# COMPLYAN - Cybersecurity Compliance Automation Platform
Conquer Compliance, Deliver Assurance and Streamline Security
## What is Complyan?
Complyan is a comprehensive, all-in-one SaaS Governance, Risk & Compliance (GRC) platform focused on cybersecurity and data protection. It offers modules for:
* Cybersecurity Compliance (e.g ISO 27001, NIST CSF, PCI-DSS, GDPR)
* Third-party/vendor risk management
* Internal and external audit process
* Data privacy, flow-mapping and repoting
Its goal is to centralize compliance workflows, automate evidence collection, map controls across frameworks and offer real-time dashboards.
## **Mission**
At Complyan, our mission is to empower organizations to effectively manage their cybersecurity and data privacy risks, ensuring compliance with relevant regulations and standards. We strive to provide a comprehensive and intuitive platform that helps organizations to efficiently and effectively assess, mitigate, and report on their compliance activities.
## **Vision**
Our vision is to be the leading provider of cybersecurity governance, risk management, and data privacy solutions, enabling organizations around the world to confidently navigate the complex landscape of regulatory requirements and best practices. We aim to help organizations of all sizes to protect their sensitive data and ensure the privacy of their customers or users, ultimately building trust and enabling them to succeed in the digital age.
## Key Features
* **Framework Marketplace & Cross-Mapping**: Supports 30+ standards (global, regional, sector-specific). Encourages re-use through linked control libraries.
* **Automated Evidence & Continuous Monitoring**: Integrates with Azure, AWS, Office 365, Okta, Nessus, Qualys, etc. for automatic evidence collection and ongoing compliance checks
* **Risk and Audit Management**: Tools for compliance risk assessments, internal/external audits, real‑time gap analysis, dashboards, and templated reports
* **Third-Party & Vendor Risk Module**: Enables vendor self‑assessments, questionnaires, risk scoring, and continuous tracking
* **Data privacy & Governance Support**: Covers data mapping, privacy impact assessments, and compliance with GDPR and similar regulations
* **Compliance Wizard**:
* Simplifies the compliance process by guiding users through control setup and implementation.
* Allows users to **add control custodians**, maturity levels, and implementation details.
* Automates compliance workflows, saving time and effort for compliance teams.
## Who Should Use This Manual
This manual is designed for:
* **Compliance Officers & CISOs** – Managing cybersecurity and data‑privacy standards.
* **IT Risk & Security Teams** – Performing risk assessments and monitoring controls.
* **Audit & Legal Professionals** – Planning internal/external audits and compiling documentation.
* **Vendor/Procurement Managers** – Overseeing third‑party risk and vendor compliance.
* **Executives and Board Members** – Tracking compliance progress via dashboards and reports
# Getting Started
To use Complyan effectively, ensure your environment meets the following requirements:
***
### **Supported Browsers**
* Google Chrome (latest version)
* Microsoft Edge (latest version)
* Safari 15 and above (macOS)
### **Network**
* Stable internet connection (minimum 10 Mbps recommended)
* Firewall access allowing HTTPS traffic to complyan.com and associated subdomains
# How to Sign Up/Sign In
## Signing Up
***
Navigate to https//app.complyan.com. A business domain (not Gmail, Yahoo! etc.,) is required to sign up.
Select **Sign Up & Organization**
***
Note: Read through **Privacy Policy** and **Terms & Conditions** before accepting and proceeding.
***
## Signing In
Return to [www.complyan.com](http://www.complyan.com) and **Sign In** with the registered credentials from the **Sign Up** process.
# Navigating the Dashboard
Once logged in, the main Complyan Dashboard will be in view.
***
Toggle between frameworks by clicking the highlighted box. This dashboard gives an overview of all modules and the progress levels across them.
***
Use **Manage Charts Visibility** to customize the look and feel of your dashboard
***
The dashboard may also be exported by clicking the highlighted icon at the top right corner.
