CompaaS — Compliance as a Service
Compliance Automation, Built by the Team That Runs the Audits.
Executive Summary
- 01Compliance automation turns framework clauses into owned, tested controls that produce their own evidence.
- 02One mapped control library can answer ISO/IEC 27001, SOC 2, PCI DSS, HIPAA, GDPR and Ghanaian statutory questions at once.
- 03Continuous monitoring finds control drift before an assessor does, which makes audits a matter of export rather than reconstruction.
In Depth
How CompaaS — Compliance as a Service Works
Obligations Become Owned Controls
A framework is a list of obligations written for auditors. Operations teams need something different: controls with owners, tests and evidence. Compliance as a service starts by translating each requirement into a control statement that names who runs it, how often it operates and what artifact proves it. One control can then satisfy many frameworks at once. Access review, for example, answers questions in ISO/IEC 27001, SOC 2, PCI DSS and HIPAA. Mapping once and reusing the result removes duplicate work and keeps answers consistent when several assessors ask the same question.
Evidence Is Gathered as Work Happens
Audits that capture a single moment in time favor teams that cram beforehand, whereas continuous compliance favors teams that keep a steady routine. Evidence is pulled from the systems where work happens: identity providers, ticketing, cloud configuration, vulnerability scanners and training records. Each artifact is timestamped, tied to a control and kept with its source. When a control test fails, the failure becomes a tracked finding with an owner and a due date, not a surprise during fieldwork. Auditors can then sample from a complete record instead of requesting screenshots. The approach depends on evidence being attributable, tamper-evident and easy to retrieve by period.
Scoring Turns Gaps into Decisions
Assessment compares the control environment against each chosen framework and scores every control for design and operating effectiveness. Design asks whether the control, as written, would meet the requirement. Operation asks whether it ran as described across the audit period. Scores roll up by framework, business unit and country, so leaders see where exposure concentrates. Gaps are ranked with risk context, such as asset criticality and regulatory consequence, rather than by count alone. Executives can fund remediation in priority order, and boards receive a defensible account of residual risk consistent with ISO 31000.
Compliance is not a document produced for auditors. It is a record proving your controls worked, every single day.
Frameworks in Scope
- ISO/IEC 27001
- NIST CSF
- Act 1038
- SOC 2
- PCI DSS
- Act 843
- GDPR
- HIPAA
CompaaS is DAAKYI's compliance automation platform. It turns framework obligations into continuously evidenced controls.
Capabilities
Feature 1 of 6
Framework Mapping
Maps each framework requirement to a shared control, so one control can answer several obligations.
Use Cases
Where Organizations Put It to Work
01
Certification Readiness
Prepare for ISO/IEC 27001 certification with mapped controls, named owners and evidence collected before the auditor arrives.
02
Many Frameworks, One Control Library
Answer Act 1038, Act 843, PCI DSS and GDPR obligations from a single set of controls instead of parallel spreadsheets.
03
Board and Regulator Reporting
Give boards and regulators a current, evidence-backed view of control status, open gaps and remediation progress.
Product Journey
Discover, Engage, Onboard, Operate
- 1
Discover
Identify the frameworks, entities and countries in scope.
- 2
Engage
Map obligations to a shared control library and assign control owners.
- 3
Onboard
Connect evidence sources and run a baseline assessment and score.
- 4
Operate
Monitor controls continuously, fix drift and export audit-ready reports.
Methodology
The Method, Step by Step
- 1
Define Scope
Identify the legal entities, systems, data types and countries in scope. Decide which frameworks apply and why, separating mandatory obligations such as statute from voluntary standards such as ISO/IEC 27001 certification. A clear boundary prevents audit sprawl and keeps evidence focused on what assessors will examine.
- 2
Map Obligations
Break each framework into discrete requirements and link them to a unified control set. Record overlaps and differences, for instance where PCI DSS is more prescriptive than NIST CSF. Assign every control an accountable owner, a test method and a frequency so nothing depends on individual memory.
- 3
Assess and Score
Test design and operation of every control using interviews, configuration review and sampled records. Score results consistently and document the rationale. Rank gaps by risk, then build a remediation plan with owners, dates and acceptance criteria that an auditor can later verify.
- 4
Automate Evidence
Connect collection to source systems wherever possible, and define manual attestations only where automation is impractical. Set retention rules, naming conventions and review cycles. Alert owners when evidence goes stale or a test fails, so corrective action starts before an assessor finds the problem.
