Question 1

Where is my assessment data stored?

Accepted Answer

AIS runs inside your environment, cloud-hosted or on-premises. Assessment data, framework databases, and configuration remain under your control, with no shared infrastructure.

Question 2

Does AIS make accreditation decisions?

Accepted Answer

No. Accreditation decisions, risk acceptance, and sign-off rest with authorised personnel. AIS may assist with drafting and review, but it does not recommend whether a system should be accredited.

Question 3

Which control frameworks does AIS support?

Accepted Answer

NZISM v3.9, NIST SP 800-53, ISO/IEC 27002, the PSR Policy Framework, Privacy Act IPPs, and custom control catalogues.

Question 4

Is AIS aligned with FISMA?

Accepted Answer

Yes. New Zealand's Certification & Accreditation process follows a FISMA-style assurance lifecycle, and AIS supports FISMA-aligned workflows end to end: security risk assessment, control validation against a catalogue, and formal C&A and Authority to Operate (ATO) documentation from one project record.

Question 5

Who is behind AIS?

Accepted Answer

AIS is developed by Andean Security Consulting, a New Zealand security consultancy with over 10 years dedicated to security audits, including 6 years running NZISM, PSR and C&A engagements for New Zealand government and regulated organisations.

Question 6

What reports can AIS produce?

Accepted Answer

SRA, CVP, CVA, combined SRA+CVA, C&A Memo, ATO Memo, EA Memo, Findings & Remediation Plan, Penetration Testing Scope, and Dashboard reports, all from one project record.

The Right Document for the Right Reader

Product Overview

One Pager

Executive Brief

Whitepaper