Vailor: the sovereign AI-native GRC alternative to Cisopolis

The documents matter less than the links between them. What belongs in one place is the risk register, open actions with an owner and a deadline, controls with the evidence that backs them, accepted exceptions and the date each falls due for review, and the frameworks in force. One question tells you whether the tooling works: can you say in a single move where a risk stands and who signed it off? Vailor holds that thread in a single repository and keeps it attached when the scope shifts.

Comparability comes first, budget second. Two risks can only be weighed against each other once they sit on the same scale: one scoring method, one definition of severity, one shared assumption on likelihood. From there the real variables are the cost of treatment, the time to implement it, and the residual risk you agree to live with. ISO/IEC 27001 asks for that residual risk to be approved by the risk owner rather than simply noted. In Vailor, each measure carries its effort in person-days, its cost and its priority (P1 to P4), stored beside the decision so the reasoning survives the meeting.

Rarely technical indicators. A committee wants to know where the organisation is exposed, what has moved since it last met, and what it is being asked to decide now: a budget, the acceptance of a risk, the reordering of a plan. The NIS2 directive raises the stakes, providing that the management body approves the cybersecurity risk-management measures and oversees their implementation. That turns the slot from a briefing into a decision point. Vailor assembles the material from data already captured, with a decision-maker summary and an executive view you can export to PowerPoint.

Preparation time goes on collection, on reconciling versions and on formatting, almost never on analysis. The rule worth applying is that reporting should be a view of the repository rather than a parallel document kept up by hand. Inside Vailor, action plan progress and the status of risks are read from dashboards, with proposed or custom indicators, and the executive view exports to PowerPoint. The commentary is the part still left to write, which is as it should be.

Keep the context, not only the conclusion: what was known at the time, the option taken, the option refused, the person who made the call and the date the decision is revisited. Miss that and a perfectly reasonable choice looks arbitrary at the management review ISO/IEC 27001 requires at planned intervals, or in front of an auditor. Vailor traces those inputs in an audit log with no delete function, and when the AI relies on your documents, the quoted passage stays tied to its proposal, so accountability rests with a named person.

Begin with an inventory rather than a bulk export: which risks are still live, which actions are still open, which evidence still holds, which frameworks are genuinely in force. Lifting everything across untouched is seldom the right target, because a share of the history has no operational value left. The workable route is to rebuild from the risk register and the open actions, then reattach evidence as each review comes round. Vailor runs as SaaS or inside your infrastructure, and our teams walk through that handover with you.