Roadmap
Your compliance program as a step-by-step process: phases, milestones with a clear 'done when', the real tasks and policies behind each one, optional dates you set, and a board to move the work.
Controls, tasks and policies tell you what exists. The roadmap tells you what to do next. It lays your program out as a step-by-step process, from kick-off to audit, with the real tasks and policies under each step, so you always know where you are and what is waiting.
You find it under Compliance → Roadmap. It has two tabs: Process and Board.
How the roadmap is made
You submit the assessment
Your security assessment decides which control families are in scope and how mature each one is today.
Aegis drafts the roadmap
A draft is built from the assessment and the program Aegis generated, with milestone descriptions written for your organisation.
NexusVoid reviews and publishes it
NexusVoid curates the structure: it can add, edit or exclude milestones, set the kind of audit you are working towards, and then publishes the roadmap. Until then you see "NexusVoid is preparing your roadmap".
The draft follows from your answers:
- Out-of-scope families are left out. If the assessment marked a family not applicable, it has no milestones.
- Your readiness counts. A family you rated documented or better gets no "policies approved" milestone, and one rated operating or better gets no "controls operating" milestone.
- The audit kind matters. An evidence observation window is added only for a Type II, certification or surveillance audit, not for Type I.
- ISO 27001 adds its own steps: Statement of Applicability approved, and internal audit completed.
If you submit a newer assessment later, NexusVoid regenerates the roadmap to apply it.
Process: phases, milestones, linked work
The Process tab shows the roadmap in five phases:
| Phase | Typical milestones |
|---|---|
| Foundation | Kick-off: owners and scope confirmed |
| Policies | One per control family, for example "Access control: policies approved" |
| Controls operating | One per control family, plus remaining evidence tasks |
| Evidence window | The auditor-observed period, for Type II, certification and surveillance audits |
| Audit prep | Statement of Applicability and internal audit (ISO 27001), and a readiness review with NexusVoid |
Every milestone has a Done when: the plain condition that completes it, such as "Every policy below is published" or "Every task below is done or marked not relevant". Under it are the tasks and policies it links to: the same items you work on elsewhere in Aegis, not copies.
- Most milestones complete themselves. When every linked item is done, the milestone is done.
- Some are completed by hand, such as the kick-off, the evidence window and the readiness review, because there is no task that proves them. An owner or admin marks them complete.
- Order is kept. A milestone that depends on another shows Waiting on… until the earlier one is done.
Each milestone shows progress (how many linked items are done) and a status: not started, in progress, waiting on another milestone, or done.
Optional dates, set by you
The roadmap does not invent a schedule. Every organisation's priorities are different, so dates are yours to set, and they are optional. Owners and admins can set:
| What | Where |
|---|---|
| A target date per milestone | On the milestone. Must be after today; clear it at any time |
| An audit date per framework | Audit dates, at the top of the roadmap |
| A milestone owner | On the milestone |
Where a milestone has a target date, it shows on track, due soon (within 14 days) or overdue. Without a date, it shows progress only.
Each framework with an audit date shows whether it is on track, at risk (a milestone that serves it is overdue or dated after the audit), overdue or complete.
Structure stays with NexusVoid: you can't add, remove or reorder milestones yourself. If the plan doesn't fit how you work, tell us and we will change it.
Up next
Up next lists open work you can start now, overdue first, then by target date: the open tasks and policies of milestones that aren't waiting on anything, and milestones that are completed by hand. A new roadmap starts with the kick-off.
Board
The Board tab shows the roadmap's tasks and policies as cards in four status columns: To do, In progress, In review and Done. A task linked to several milestones appears once. Filter by milestone, phase or assignee.
Move a card by dragging it, or with its Move to… menu. Moving a card changes the real item, so the task page, the board and your framework scores always agree.
| Move | What happens |
|---|---|
| A task to To do, In progress or Done | The task's status changes |
| A task to In review | The task is submitted for review. You choose an approver |
| A task to Done, when your organisation requires evidence approval | The task is submitted for review instead; the approver completes it |
| A task already In review, when approval is required | Locked: it is waiting on its approver |
| A policy, in any direction | Locked: policies go through review and approval on the policy page |
Failed tasks sit in To do and not-relevant tasks in Done, each with a badge. Draft policies sit in To do, policies awaiting approval in In review, and published policies in Done. People who can't update tasks see the board but can't move cards.
See Evidence & Tasks for how review and approval work.
Who can do what
| Role | Roadmap access |
|---|---|
| Owner, Admin | View; set target dates, audit dates and milestone owners; mark hand-completed milestones done; move task cards |
| Auditor | View |
| Employee, Contractor | No access |
| NexusVoid | Generate, curate and publish the structure |
Custom roles that hold the roadmap:update permission can plan the roadmap like an admin.
What it does not do yet
- No suggested dates. Aegis does not work out a schedule or tell you whether an audit date is achievable. Dates are only the ones you set.
- No reordering by you. Milestone order and dependencies are set by NexusVoid.
- No reminders. There are no digests or due-date alerts yet; check Up next.
- No timeline view. The roadmap is a process and a board, not a Gantt chart.
Next steps
Security Assessment
The answers the roadmap is built from.
Evidence & Tasks
The tasks behind each milestone, and how approval works.
Policies
How policies move through approval to published.
Frameworks
The live coverage your roadmap moves.
Contact us
- Website: nexusvoidai.com
- LinkedIn: linkedin.com/company/nexusvoidai
- Email: ujwal@nexusvoidai.com