How InfosecAgent scores compliance.
AI-assisted assessment is only useful if the result survives the question “based on what?” Our answer: every score is grounded in your evidence, every finding is traceable to its source, and the rules that protect score integrity are enforced in code — not left to a model’s judgment.
1.Grounded in your evidence
Every score is based on your organisation’s actual documentation — policies, procedures, and records you upload (PDF, DOCX, XLSX, TXT). The AI evaluates the evidence relevant to each control; it is never asked to assess a control without evidence and improvise an answer.
Every finding is a pointer, not prose: it traces back to the exact document, page, and section it came from, so reviewers can verify any conclusion against the source. Full AI decision logging can be enabled per deployment, so any scoring decision can be reconstructed after the fact.
2.Integrity rules the AI cannot override
Verbal claims alone can never produce a full compliance score. When a control is supported only by what was said in an interview — with no written evidence behind it — the platform automatically limits the score and flags that documentation is required. The limit lifts as soon as documented evidence exists.
These guardrails are enforced in code, after the AI has answered. An optimistic model response cannot persist an inflated score.
3.Reproducible deliverables
The Statement of Applicability never touches an LLM. It is produced deterministically: same inputs, same output, every run, with every control in the library accounted for. Reproducibility is what makes a SoA defensible in front of an auditor.
The same principle applies to sizing: the Bill of Materials is computed, not generated.
4.Interviews and rescoring
After initial scoring, the platform generates stakeholder interview questions focused on the identified gaps — operational questions for practitioners, management questions for leadership. Completed interviews trigger a targeted re-assessment of the affected controls with the combined document-plus-interview evidence.
5.Frameworks and coverage
- Unified control library: 38 controls, 135 sub-controls, mapping ISO/IEC 27001:2022 and NIS2, with a Greek jurisdiction overlay for Law 5160/2024.
- NIS2 directive article text informs the assessment wherever a control references it.
6.Deployment and isolation
- Multi-tenant with tenant isolation enforced on every database query; per-client access grants for restricted users. Each assessment is strictly isolated from every other.
- Dedicated single-tenant instances; on-premise Docker deployment supported.
- Immutable audit trail on mutations; full AI request/response logging available per deployment.
- Frontier models handle reasoning; a specialised local model handles retrieval; everything that must be reproducible is deterministic code. Model configuration is per-deployment.