From framework to board report,
in one connected system
See what Netra is made of and how work moves through it. Every step updates the same record, so nothing is collected twice.
Task Engine · one task, credited everywhere
Not started
In progress
In review
Done
Enforce MFA for remote access
Owner: IT Security
Evidence uploaded once. Credited to:
How the work flows
The Netra journey
Eight steps, one record.
- 1
Framework selection
Choose the frameworks you hold or need from a library of 50+ frameworks, including the RBI Directions, ISO 27001 and SOC 2. Everything that follows is scoped by this choice.
Open Compliance CentreYou start with a short onboarding questionnaire of about 20 questions, including which frameworks apply. Netra AI then builds your workspace, so you begin with a populated programme rather than a blank template.
- Choose from a library of 50+ frameworks, including the entity-specific RBI Directions, CERT-IN, NISPG, ISO 27001 and SOC 2
- Policies, controls, tasks and risks are generated for the frameworks you select
- Upload the policies you already have; they sit alongside the live Netra policy for auditors to compare
- Each policy carries a score out of 10 that shows how much of it has actually been implemented
- Administrators can add frameworks after onboarding, and existing work counts towards them
Netra · Compliance Centre · Frameworks - 2
Policies
Your policy library is generated from the frameworks you selected, so the organisation starts with policies that match what it is held to, not a blank template set.
Open Policy HubNetra · Policy Hub · The library - 3
Tasks
Tasks are generated from those policies, with owners and due dates. Each task shows every framework it satisfies, and recurring tasks keep evidence current.
Open Task EngineThe Task Engine is where the programme is run. Requirements arrive as concrete tasks, so the team works through actions instead of interpreting control text.
- Each task has an owner, a due date, the requirement it meets and guidance on how to complete it
- The “satisfies” line shows every framework control the task counts towards
- Recurring obligations, such as quarterly reviews, reopen automatically so they do not lapse
- Done counts towards your scores; N/A removes a task that genuinely does not apply
- Each task links to its policy and the risks it treats, and can hold SOPs and company notes
- Netra AI can explain what evidence a task needs and suggest which assets it applies to
What you getOwned workRecurring scheduleLinked policies and risksNetra · Task Engine · All tasks - 4
Assets
An asset register linked to the tasks, so you know what each piece of work protects and which evidence applies to which system. Netra AI proposes the asset types and the individual assets a task touches, with its reasoning and the lines it read; a person confirms.
Open Asset ManagementNetra · Linking assets to a task - 5
Cloud Management
Connect cloud accounts to keep the cloud inventory current, with its security checks and the cloud risks they raise traced back to controls and tasks.
Open Cloud ManagementNetra · Cloud Management · Posture - 6
Evidence
Evidence is uploaded once against the task and kept tamper-evident. Store it in Netra or in your own storage.
Open Task EngineEvidence is the proof that a control works: a report, a log, a screenshot or a signed document. In Netra it is attached to the task once, while the work is being done.
- Attached once, then counted towards every framework the task satisfies
- Kept tamper-evident, so you can show it has not changed since it was submitted
- Pulled straight into an audit’s Evidence Vault, so it is never gathered twice
- Stored in Netra’s cloud by default, or in your own storage such as Azure Blob, Amazon S3, Google Drive, SharePoint, Dropbox Business or Box
Netra · Evidence, and where it is kept - 7
Compliance status
Control status is derived from completed tasks and evidence, never typed in. See live posture for each framework.
Open Compliance CentreThe Compliance Centre is the framework view of the same tasks. There is one record per task, so a change made here updates the Task Engine, and the other way round.
- Control status is worked out from completed tasks and evidence; nobody types it in
- Overview: an executive dashboard for each framework, with a control-status breakdown and analysis charts
- Controls: the working register, where each control opens to its tasks, policies and evidence
- A control becomes Out of Scope only when every task mapped to it genuinely does not apply
- The framework report button produces the board report from live data
What you getLive posture per frameworkControl registerNetra · Compliance Centre · Controls - 8
Risk
A risk register with inherent and residual heatmaps. Risks come down as the linked tasks are completed.
Open Risk ManagerRisks are generated from your risk profile and enabled frameworks, so the register does not start empty. Your team assesses each risk, decides the treatment, assigns an owner and drives the treatment to completion.
- Inherent and residual risk side by side on twin heatmaps, so leadership sees what treatment has removed
- Residual risk comes down as the linked tasks are completed
- Treatment options of mitigate, transfer, avoid or accept, each with budget implications the board can see
- A Key Risks filter gives directors a focused view
- The register exports to PDF for board and committee packs
What you getRisk registerTwin heatmapsTreatment planNetra · Risk Manager · Heat map - 9
Vendors
Find vendors from what Accounts and Purchase pay, run public-source checks, assess them through a vendor portal and record each decision.
