See risk clearly, then treat it.

1. Add a risk: title, description, category, owner.
2. Rate likelihood (how probable) and impact on Confidentiality, Integrity and Availability.
3. CompliLens calculates the score and level (Low, Medium, High, Critical). You cannot fake this; it is calculated centrally.
4. Describe the treatment (accept, reduce, transfer or avoid) and re-rate the residual risk after protections.
5. Link the risk to controls, assets, vendors and incidents.
6. View the risk matrix (heat map) and a top risks list. Set a review date to be reminded.
7. Attach evidence, and see related findings (NCRs) on the risk.

Who uses itRisk managers, compliance managers.

1. Report an incident: what happened, when, severity, category and who reported it.
2. Record the investigation and root cause. Link the related risk, policy, vendors and assets.
3. Note the source: reported manually, from customer feedback, or detected by a connected system.
4. Regulatory reporting: if the incident must be reported to a regulator, tick the relevant regulation (for example CERT-In: 6 hours, GDPR: 72 hours). A live countdown appears. Click Mark as reported when done. Overdue deadlines trigger alerts.
5. Track corrective actions until the incident can be resolved.

Who uses itRisk managers, security teams.

1. From an incident, add a CAPA: title, type (corrective or preventive), owner and due date.
2. Fill in the 5 Whys: ask "why did this happen?" five times, one answer per layer, to reach the real cause. Attach photos or screenshots to any why.
3. Track status through to completed. Completion time is stamped automatically.
4. Later, record effectiveness: did the fix really work? Pick a verdict (effective / not effective / pending), who checked, when, and notes.
5. Download a PDF report.
6. The CAPAs tab on the Incidents page lists every CAPA across all incidents.

Who uses itRisk and compliance managers.

1. Add a vendor: name, category, contacts, risk level, status and contract start/end dates.
2. Mark whether the vendor processes personal data and the DPA status (signed, pending, not required). A helpful checklist shows what a good DPA should cover.
3. Link the vendor to risks, controls, assets, incidents and NCRs.
4. Attach evidence such as the signed contract or their certificate.
5. Contract renewal reminders arrive automatically.

Who uses itVendor managers, compliance managers.

1. Open a vendor and click New Evaluation.
2. Score each criterion from 0–10: by default six areas (such as security posture, compliance, data protection). You can add your own criteria (for example "Local data residency") or use the AI Vendor preset for AI suppliers.
3. CompliLens calculates the overall score and outcome: Approved, Conditional, Suspended or Rejected.
4. On a poor outcome it automatically: creates a linked risk, raises an NCR, and updates the vendor's status.
5. A next review date is set and you are reminded as it approaches. If it is overdue, an NCR is raised.

Who uses itVendor managers.

1. In a vendor's Documents tab, add required documents (NDA, DPA, insurance certificate, security certification, business registration, tax form, and others). Set an expiry date if one applies; leave it blank for documents valid for the whole contract.
2. Upload the actual file as evidence against each item.
3. Each row shows a live status: Missing (nothing uploaded), Expired (uploaded but past its date), or In place.
4. If a vendor has missing or expired documents, or is no longer active, CompliLens raises an NCR automatically (one at a time, no duplicates).
5. You also get reminders ahead of document expiry.

Who uses itVendor managers.

1. Add an asset: name, device type, category, owner, criticality, status, location, serial number and expiry/warranty dates.
2. Set data residency: stored in India, offshore, mixed, or not applicable.
3. Open the Configuration tab to record device-specific details (for example a cold-storage sensor's temperature range or calibration date). Admins design these fields in Settings → Asset Fields.
4. Link the asset to risks, controls, vendors, incidents and NCRs, and attach evidence.
5. Get reminders before assets expire.

Who uses itRisk managers, IT and security teams.

1. Add a device (or let Microsoft Intune sync them automatically).
2. Record encryption, screen lock, antivirus, operating system and last patch date.
3. CompliLens decides Compliant / Non-compliant / Pending review automatically; it cannot be hand-edited.
4. If a device is linked to an asset, its owner and device type are taken from that asset.
5. Devices can be placed inside a framework's scope.

Who uses itIT and security teams, risk managers.

1. Add an AI system: name, purpose, owner, type (for example chatbot, recommendation engine), vendor (if third-party), lifecycle stage and human oversight notes.
2. Assign a risk tier: Unacceptable, High, Limited or Minimal. "Unacceptable" is shown in red because such systems are prohibited under the EU AI Act.
3. Open the Impact Assessments tab and record a periodic review across five areas: bias & fairness, explainability, robustness & security, human oversight, environmental impact. Rate each Good, Needs improvement or Poor.
4. On a weak result, click Create Risk from this finding to add it to the Risk Register.
5. Set a next assessment date and get reminded.
6. Include AI systems in framework scopes and attach evidence.

Who uses itCompliance managers.

1. Assign role-based courses. New hires get their department's training automatically.
2. Run attack simulations across email, SMS, voice, QR codes and MFA prompts.
3. Every person, team and attack type gets a human risk score that moves as people train, report and click.
4. Link a high human-risk area to a risk in the register, with targeted training as its treatment.
5. Completions, quiz scores and acknowledgements are filed as audit evidence automatically.

Who uses itSecurity and compliance managers, HR.