Eight modules.
One structural truth.
VigiliaRes is built around a single object graph: controls, frameworks, risks, evidence, and the assessments that bind them. Every module you'll see below is a different lens on the same underlying structure.
Maturity wizard
Six-area, weighted, branching
Quantified scoring
Impact × likelihood × velocity
Cross-mapped library
17 frameworks, one map
Continuous capture
Time-stamped, attributed
Versioned authoring
Templates, redlines, sign-off
Third-party reviews
Tiered, on a cadence
Auditor workspace
Scoped, read-only, time-boxed
Board-grade exports
PDF, CSV, live links
Six control areas.
Four answer types.
One score.
Run an assessment the way it's actually conducted — area by area, question by question, with branch logic that hides irrelevant items and an evidence pane that travels with you.
- A·1Yes / No, Multiple Choice, Scaled, Free-text
Match the question type to the data you actually have. Scaled questions render as 1–5 maturity sliders.
- A·2Auto-save by control area
No "submit" cliff. Move freely between areas; everything persists on blur.
- A·3Approval workflow
Optional second-line review before the assessment is locked and contributes to the rolled-up score.
- A·4Industry overlays
Healthcare, financial services, public sector, SaaS — each ships with its own question set and weighting.
A risk register your CFO will read.
Quantitative scoring across impact, likelihood, and velocity. Treatment plans attached to owners with deadlines that actually trigger reminders. Roll up to a heatmap; filter to the line item; click to the source.
Map a control once.
Satisfy many frameworks.
The single most expensive thing in compliance is duplicate work. We model your controls as a graph and let you draw edges to as many framework clauses as apply. Answer the control once; it counts everywhere.
Encryption at rest is enabled for all production data stores using customer-managed keys.
Continuous, not last-minute.
Wire VigiliaRes to AWS, GCP, Azure, Okta, GitHub, and your existing ticketing system. Evidence flows in by itself. Every artifact is attributed, time-stamped, hashed, and linked to the control it satisfies.
Versioned authoring with redlines.
A library of starter policies, your own rich-text edits, redline diffs between versions, and approval flows that map to control owners. Sign-off is captured as evidence automatically.
Tiered reviews on a cadence.
Rank vendors by data sensitivity. Tier 1 vendors get an annual deep questionnaire; Tier 3 gets a lightweight attestation. Renewals trigger automatically.
An auditor workspace.
Scoped, read-only, time-boxed.
Spin up a virtual room with exactly the scope your auditor is engaged for. They ask questions in a queue; your team answers with evidence already attached. When the engagement ends, the room closes. Permanent record of every interaction.
Board-grade exports.
PDF for the board pack, CSV for the analyst, live link for the auditor. Every export is footnoted to the underlying evidence.