |
| IT security lead | Assesses, sets scope, plans corrective actions and completes controls | Submit for accreditation |
| Responsible officer | Assesses the controls assigned to them | Touch controls they do not own |
| Internal auditor | Assesses with final say inside the organisation and reads the audit log | Manage the team |
| Commenter | Reads everything and adds review comments | Change an answer or a piece of evidence |
| Viewer | Reads | Comment on or change anything |
Azbers Assist
AI drafts. A person decides. The record remembers.
Most compliance work is reading, and that is where AI earns its place. It reviews evidence, suggests determinations, drafts findings and corrective plans, and summarises a submission for a busy reviewer. It never decides anything, and everything it touches carries its own marking so people always know.
01 · Suggest
A draft appears
AI drafts an answer, a finding or a plan.
02 · Pending
Nothing changes yet
The draft is stored as pending review, and nothing official moves.
03 · Decide
A person decides
Someone accepts it, edits it or rejects it through the normal save.
04 · Record
It is remembered
The decision stays tied to that exact draft and that person.
AI never writes directly to answers, findings, corrective actions or certificates.
A draft cannot be edited or deleted afterwards by anyone, including the person who reviewed it.
The operator chooses the AI provider, can run models hosted inside Pakistan, or can switch AI off entirely.
Works with ControlGraph
Assess PISF once. See what it means for every other framework.
An organisation's finalised PISF results can be sent to ControlGraph, which estimates how far that work already carries toward ISO 27001, NIST CSF and the other frameworks it answers to. CyberNexus keeps the assessment, the evidence and the Authority's verification. ControlGraph keeps the frameworks and the relationships between them. Results travel signed, and anything altered on the way is refused.
Questions we get asked
Before you get in touch
The questions that come up most often, answered the way we would answer them on a call.
Can we see it working?
Yes. We demonstrate CyberNexus on the real software with sample data, and we can do it on your premises. A demonstration walks one case from the first answer to a certificate that verifies on the public page.
Where would our data live?
In Pakistan, on government or accredited infrastructure that you choose. CyberNexus supports private cloud, on premises and air gapped deployment, because for this kind of data hosting is a condition rather than a preference.
Does the AI send data out of the country?
Only if the operator chooses a provider outside it. AI can run on models hosted inside Pakistan, or be switched off entirely, and the platform works either way.
Does AI make any compliance decisions?
No. It drafts, and a person decides. Nothing it produces changes an answer, a finding, a corrective action or a certificate until someone accepts it, and that acceptance is recorded against their name.
Who has checked its security?
We test it ourselves the way an attacker would, and we welcome an independent audit and penetration test by PKCERT or an agency it nominates before it holds real assessments.
Are we locked in?
No. The data belongs to the organisation that owns it and exports in open formats.
See it running, on your own premises if you prefer.
We demonstrate CyberNexus on the real software with sample data, walking one case from the first answer to a certificate that verifies. Tell us who should be in the room.