PGRC EnterpriseGRC & Assurance An LTPD Technology Product

Cybersecurity Governance, Risk & Assurance

One Governed View of Risk, Controls and Evidence.

PGRC Enterprise connects governance obligations, enterprise risks, controls, evidence and remediation, so leaders can oversee cyber risk with accountability and a traceable record.

Discuss an Engagement View Capabilities

Delivered through direct enterprise engagement. Capabilities are labelled by maturity; nothing here implies certification or guaranteed compliance.

Business Value

Oversight Built for Accountable Decisions

The platform is designed around the questions boards, risk owners and assurance teams ask.

01 · Visibility

See Risk in Business Context

Hold risks, assessments and their relationships in one governed register, so priorities are discussed against the same facts.

02 · Accountability

Clear Ownership and Approval

Role-based access, reviewer tasks and separation of duties keep those who propose a decision distinct from those who approve it.

03 · Assurance

A Traceable Record

Append-oriented audit events record what changed and who changed it, supporting evidence-led review rather than recollection.

Capabilities

What Exists Today, and What Does Not Yet

Every capability carries a maturity badge so that demonstrated work is never confused with future development.

Demonstrated

Built and verified in the released Foundation baseline (v0.1.0).

In Development

Built or being built in current development. Not part of a tagged release.

Planned

On the roadmap. Not built, with no committed date.

Demonstrated

Foundation Release v0.1.0

A governed risk journey, proven through interface, API, database, workflow and audit.

Risk Management

Demonstrated

Risk Register & Risk 360

A register of enterprise risks with a single-object view bringing together a risk, its assessments and its relationships.

  • Risk register
  • Object 360
  • Typed relationships
Details
What it does
Records risks and links them to other objects through typed relationships.
Boundary
Relationships currently target an organisation. A business-service object is deferred.

Risk Assessment

Demonstrated

Versioned Risk Assessment

Assessments are held separately from the risk and versioned, using a governed 5×5 methodology configuration.

  • 5×5 methodology
  • Versioned
Details
What it does
Preserves assessment history so earlier judgements remain reviewable.
Boundary
Quantitative risk modelling (such as FAIR) is out of scope for this baseline.

Governance Workflow

Demonstrated

Review & Approval

A governed review workflow with reviewer tasks surfaced in a personal work queue, enforcing maker-checker separation.

  • Reviewer tasks
  • My Work
  • Maker-checker
Details
What it does
Routes risk changes to a different person for approval.
Boundary
Development builds use clearly labelled development identities. Browser sign-in is deferred.

Assurance Record

Demonstrated

Audit Trail & Evidence Metadata

Append-oriented audit events are written transactionally, alongside an evidence-metadata foundation.

  • Audit events
  • Transactional outbox
  • Evidence metadata
Details
What it does
Keeps a durable record of governed actions for later review.
Boundary
Evidence storage is an adapter foundation. A full evidence lifecycle is planned, not delivered.

Platform Security

Demonstrated

Tenancy & Access Control

Tenant, organisation and business-unit structure with roles, scopes and default-deny authorisation.

  • Multi-tenant
  • Default-deny
  • OIDC token validation
Details
What it does
Resolves identity from a verified issuer and subject; token claims alone never grant authority.
Boundary
This describes engineering controls in the product, not a security certification.
In Development

Current Development (Sprint 002)

Enterprise risk management depth. Not yet part of a tagged release.

Remediation

In Development

Treatment & Remediation Plans

Plans with owned actions that move through submission, approval, progress and completion.

Details
Status
Exercised in local acceptance testing. Not yet released or generally available.

Independent Review

In Development

Designated Assessors

Named assessors for independent challenge of risk assessments, with their own task views.

Details
Status
Accepted in local development. Not yet released.

Information Boundaries

In Development

Disclosure Controls

Rules so that related records and audit history show only what the viewer is entitled to see.

Details
Status
Under security assessment and implementation. Not yet released.
Planned

Future Development

Not built. No delivery dates are committed.

Control Assurance

Planned

Controls & Assurance Lifecycle

Control libraries, testing, assurance activity and linked evidence across their full lifecycle.

Compliance

Planned

Compliance & Obligations

Mapping governance obligations to controls and tracking progress against them.

Reporting

Planned

Reporting & Dashboards

Management and board reporting built on governed data. No report builder exists today.

Wider GRC

Planned

Audit, Third-Party & Resilience

Audit management, third-party risk, operational resilience and technology risk modules.

Identity

Planned

Browser Sign-In

Interactive single sign-on in the browser. Development currently uses labelled development identities.

Assistance

Planned

AI-Assisted Analysis

An assistant to support risk and assurance work. No production assistant exists today.

Governance Workflow

From Identified Risk to Evidenced Assurance

The intended journey. Each step shows how far the product has progressed.

  1. IdentifyRecord the risk and its relationships.
    Demonstrated
  2. AssessScore with a versioned 5×5 assessment.
    Demonstrated
  3. ReviewApprove through a separate reviewer or assessor.
    Demonstrated
  4. TreatAgree and track remediation actions.
    In Development
  5. AssureTest controls and link evidence.
    Planned

Illustrative of product design. It is not a recording of any customer deployment.

Framework Alignment

Aligned to Your Obligations, Not Claimed for You

Frameworks are a planning input for each engagement.

Approach

Planned

Framework Mapping

The intended direction is to relate risks and controls to the recognised security and risk frameworks relevant to an organisation. Framework coverage is agreed per engagement and is not yet a delivered feature.

Assurance Position

Important

No Certification or Compliance Guarantee

PGRC Enterprise supports an organisation's own governance and assurance work. Using it does not certify an organisation, confer regulatory approval or guarantee compliance with any standard or law.

Enterprise Engagement

Discuss Your Governance Needs

PGRC Enterprise is delivered through direct engagement, not self-service. Tell us about your risk and assurance priorities and we will respond.

Start an Enquiry pc@purenaijaent.co.uk

Choose an Enquiry Topic