***
# AI Usage Disclaimer
#### **1. General Information**
ComplyBot is an Artificial Intelligence (AI)-powered assistant designed to support users with information related to governance, risk management, compliance, and associated domains.
The system generates responses based on patterns in data and does not possess human judgment or independent reasoning.
***
#### **2. No Professional Advice**
Responses provided by ComplyBot are for **informational and assistive purposes only** and do not constitute:
* Legal advice
* Regulatory advice
* Audit opinions
* Professional consulting services
Users must **exercise independent judgment** and consult qualified professionals before making decisions based on system outputs.
***
#### **3. Accuracy and Limitations**
While reasonable efforts are made to ensure the reliability of outputs:
* Responses may be **incomplete, outdated, or inaccurate**
* The system may generate **plausible but incorrect information (hallucinations)**
* Contextual misunderstandings may occur
Users are responsible for **validating outputs** before use in decision-making or operational processes.
***
#### **4. Human Oversight Requirement**
ComplyBot is not a substitute for human expertise.
All outputs should be:
* Reviewed by appropriate personnel
* Verified against authoritative sources
* Subject to organizational approval processes where required
***
#### **5. Data Usage and Privacy**
Users must not input:
* Personal data unless explicitly authorized
* Sensitive or confidential information without proper classification and controls
* Regulated data unless permitted by organizational policy
Any data entered into ComplyBot may be processed in accordance with applicable data protection laws and organizational policies.
***
#### **6. Security and Acceptable Use**
Users shall not:
* Use ComplyBot for malicious, unlawful, or unauthorized purposes
* Attempt to manipulate, exploit, or bypass system safeguards
* Input harmful code, prompts, or instructions intended to degrade system integrity
All usage is subject to monitoring and may be logged for security and compliance purposes.
***
#### **7. Bias and Fairness Notice**
AI-generated outputs may reflect:
* Biases present in training data
* Limitations in model design
The organization implements controls to monitor and mitigate bias; however, users should remain aware of potential limitations and report any suspected bias.
***
#### **8. Availability and Performance**
The system is provided on an “as available” basis.
The organization does not guarantee:
* Continuous availability
* Error-free operation
* Performance consistency under all conditions
***
#### **9. Liability Limitation**
The organization shall not be liable for:
* Decisions made based on AI-generated outputs
* Any direct or indirect losses arising from system use
* Misinterpretation or misuse of responses
Use of ComplyBot is at the user’s own risk.
***
#### **10. Continuous Improvement**
ComplyBot is subject to ongoing monitoring and improvement.
Outputs and system behavior may change over time as part of:
* Model updates
* Risk mitigation efforts
* Performance enhancements
***
#### **11. User Acknowledgment**
By using Complyan users acknowledge that they:
* Understand the capabilities and limitations of its AI system
* Accept responsibility for validating outputs
* Agree to comply with applicable policies and guidelines
***
> *ComplyBot is an AI-powered assistant providing informational support only. Outputs may be inaccurate or incomplete and must be independently verified. Do not input sensitive or personal data unless authorized. Use is subject to monitoring and applicable policies.*
***
#### **12. Reporting AI Issues and Adverse Impacts**
The organization is committed to the responsible and safe use of Artificial Intelligence systems. Users and other interested parties are encouraged to report any concerns, issues, or adverse impacts arising from the use of ComplyBot.
Examples of reportable issues include, but are not limited to:
* Inaccurate, misleading, or harmful outputs
* Suspected bias or unfair treatment
* Security vulnerabilities or data exposure risks
* Inappropriate or unsafe system behavior
* Any unintended consequences impacting users or stakeholders
#### **How to Report**
Reports can be submitted through the following channels:
* **Email:** `security@complyan.com`
When submitting a report, please include (where possible):
* Description of the issue
* Date and time of occurrence
* Relevant input and system response
* Any supporting evidence (e.g., screenshots)
#### **Handling of Reports**
All reported issues will be:
* Logged and assessed in accordance with internal procedures
* Reviewed by appropriate personnel
* Investigated and addressed based on severity and impact
The organization will take appropriate corrective actions where necessary and may use reported information to improve system performance, safety, and governance.
