ReferenceFAQ

Aegis FAQ

The questions CISOs, GRC leads and founders ask most about Aegis.

Does Aegis get us certified?

Aegis gets you audit-ready and gives your auditor a clean, read-only room to work in. An accredited auditor still issues the SOC 2 report or ISO certificate, Aegis does the program work that makes that a walkthrough instead of a scramble.

How fast can we stand up a program?

The interview and materialization produce a real, framework-mapped program, controls, policies, evidence backlog, risk register, vendors, in an afternoon. Getting to audit-ready then depends on how quickly you assign owners, connect systems and close genuine gaps, not on how long it takes to build the scaffolding.

What is the security assessment, and do we have to finish it in one go?

It is the set of questions that decides what is in scope for you and records where each area stands today; Aegis generates your program from it. You can choose Finish later and come back from the nav or the Overview card. Nothing is generated until you submit. See Security Assessment.

Can our AI agent fill in the assessment?

It can propose answers over MCP, under rules the server enforces: every answer needs evidence, document answers must quote the document, and nothing counts until a person confirms it in Aegis. The agent can't submit.

Can we upload the documents we already have?

Yes. The Document Vault reads policies, vendor lists, risk registers, contracts and diagrams, and suggests vendors, risks, facts and assessment answers, each with a quote you can check. Nothing is applied until a person approves it, and documents never override answers a person gave.

Who sets the dates on our roadmap?

You do, if you want them. Owners and admins can set a target date per milestone and an audit date per framework; without dates, the roadmap shows progress only. NexusVoid curates the roadmap's structure.

Which frameworks are supported?

SOC 2, ISO 27001, ISO 42001, NIST CSF, NIST AI RMF, the EU AI Act, GDPR, India's DPDP, HIPAA and PCI DSS, among others, all on one shared-control model so they reuse each other's work. If you need one that is not listed, ask us.

Do we have to do multiple frameworks separately?

No, that is the point of the shared-control model. One control can satisfy requirements across many frameworks at once, so a second framework is mostly the delta over the first, and evidence you collect counts everywhere it maps.

Are the AI-written policies actually usable?

They are strong first drafts written in your real context, your cloud, data types and workforce, not generic templates. A human owner reviews, edits and approves them before they are published. Most teams find they are editing, not writing from scratch.

Can someone skip review and mark evidence done?

Not when your organisation turns on Evidence Approval. Tasks are then submitted for review and only the assigned approver completes them, including tasks that an automated check passes. The Aegis API enforces it for API keys and MCP as well as the app. Policies always go through approval: a policy is published only when the approver you chose accepts it, and published text can't be edited in place. See Evidence & Tasks and Policies.

Can Aegis mark a control as met on its own?

No. A control with no evidence is shown as in progress, never as met, and automated checks that cannot run report not-determined rather than pass. Aegis is deliberately honest about the difference between "we looked and it holds" and "we could not look."

What does the device agent actually see?

It reports endpoint-compliance posture, the signals a control asks about, and builds a software inventory (including Shadow AI). It is an evidence source for device controls, not a surveillance tool.

Is Aegis itself SOC 2 certified?

Not yet, we are early on our own journey, and we would rather tell you that than imply otherwise. See Security & Data Handling for exactly where we stand and what we can show your team today.

How does Aegis relate to Argus and the rest of the platform?

Aegis is the compliance and governance module; Argus secures your code and supply chain, and the teaming suites test and defend your AI systems. They share one account, roles and billing, and Argus's technical findings and pull-request gates make good evidence for change- and vulnerability-management controls.

Who is Aegis for?

CISOs and heads of security, GRC and compliance leads, and founders or engineering leaders who need a real program without hiring a full GRC function. See Use Cases.

How do we get started?

Follow Getting Started, or reach out and we will walk you through it.

Contact us

Was this page helpful?