One Project Record. Every Assurance Output.

Control Frameworks. Right There When You Need Them.

Security Chat helps auditors search, interpret, filter, compare, and discuss security controls from supported frameworks and custom catalogues inside AIS. It recognises control IDs, framework names, topic searches, compliance levels, explanation requests, and follow-up questions, so auditors can move from raw control text to practical understanding without leaving the assessment workspace.

• Look up specific controls by ID, including formats such as AC-2, 16.1.27.C.01, or 5.15
• Ask for the intention, purpose, rationale, or practical meaning of a control
• Search controls by topic, such as multi-factor authentication, privileged access, encryption, logging, or incident response
• Filter controls by framework, chapter, compliance level, or obligation strength where supported
• AIS supports built-in and custom control frameworks, allowing assessments to align with your organisation's policies, standards, and regulatory requirements.

Start With a Draft, Not a Blank Page

The Risk Generator produces AI-generated risk scenarios from the system context, using the selected control framework and project data already entered. Auditors can review, edit, delete, or add additional risks.

Bring Penetration Test Results Into the Record

Import third-party penetration test reports (PDF or DOCX) directly into an audit project. AIS extracts candidate technical findings and observations, maps them to the project's control catalogue, and places every candidate in a review queue. Nothing enters the official record without explicit auditor acceptance.

• AI-assisted extraction of technical findings and observations, capped and schema-validated
• Built-in prompt-injection screening treats report content as untrusted, and suspicious content is flagged for the auditor
• Review queue with accept, edit, or reject per candidate. Accepted items become tracked TF findings with retest notes
• Imported findings flow into the Findings Registry, integrity checks, and reports like any other finding

All Findings. One View.

The Findings Registry shows all findings across every project. Filter by system, auditor, exposure, or classification. Track severity, status, owner, due date, and remediation progress. Overdue items and systemic patterns are visible before they become accreditation problems.

• Each finding links to its source control, associated risk, and remediation plan
• Ownership, due dates, and status tracked in the same record, with no parallel spreadsheet
• Add evidence to a finding and let AIS help identify whether it supports the remediation claim, highlights gaps, or needs further review. The auditor remains in control of the final decision

No Closure Without Independent Sign-Off

Every audit passes through formal review gates before it can be finalised. At each stage the work moves from in progress to under review, and only advances once an independent reviewer has signed it off.

• Gate 1: Security Risk Assessment review
• Gate 2: Control Validation Assessment review
• Gate 3: Final review before closure
• The assigned reviewer is notified at each gate, checks the work, and passes the gate to let the audit continue

Portfolio Visibility for Supervisors and Audit Leads

AIS dashboards turn assessment data into a practical management view for continuous assurance monitoring. Supervisors can see where each project stands, which systems carry the highest risk, which findings are overdue, and which remediation actions need attention before review, accreditation, or certification expiry.

• Portfolio view of active and closed assessments.
• Continuous monitoring of risks, findings, remediation status, and assurance progress.
• Certification and accreditation expiry tracking by system.
• Risk position by system, project, or assessment.
• Findings by severity, status, owner, and due date.
• Management visibility for prioritisation, review readiness, and remediation follow up.