# Marketplace
All standards and regulatory compliance frameworks available on Complyan are visible here.
Use the **Search** functions to look up global, international and local frameworks.
***
To subscribe:
* Find a framework of choice either by browsing or searching for it
* Select View Details on chosen framework
* Click Subscribe
# My Frameworks
This is the library for all frameworks you have successfully subscribed to.
# Implementing Controls
To view all controls and sub-controls under a framework and proceed to implementation:
* Select **Preview Controls** to see all controls specific to a domain.
* Or use **View Controls** to see controls across all domain and select **Report** to export a consolidated document of control information.
* Move the slider to reveal action buttons at the end of each control.
* Select **Edit** to begin.
* Determine whether the control is relevant to your organization and select **Applicable** or **Not Applicable** and proceed.
* Select custodians for the control under **Business Owner** and **Technical Owner**. Click on the highlighted button to create new business units.
* Toggle the RUN switch on top of the control implementation pane to use Complyan's AI feature in filling out details.\
\
* Click to select **Implementation Status.**
* Attach evidence of implementation by uploading or selecting from files you have previously uploaded.
* Enter a list of documents relevant to the implementation of the control. Extend the size of the text box by using the arrow at the highlighted edge.
* Enter details of implementation of this control in your organization.
* Select **Compliance Level.**
* Optionally, you can assign the control to a policy by selecting **Assign To A Policy**.
* If any selection is made other than **Fully Implemented**, you will be required to enter a plan to meet full implementation.
* Finally, select maturity at **Governance** & **Technical** levels and select **Submit**.
* Use the highlighted action button to preview all details you have entered.
* You can also leave comments in this section.
* Select the highlighted icon to link control to an existing risk
# Unified Complyan Controls
# Overview of the UCC Dashboard
# How To Edit Base Framework Settings
# Generating A Base Framework Report
# Policy Management
# Accessing All Policies
This interface displays all policies which have been created and used across frameworks.
# Creating A New Policy
To create a new policy, click on **Create New Policy**. Input the name of the policy and add a short description with details such as version number (v1.0, v2.0 etc.). Optionally, the policy can be attached to a control by selecting **Attach Framework.**
After this, a new policy will be created as a placeholder. To finish, click on **Start.**
Select between creating one using Complyan's templates or uploading an already existing file. Note, different types of documents; policies, procedures, processes, guidelines etc., can be uploaded in this module.
Follow steps after selecting your preferred method to complete the creation of a new document.
To view inbuilt policies and documents on Complyan or only see documents created by you, toggle the highlighted button.
# Policy Knowledge Base
This displays not just policies but procedures, standards, plans, checklists etc regardless of what frameworks or controls they are attached to.
# Creating Policy Templates
# Managing Policy Templates
# Asset Management
This asset management interface offers a consolidated view of assets and sub-assets showcasing important metrics such as total assets, sub-assets, and critical assets.
# Assets
The "Assets Class" section provides detailed information on each asset, including ID, name, risk values, descriptions, and associated entities. Users can easily search, add new assets, or upload assets in bulk, making the management process more efficient.
CIA values can be assigned to assets to determine their criticality or importance.
Assets can be imported in bulk.
# Sub-assets
This environment manages sub-assets assigned to each parent asset. Similar to Assets, sub-assets can be added individually or in bulk following the Complyan template.
# Entities Compliance
# Understanding Entities Compliance
# Applicability and Usage
# Entities Submission
# Risk Management
**Complyan** simplifies the process of risk management by providing a centralized platform to track, assess, and manage third-party risks. The risk dashboard gives an overview of the organization's risk management status, including important data and visual breakdowns. It displays the overall number of hazards found, the status of ongoing response activities, the current degree of residual risk, and the progress of risk assessments at the top.
