Security Assessment
The onboarding assessment that decides what is in scope, records where you stand today, and drives the program Aegis generates for you.
The security assessment is the first real piece of work in Aegis. It asks how your company is built and run, and its answers decide which control families and policies apply to you, where each area stands today, and what Aegis writes into your program. Aegis generates the program from the assessment you submit, not from guesses.
You find it under Compliance → Assessment, and on the Overview page as a card that shows your progress until the assessment is submitted.
What it asks
The assessment is organised into ten sections. Questions branch on earlier answers, so you only see the ones that apply. The SOC 2 trust criteria question, for example, appears only if you chose SOC 2.
| Section | What it covers |
|---|---|
| Company & people | Frameworks you are pursuing, what the company does, industry, headcount, the executive accountable for security |
| Product & data | What you deliver and the data types you store or process for customers |
| Infrastructure & cloud | Where production runs |
| Identity & access | Your staff identity provider and how people and services authenticate |
| Engineering & change | Source control and how code is built and shipped |
| Vendors & subprocessors | The third parties you depend on, one per line |
| Physical & devices | Offices and how staff laptops are managed |
| Incidents & continuity | What happens when things go wrong |
| Existing program | Prior audits, the audit you are working towards, and when you want to be audit-ready |
| Readiness | One maturity question per control family: your honest starting point |
The readiness questions use a five-step scale: none (nothing in place), ad hoc (done informally), documented (written down), operating (followed consistently) and monitored (measured and reviewed). There is no right answer. An honest "ad hoc" gives you a more useful roadmap than an optimistic "operating".
If you answered the short interview during setup, those answers are already filled in.
How answers become your program
Your answers produce three things, and the review page shows all three before you submit.
Scope decisions
For each of twelve control families (governance, risk, people, access, data protection, engineering, network, vendors, physical, incidents, AI governance and, for ISO 9001, quality), and for each policy template, Aegis decides whether it applies to you. Every decision carries its reason, with a link back to the answer it came from ("because you answered…").
A readiness baseline
Where each control family stands today, taken from your maturity answers. It shapes your roadmap: a family that is already documented does not get a "write the policies" milestone.
Facts about you
Structured facts about your company, hosting, data and tooling ("What we know about you"), which Aegis uses to tailor policies, vendors and risks.
When you submit, Aegis generates your program from those outputs:
- Policies are tailored for the templates that are in scope. Out-of-scope policies are kept, but marked out of scope, so an auditor still sees a complete set.
- Controls and tasks in a not-applicable family are taken out of scope and do not count against your framework scores.
- Vendors start from the list you gave in the vendors section.
- Risks are drafted from what your answers say about your organisation.
Overriding a scope decision
If a decision is wrong for you (a parent company runs a control on your behalf, say), mark it as in scope or not applicable on the review page and give a reason of at least 10 characters. The override and its reason are recorded with the decision.
Finish later and resume
You don't have to finish in one sitting.
- Answers save as you go. Leave and come back to the section you were on.
- Finish later saves any pending answers and opens the app. Nothing is generated until you submit, so the program stays empty until then.
- The Overview card shows how many questions you have answered, with Resume, until you submit.
Every visible question must be answered before you can submit. There is no "not sure" option: if you don't know, ask the person who does, then answer.
Review and submit
Open the review page
It lists the scope decisions with their reasons, the readiness baseline and the facts Aegis took from your answers.
Override what is wrong
Change any scope decision, with a written reason.
Submit and generate
Submitting locks the assessment and starts program generation. You can follow progress in the app. If generation fails to start, your answers are still saved and an admin can use Retry generation on the review page.
A submitted assessment is read-only.
Submitting after your program already exists
Organisations that were set up before the assessment existed can take it from the nav item or the Overview card. If a program already exists when you submit, submitting re-runs program generation with your answers: policies are re-tailored and your current policy text is rewritten, vendors and risks are refreshed, and not-applicable areas drop out of scope. The review page warns you before you submit.
If you have edited generated policies by hand, talk to us before you submit late. Re-tailoring rewrites policy text.
Where each answer came from
Every answer shows its source, so you can tell what a person said from what was suggested.
| Label | Meaning |
|---|---|
| (no label) | Given or confirmed by a person in Aegis |
| From and the document's name | Applied from a Document Vault suggestion that a person approved. "From a deleted document" if the file has since been removed |
| Needs confirmation | An answer your AI agent suggested, waiting for a person to confirm, edit or reject |
Answers from documents only fill gaps. A document never replaces an answer a person gave or confirmed.
Answer with your agent
If you use Claude or another assistant that supports MCP, you can let it propose answers from what you tell it, from your vault documents, and from connected systems. Open Answer with your agent in the assessment to connect it and to see what it has sent.
The rules are strict:
- The agent is told never to answer from general knowledge about your company. If you haven't told it and no connected source says it, it must mark the question as one it couldn't answer.
- Nothing it sends counts until a person confirms it in Aegis. Its answers wait under each question in an amber "Needs confirmation" box, and in the agent panel, grouped by section.
- Each suggestion shows its source: You told it, Document: and its name, with the verified quote, Integration, or Inferred, which is flagged because nobody stated it.
- On a question you already answered, the agent's suggestion appears next to your answer as "Replaces your answer: …". Your answer stays until you confirm the change.
- You can confirm, edit or reject one at a time, or confirm or reject a whole section. The bulk dialog flags questions whose answer changes scope.
- Questions the agent couldn't answer appear in the panel with Answer now.
- The agent cannot submit. Only a person can.
Pending suggestions don't block submitting. They are discarded when you submit, and your current answers are what count. See Connect Claude (MCP) for the tools and the rules the server enforces.
Who can do what
| Role | Assessment access |
|---|---|
| Owner, Admin | Answer, override scope, review agent suggestions and submit |
| Auditor | Read the answers and the review |
| Employee, Contractor | No access |
| Custom roles | Whatever their assessment permission allows |
Answering, confirming and submitting in Aegis require a signed-in person. API keys cannot submit.
What it does not do yet
- No section hand-off. You can't yet assign one section to a colleague. Anyone with assessment access can open any section.
- One assessment per organisation. Re-taking it after submission is not available yet.
- No Statement of Applicability pre-fill. ISO 27001 applicability answers don't yet pre-seed the SoA document.
Next steps
Roadmap
The step-by-step plan that follows from your assessment.
Document Vault
Upload what you already have and get suggested answers to review.
Connect Claude (MCP)
Let your agent propose answers under strict rules.
Getting Started
Where the assessment fits in setting up Aegis.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com