Case study
Engineering a Cybersecurity Compliance Self-Assessment Platform
A platform designed to help organizations turn cybersecurity compliance requirements into structured, self-assessable, and auditable workflows.
Context
The platform operates in a regulated compliance environment, where organizations need a structured way to assess their own cybersecurity posture against defined requirements and track how implementation of those requirements is progressing.
Problem
Compliance requirements are often difficult to turn into day-to-day, trackable work: responsibilities are unclear, supporting evidence is scattered, and status reporting for review and audit activities is hard to keep current.
My role
As a Full Stack Developer, I contribute to the design and development of a platform that helps organizations conduct cybersecurity compliance self-assessments and manage implementation progress. This description reflects one contribution within a larger team effort; it does not imply sole ownership of the platform.
Engineering considerations
- Turning cybersecurity compliance requirements into structured, repeatable self-assessment workflows.
- Tracking the implementation status of individual controls over time.
- Organizing supporting evidence in a way that stays usable during review and audit activities.
- Improving reporting visibility so progress is easy to see at a glance.
AI-assisted assessment
More recently, I have worked on an AI-assisted capability that helps organizations draft compliance justifications. The approach is retrieval-augmented generation (RAG) over each organization’s own context — uploaded documents, including scanned files processed with OCR, alongside data entered directly into the platform — indexed per tenant so that no organization’s data ever informs another’s assessment. For a selected clause from any supported framework, relevant material is retrieved and re-ranked, and the result is a structured assessment rather than free-form prose.
- Structured output for every assessment: a seven-level maturity status, a written justification, citations to the source material, and an actionable recommendation.
- A “Not Applicable” status can only be set by a human — the AI is deliberately prevented from concluding it, keeping scoping decisions under human ownership.
- Model output is strictly validated; an invalid response fails loudly instead of degrading silently into an answer no one can verify.
- Justifications never expose file names — source citations are recorded separately — and an evaluation harness measures retrieval and answer quality over time.
Governance considerations
- Assigning clear responsibility for individual controls and their implementation status.
- Helping teams prepare for review and audit activities with an organized, auditable trail.
- Keeping humans in charge of AI-generated assessments — people own the exceptions and the final judgment on every result.
Constraints & trade-offs
A recurring engineering trade-off was balancing usability against data integrity, access control, and traceability — the platform needed to stay approachable for day-to-day self-assessment while still meeting the rigor expected of a compliance and audit context.
Outcome
Compliance requirements were turned into usable, traceable workflows — supporting self-assessment, clearer implementation tracking, and better-prepared review and audit activities.
Specific operational metrics and internal implementation details are omitted to protect confidential information. Customer names, private control mappings, system architecture, vulnerabilities, security configurations, proprietary workflows, internal screenshots, and source code are not disclosed.