Evidence for your auditors, drawn from the work itself
Ciyora Comply connects what the other modules already do (access reviews, separation-of-duties checks, privileged sessions, posture findings and the audit chain) to the controls in the frameworks you report against. Evidence comes from the platform's own records instead of screenshots collected by hand.
What Ciyora Comply does
One framework library, mapped across standards
Comply keeps a library of frameworks and their controls: SOC 2, ISO/IEC 27001, NIST, CIS, PCI DSS, HIPAA and GDPR, and a regulatory pack for India with the RBI IT governance directions, SEBI CSCRF, CERT-In directions, IRDAI cyber security guidelines and the DPDP Act. Equivalent controls are mapped across frameworks, so one piece of evidence can support several of them.
- Control references follow each regulator’s own numbering, so auditors recognise them
- Controls mapped across frameworks for multi-framework programmes
- Custom controls for requirements that are specific to you
Compliance posture you can track over time
Control status rolls up into a score per framework and an overall posture. Snapshots keep the history, so you can show an auditor how posture moved between assessments.
- Score per framework and overall posture
- Snapshots and history for trend reporting
- Privileged-access controls mapped to the framework clauses they support
Evidence drawn from the work itself
Every access review campaign produces an evidence pack: each decision with reviewer, time and comment. Separation-of-duties results, privileged session records, posture findings and incident records are linked to the controls they support.
- Access review evidence packs as CSV or JSON, with a content hash on the JSON pack
- Separation-of-duties results and privileged-access reports from Ciyora Fortress
- Cloud posture results from Ciyora Armor and incident records from Ciyora Detect
Risk register and policies
Record risks with their owner and treatment, and link each one to the controls that reduce it. Keep your policies next to the controls they implement.
- Risks linked to controls
- Policy library tied to frameworks and controls
AI help for the paperwork
Zara drafts the documents that take the longest, from the controls and evidence already in the platform, using the language model your tenant configures. A person reviews and approves every draft.
- Policy drafts for a control, approved before use
- Evidence checked against what a control requires
- Audit report drafts and remediation plans with status tracking
- Ask compliance questions in plain language
Privacy operations
Track data subject requests from intake to closure and keep consent records that can be revoked, for obligations under laws such as GDPR and the DPDP Act.
- Data subject request intake and status tracking
- Consent records with revocation
An audit trail that proves itself
Each audit entry carries the hash of the one before it. The console recomputes the chain in your browser and can ask the server to verify it from the first entry, so a changed or deleted record is detectable.
What Comply does not do. No tool can make an organization compliant or certified. Comply helps you operate controls and show evidence of them; your auditors and regulators decide whether you meet a requirement. See how this works for RBI, SEBI CSCRF, the DPDP Act and ISO/IEC 27001.
Capabilities
- Frameworks and controls
- SOC 2, ISO/IEC 27001, NIST, CIS, PCI DSS, HIPAA, GDPR and an India regulatory pack, with cross-framework mappings and custom controls.
- Posture
- Scores per framework, overall posture, snapshots and history.
- Evidence
- Access review evidence packs, separation-of-duties results, privileged session records, posture findings mapped to controls, and audit exports.
- Risk and policy
- Risk register linked to controls, and a policy library.
- AI assistance
- Policy drafts, evidence validation, audit report drafts, remediation plans and compliance questions answered from your tenant data.
- Privacy operations
- Data subject request tracking and consent records with revocation.
- Reports
- User access, SoD violations, access certification, privileged access, dormant accounts, joiner-mover-leaver activity and audit exports in PDF, CSV, XLSX or JSON.
- Audit chain
- Per-tenant SHA-256 hash chain over canonical entries, verifiable in the browser and on the server.
How Ciyora Comply works with the rest of the platform
Every module shares one tenant, one identity model, one audit chain and one console, so a finding in one place is context everywhere else.
Ciyora Comply can be bought on its own or as part of a bundle. See Ciyora Comply pricing.
See Ciyora Comply in a demo
A demo walks through the module on a sample tenant and covers how it would connect to your identity provider, cloud accounts and sites.