Framework language is preserved
Reports use the concepts and status language of the selected framework rather than forcing every view into Core risk terminology.
Framework-specific assessment
Assess against the language your assurance teams already use
Aegis101 combines a stable risk-assessment foundation with governed framework views that retain each framework's structure, terminology, uncertainty, and limitations.
The CAF view is answer-based mapped screening. It supports review and prioritisation; it is not a formal CAF assessment or evidence-validated judgement.
Framework-owned structure
Traceable mapped basis
Visible uncertainty
Explicit assurance boundaries
A governed portfolio
One risk foundation. Distinct framework views.
Each view shows how the submitted answer basis connects to the framework, where information remains incomplete, and what requires further evidence or judgement.
Aegis101 Core
The risk foundation
Core assessment captures context, routes questions, interprets submitted answers, identifies material weaknesses, and directs remediation and evidence follow-up.
Framework-specific views
A portfolio, not a generic mapping label
Each framework is introduced through controlled mapping, framework-specific language, routing, report treatment, and explicit assurance boundaries. The portfolio can grow without making one framework the identity of Aegis101.
Governance principles
What must stay true as the framework portfolio grows
Adding breadth must not weaken the integrity of the interpretation.
Mappings remain traceable
Users can understand which answer basis contributed to a framework view and where further judgement or evidence is needed.
Uncertainty remains visible
Unresolved mapped controls remain Not Assessed or insufficient basis. Missing information cannot create a favourable framework direction.
Assurance is not overstated
An answer-based indication does not become an audit finding, compliance decision, certification, or evidence-validated outcome.
First framework implementation
NCSC CAF v4 mapped screening view
The CAF view organises mapped response signals against CAF objectives, principles, contributing outcomes and applicable Indicators of Good Practice direction. It is not a formal CAF assessment.
- Answer-based indication: highlights mapped gaps, partial indications, or no adverse indication from the recorded responses.
- Outstanding controls: retains unresolved mapped controls as Not Assessed and provides a route back to complete them.
- Direction for further review: identifies relevant CAF and IGP areas for evidence, judgement, or treatment.
- CAF-specific action planning: groups contributing outcomes by appropriate follow-up route.
- Explicit boundary: does not declare Achieved, Partially Achieved, or Not Achieved as a formal CAF judgement.
Growing coverage
A framework portfolio shaped by practical risk use
Recognised security, resilience, and technology standards are introduced through governed views that retain their structure, interpretation, outstanding states, and compatible assessment history.
Framework-owned structureObjectives, outcomes, controls, or requirements retain their hierarchy.
Specific interpretationStatus and action language fits the selected framework.
Compatible historySaved records preserve the governed framework basis; authorised users can rerun eligible assessments and compare compatible reports they can access.
Tell us which frameworks matter to your risk programme
Register interest to discuss current framework-specific reporting and the standards that would provide the greatest practical value to your organisation.