# Risk Register
The Risk Register serves as a centralized repository to record all identified risks. It includes detailed information about risk treatment options and plans, risk matrix, level of residual risk etc. This feature allows users to systematically track and manage risks across the organization as well as track and schedule periodic assessments for the organization.
In this module, new risk can be created singly or in bulk when you click the **Actions** button.
Risks can be added to the register by one of the two ways shown below. Select any option and follow the steps as required.
Under the Configurations tab, risk assessments can be toggled on or off. Treatment of identified risks can also be configured based on specific controls.
# Mitigation Planning
The Risk Mitigation interface is designed to help users track and manage mitigation plans and their corresponding approvals for risks within the organization. The dashboard offers a real-time overview of the current state of mitigation efforts, categorized into the following areas:
1. Closed: Displays the total number of mitigation plans that have been successfully completed and closed.
2. Mitigation Rejected: Shows the number of mitigation plans that were reviewed and rejected.
3. Mitigation In Progress: Displays the count of mitigation plans currently being worked on.
4. Approval Pending: Lists the number of mitigation plans that are awaiting management approval.
# Risk Matrix
The Risk Matrix interface allows users to visualize and assess risks based on their likelihood and impact. It is used to log and determine the severity of various risks and helps prioritize risk mitigation strategies. The key components of this section are:
**Select Matrix Type:**
* This feature allows users to select the size of the matrix grid based on the complexity of their risk analysis. The available options are:
* 3x3 (default)
* 4x4
* 5x5
* Users can select the matrix type from the dropdown menu and click the Update button to apply the selected configuration. The matrix will adjust accordingly to reflect the chosen grid size.
**Risk Matrix Display:**
* The matrix is displayed as a color-coded grid that categorizes risks based on their Impact (y-axis) and Likelihood (x-axis):
* Impact ranges from Low to High, while
* Likelihood ranges from Rare to Likely.
* Each cell within the matrix represents a combination of impact and likelihood, color-coded to reflect the risk level:
* Green: Low risk
* Orange/Yellow: Medium risk
* Red: High risk
**Risk Categories:**
* Users can manually adjust the risk levels (e.g., Low, Medium, High) for each combination of impact and likelihood by using the dropdowns in each matrix cell. This enables customization based on the organization’s risk tolerance and specific scenarios.
# Risk & Threat Catalog
This section provides a structured interface where users can view, categorize, and manage organizational risks and threats. The catalog is split into two tabs: Risk and Threat, allowing users to toggle between risk and threat management. The default display shows a list of the organization’s risk with the following features:
1. Risk ID: A unique identifier for each risk in the system.
2. Risk Event: The specific event or condition that may present a risk to the organization (e.g., Incident Response, Business Continuity).
3. Description: A brief explanation of the risk event and its implications.
4. Function: This section indicates the functional area of the organization responsible for managing or mitigating the risk.
5. Actions: Provides action buttons for managing each risk entry. Actions may include options to expand or collapse details, edit, or delete the risk.
**New Risk(s) can be created here.**
* Users can click the New Risk button located on the top-right corner of the catalog. This will open a form to create a new risk entry.
Create Risk Form:
* The Create Risk form allows users to input essential details about the risk, which include:
* Risk Grouping: A dropdown menu to select the category or group the risk belongs to.
* Risk Name: The name of the specific risk event.
* Risk Event: Further details of the risk event being added.
* Description: A detailed description of the risk, outlining its potential impact and relevance.
* Function: Select the department or function within the organization that is responsible for managing this risk.
Create Button:
* After filling in the required fields, users can click the Create button to new risks to the catalog. The risk will then appear in the list, ready for monitoring and management.
