Getting Started with Aegis
From an empty account to a materialized, framework-mapped compliance program, and what to do in your first 90 days.
Aegis is designed so that the first hour produces a real program, not an empty shell you fill in yourself. You describe your business once, in a short setup interview and a security assessment; Aegis does the scoping, drafting and mapping.
Before you start
You will get the most out of setup and the assessment if you know:
- The frameworks you need (for example SOC 2, ISO 27001, or the EU AI Act). You can add more later, they share work.
- Where you host and what you handle, your clouds, regions, and the categories of data you process.
- Your workforce shape, employees vs contractors, remote vs office, company vs personal devices.
- The tools you run, identity, source control, cloud, HR, analytics and the like. This seeds your vendor list and your integrations.
- How mature each area is today, honestly. The assessment asks, and the answer shapes your roadmap.
If you already have policies, a vendor spreadsheet or an architecture document, upload them to the Document Vault and Aegis suggests assessment answers, vendors and risks from them for you to review.
None of this has to be perfect. You can leave the assessment and come back, and everything the program contains afterwards is editable. Scope decisions can be overridden, with a reason, before you submit.
Set up your program
Create your organization
Choose your frameworks, name your organization, and add your website. Aegis uses the website to brand your workspace and Trust Center.
Answer the interview
A short set of questions about your product, hosting, data, workforce and tooling. Your answers pre-fill the security assessment.
Complete the security assessment
Ten sections on how your company is built and run, ending with how mature each area is today. It decides which control families and policies are in scope. Choose Finish later to leave and resume from the nav or the Overview card; nothing is generated until you submit. You can also let your AI agent propose answers for you to confirm. See Security Assessment.
Review and submit
Check the scope decisions and their reasons, override any that are wrong, and submit. Aegis then generates your controls, policies, evidence backlog, a starter risk register and a vendor list, scoped by your answers and mapped to the frameworks you chose. This runs in the background and populates your workspace as it completes.
Review what it built
Walk the Overview dashboard. You will see a control library, draft policies written in your context, an evidence backlog grouped by category, risks with suggested control mappings, and vendors with risk assessments.
Follow your roadmap
NexusVoid prepares a roadmap from your assessment: phases and milestones from kick-off to audit, with your real tasks and policies under each. Once it is published, set any target and audit dates you want and work from Up next.
What gets created for you
A freshly materialized program is not a blank framework, it is populated with your organization already in it:
| Artifact | What Aegis generates | You then |
|---|---|---|
| Controls | The control set for your frameworks, with shared controls mapped across all of them | Assign owners and attach evidence |
| Policies | Full policy documents drafted in your real context, in draft status. Out-of-scope templates are kept but marked out of scope | Review, edit and publish |
| Evidence tasks | A backlog grouped by category (access, change management, backups…) | Assign, set cadence and complete |
| Risk register | A starter set of risks with inherent and residual scoring | Confirm, map controls, add treatments |
| Vendors | The vendors from your assessment, with AI risk assessments | Confirm scope and residual risk |
| Roadmap | A step-by-step plan, prepared and published by NexusVoid | Set dates and owners, work from Up next |
Your first 90 days
A sensible order of operations once the program exists:
Days 1–15 — Own it
Hold the kick-off milestone on your roadmap: name owners and agree scope. Assign an owner to every control, policy and evidence task. Connect your identity provider, source control and cloud so evidence starts flowing. Publish the policies that are already accurate.
Days 15–45 — Close the obvious gaps
Work the evidence backlog by category. Turn on cloud tests for your AWS, GCP or Azure accounts. Confirm your risk register and let Aegis map risks to controls and generate treatment tasks. Roll out the device agent to your team.
Days 45–90 — Get audit-ready
Drive control coverage up, finish policy sign-off, resolve high risks, and complete your vendor assessments. Stand up the Trust Center. When coverage is where you want it, invite your auditor to the read-only auditor view.
Roles you will set up
Aegis uses role-based access so the right people see the right things. The common starting set:
- Owner / Admin — full control of the program (usually the CISO or compliance lead).
- Employee — sees and completes the tasks and training assigned to them.
- Contractor — a scoped role for non-employees.
- Auditor — a read-only view of controls, evidence and policies for your external assessor.
See Team & Access for the full permission model and custom roles.
Next steps
Security Assessment
What the assessment asks and how it scopes your program.
Roadmap
Your program as a step-by-step process, with a board.
Frameworks
Understand the shared-control model that makes multi-framework cheap.
Evidence & Automation
Connect systems so evidence collects itself.
Policies
Review, version and publish the policies Aegis drafted.
Capabilities
The full feature reference.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com