Platform
One process. Every framework.
NURA follows the NIST Risk Management Framework from setup to monitoring. The work you do at each step carries over to every framework you report against.
Prepare: the foundation.
Register your systems, your teams and the controls they share, like a cloud platform or an identity provider. Every new system starts from that shared ground.
An agency node and two common control providers appear; the system registers and inherits from them.
Categorize: know what’s at stake.
NURA walks you through the data each system holds and how much harm a breach would cause, then sets its impact level. Every change is versioned.
Three kinds of data are scored for confidentiality, integrity and availability; the highest score sets the system at Moderate.
Select: the controls that apply.
The impact level pulls the right NIST baseline and the matching requirements from your other frameworks. Scope out what doesn’t apply, mark what’s inherited, and note why.
The Moderate baseline appears, already mapped to your other frameworks; scoped-out controls are dashed and inherited ones marked, leaving 261 of 287 in scope.
Collect: evidence without the chase.
Read-only connectors pull evidence from your cloud, identity provider, security tools and older systems. Short guided questions cover the controls people answer for. Everything is sealed the moment it arrives.
Six sources send evidence into the baseline, which fills row by row as each record is hashed.
Assess: checked automatically.
Every control is tested against its evidence as it comes in. Failures are ranked by severity and become tracked action items with an owner.
Controls pass in a wave; five fail and seven action items open, ranked by severity.
Report: any framework, on demand.
Produce a readiness report for SOC 2, ISO 27001 or any mapped framework, or an OSCAL package for government, from current data. Every claim links to its evidence.
The baseline moves aside and SOC 2 and ISO 27001 readiness reports and a government OSCAL package are generated; a line traces a claim back to its evidence.
Monitor: the loop that closes.
Each system and framework has a live health score. Drift is flagged within hours and collection runs again. Evidence stays current, and so does your compliance.
The health score fills to 912; one control drifts amber and turns green again as collection re-runs; the open action items stay marked.
Product views show illustrative sample data.
Verifiable by math, not by trust.
Each record gets a unique fingerprint when it’s collected. Corrections are added as new records, so the original and the fix both stay on file. Anyone can recompute the fingerprints and see the complete history.