# Data Processing Register
# Assets
# Creating New Assets and Sub Assets
# Managing Assets and Sub-Assets
# Data Processing Activities
# Reports and Dashboard
# Assignments
# Data Protection Impact Assessment
# Exploring The DPIA Dashboard
# Process and Implementation
# DPIA Reports
# Managing DPIA Assignments
# Third-party Risk Management
Third-party risk management (TPRM) is essential for managing risks from external partners. **Complyan** simplifies this by providing a centralized platform to track, assess, and manage third-party risks.
# Suppliers
Suppliers form a critical component of the organization’s Governance, Risk, and Compliance (GRC) framework, as they directly influence the integrity, security, and resilience of business operations. By engaging with suppliers, an organization extends its ecosystem, which means supplier practices in areas such as cybersecurity, data protection, ethics, and regulatory adherence must align with the organization’s own policies and compliance obligations. Risks introduced through suppliers, whether cyber incidents, operational failures, or legal non-compliance, can significantly impact organizational performance and reputation. To manage this, the organization must implement structured supplier governance processes that include due diligence, risk assessments, continuous monitoring, and clear contractual obligations to ensure accountability. Complyan supports this by providing an integrated Third-Party Risk Management (TPRM) module that automates supplier onboarding and monitoring of their compliance with your organization.
In this section, suppliers can be added by using the available options. This dashboard can also be exported.
Using the **Invite Supplier** option, you may select the **Send Onboarding Questionnaire** to the invitees at the same time.
The **Search** options can be used to filter and categorize suppliers.
# Supplier Assessment
This section allows the sending of questionnaires if they were not sent during the invitation process.
Follow the steps until a questionnaire suitable for the **Vendor** or **Entity** has been created.
# Questionnaire Templates
In this tab, templates are configured and narrowed down to specific areas of security and to fit into different supplier/vendor type.
# Documents
This Document Inventory page serves a repository for all documents attached as evidence during framework implementation.
# User Management
The Users Management section provides administrative control over the organization's user accounts and roles.
# Users
Within this section, the **Member Users** tab allows administrators to add new users, view, manage, and edit individual user profiles.
The **Guest Users** tab can be used to temporarily grant access to third-parties on the platfrom.
# Roles
The Roles tab offers a way to define and manage role-based permissions for groups of users, ensuring that each user has appropriate access based on their job responsibilities.
New roles can be created with permissions assigned to each role and subsequently assigned to users upon their creation.
# Integrations
This module provides synchronization between Complyan and enterprise tools and services.
Available services are visible in this view.
Use **Details** to understand each service and proceed to **Connect.** For instance, to integrate Amazon Web Services (AWS):
This will reveal lists of supported tests and control for AWS integration.
Select **Connect**.
Follow the prompts as described until succesful.
# Manage
This module is used to manage various aspects of your integration from the Integration section.
# People
This section contains management options for users in your Active Directory. It also provides the capability to create users manually even if the AD is not connected.
Use **Notify** to send an email notification to users to follow Checklist items (see next page).
# Groups
This section is used to group **People** based on their organizational roles. This helps to facilitate training, checklist and management efforts.
# Checklist
This section lets an administrator build a tailored compliance checklist that ensures that the **People** of the organization go through the necessary policy sign-offs, training, and contract agreements before being considered compliant.
# Trainings
In this section, training programs can be created to ensure awareness, enlightenment and compliance among the **People,**
# Administrative Settings
# Configurations, Preferences and Customizations
# Account Security Settings
# Adding Compliance Farmeworks
# Managing Entities and Custom Fields
# Cross Mapping
# Audit Logs
# Accessing and Understanding Logs
# Meetings and Follow-ups
This environment is used for collaboration and synchronization across teams. It is also used to log personal tasks.
1. Select “Create Event” to either schedule a call or log a personal task.
# Appendix
# Glossary of Terms
# Frequently Asked Questions (FAQs)
# Additional Resources
.png?alt=media&token=4d422d8e-e57a-45be-9e22-2e40709baeb1)