Open Third-Party RiskNetra · Third-Party Risk · Vendor register - 10
Audit
Internal, external, certification and regulatory audits run end to end on the evidence already in place: planning, fieldwork, findings, corrective actions and reports.
Open Audit CentreThe Audit Centre runs an audit from set-up to the issued report, with the auditee and the auditor working in the same place.
- A six-step set-up: audit details, frameworks in scope, current assessment, platform mode, team and review
- Internal, external, certification (including surveillance and recertification) and regulatory audits
- Auditors see only what is in scope and what is submitted; their workpapers stay private to the audit team
- Findings record the condition, effect, root cause and recommendation, with a severity from Critical to Informational
- Corrective action plans are approved or returned until they address the root cause, then verified and closed
- The audit closes with a formal opinion: Unqualified, Qualified, Adverse or Disclaimer
What you getFindings registerCorrective actionsAudit reportNetra · Audit Centre · Audit overview - 11
Reports
A live Posture Score, a one-click board report, audit reports and third-party risk reports.
Open Dashboard & ReportsReporting is built from live data, so it is ready when the board, a committee or an auditor asks.
- A Posture Score from 0 to 100, computed from control and task completion and weighted by importance
- The score moves only as work is done or obligations lapse, never by editing it
- A one-click board report for each framework: executive summary, risk exposure, policy impact, remediation roadmap, critical gaps, full register and sign-off page
- Audit reports from the Audit Centre and third-party risk reports from Third-Party Risk
What you getPosture ScoreBoard reportAudit and vendor reportsNetra · Board report · Executive summary
Netra AI
It does not answer from the internet. It answers from your records.
General assistants can tell you what ISO 27001 says. Netra AI can tell you which of your own tasks to do first, and why, because it reads the same tasks, controls, risks, assets and evidence the rest of the platform runs on. It advises. Your people decide.
Tasks
owner, due date, status, evidence
Policy controls
what each one requires
Frameworks
which controls a task satisfies
Risks
inherent and residual, and what treats them
Assets
criticality, exposure, what they process
Evidence
what is attached, and what is validated
The assistant sits beside the work rather than in a tool of its own. It opens on the same organisation as the Dashboard, Policy Hub, Task Engine, Risk Manager and Audit Centre in the rail behind it, and reads what they hold.
A worked example
Which task should we tackle first?
Start here
Task 620, the consent choices your privacy controls depend on.
Why this one
- PriorityThe only High priority task in the privacy cluster.
- FrameworksSupports two controls that are still Not Implemented.
- ConflictMarked Not Applicable, while the controls it supports are not implemented.
- OwnershipNo owner, no due date, no evidence attached.
- RiskLinked to a High residual risk on integrity of records.
- AssetsTouches four high-criticality customer-facing systems.
First concrete action
Give the task an owner and a due date, decide whether Not Applicable still holds, then attach the evidence source it has been missing.
Illustrative. Netra AI can make mistakes, and every answer says so.
The same shape on the real screen. Each answer names the records it reasoned from, which is what makes it checkable and what keeps the decision with the person accountable for it.
What it helps with
Reading, ranking and drafting, against your own records.
- Ranks what to do first, with the reason beside each item
- Tells you what evidence a control is asking for
- Points out what a task is still missing: owner, date, evidence
- Flags where a status contradicts the work behind it
- Suggests which assets a task should be linked to
- Drafts SOPs and procedure text for your team to review
What it never does
The decisions, and the accountability, stay with your people.
- Completes a task or attaches evidence on your behalf
- Approves a policy, accepts a risk or signs off a vendor
- Moves a control to compliant, or changes any status
- Answers from another client’s workspace, or from the open internet
- Closes an audit finding or issues a report
It shows its working
Each answer names the tasks, controls, risks and assets behind it, so a reviewer can check it against the record.
It stays inside your workspace
On the Partner Portal the assistant is scoped to the client in front of you, never across clients.
It asks you to verify
Every answer carries a reminder to verify important information. A co-pilot, not an autopilot.
For partners
The same journey, for every client
MSSPs, vCISO practices and audit firms run each client organisation from the Partner Portal, with the client's data kept separate and the same method applied to all of them.
A library of 50+ frameworks
Including the RBI CTRRAF 2026 Directions, NISPG, CERT-IN, ISO 27001, SOC 2, GDPR, PCI DSS, HIPAA, DORA and NIS2.
See the platform before you decide
A 25-minute demo on the frameworks that matter to you.