- 5
Review and Report
Hold regular control reviews, update mappings when frameworks or laws change, and report posture to management. Prepare audit packages by framework and period. Feed lessons from audits and incidents back into control design so the program improves instead of repeating findings.
Threat Scenarios
What It Looks Like in Practice
Audit Evidence Surge
How It Shows Up
An assessor sends a long evidence request and teams search mailboxes and shared drives for screenshots.
Response
Controls already hold current, indexed evidence, so the request is answered by export rather than reconstruction.
Breach Notification Clock
How It Shows Up
A personal-data incident is confirmed and legal asks which regulator, which law and which deadline apply.
Response
Obligation mapping links triggers such as the GDPR 72-hour notification expectation and incident reporting under Act 1038 to the incident procedure and its owners.
Silent Control Drift
How It Shows Up
A cloud setting or access rule changes after the last assessment, and the control no longer operates as documented.
Response
Monitoring detects the deviation, opens a finding and records the fix as new evidence.
New‑Market Expansion
How It Shows Up
A business enters another country and discovers local data and cyber rules its program never covered.
Response
Existing controls are mapped to the new obligations, exposing only genuine gaps, such as registration duties under Act 843.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Audit Evidence Surge | An assessor sends a long evidence request and teams search mailboxes and shared drives for screenshots. | Controls already hold current, indexed evidence, so the request is answered by export rather than reconstruction. |
| Breach Notification Clock | A personal-data incident is confirmed and legal asks which regulator, which law and which deadline apply. | Obligation mapping links triggers such as the GDPR 72-hour notification expectation and incident reporting under Act 1038 to the incident procedure and its owners. |
| Silent Control Drift | A cloud setting or access rule changes after the last assessment, and the control no longer operates as documented. | Monitoring detects the deviation, opens a finding and records the fix as new evidence. |
| New‑Market Expansion | A business enters another country and discovers local data and cyber rules its program never covered. | Existing controls are mapped to the new obligations, exposing only genuine gaps, such as registration duties under Act 843. |
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Unified Control Library | One control set mapped to every in-scope framework and law. |
| Gap Assessment Report | Scored findings ranked by risk, with remediation guidance. |
| Evidence Register | An indexed record of artifacts by control, owner and audit period. |
| Audit‑Ready Package | Framework-specific evidence bundles that answer assessor requests directly. |
| Management Dashboard | A concise view of posture, overdue findings and residual risk for executives and boards. |
| Role | Responsibility |
|---|---|
| Chief Information Security Officer (Client) | Owns the control environment and makes risk acceptance decisions. |
| Control Owner (Client) | Operates a control and supplies or approves its evidence. |
| Privacy or Legal Lead (Client) | Interprets obligations such as Act 843 registration and GDPR breach notification. |
| Compliance Analyst (Provider) | Maintains mappings, runs assessments and tracks remediation to closure. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Reactive
Compliance is a project before each audit. Evidence lives in email and spreadsheets, and the same findings return.
Stage 2
Defined
Controls are documented and mapped, owners are named, and assessments follow a schedule.
Stage 3
Managed
Evidence is collected routinely, scores are tracked over time, and remediation is measured against due dates.
Stage 4
Continuous
Monitoring detects drift quickly, mappings update as regulation changes, and compliance data informs risk decisions.
Frameworks and Regulation
The Standards That Shape This Work
ISO/IEC 27001:2022
Annex A contains 93 controls in four themes: organizational, people, physical and technological. ISO/IEC 27002:2022 guides implementation and supports a certification-ready control library.
NIST CSF 2.0
Its six functions, Govern, Identify, Protect, Detect, Respond and Recover, give an outcome-based structure for scoring posture and reporting to executives.
PCI DSS v4.0.1
Future-dated requirements became mandatory on 31 March 2025, so related evidence must now be current and repeatable.
Ghana Data Protection Act, 2012 (Act 843)
It requires data controllers to register and sets eight privacy principles, each of which can be expressed as testable controls.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for control mapping that is reusable across frameworks, not a separate checklist per standard.
- Look for evidence that is traceable to a source system, timestamped and exportable for assessors.
- Look for coverage of local law, including Act 1038 and Act 843, alongside international standards.
- Look for practitioners who have sat through audits and can explain how assessors sample.
Questions to ask a provider
- How do you keep mappings current when a framework or regulation changes?
- Can you show one control's evidence satisfying more than one standard?
- How are failed control tests escalated and tracked to closure?
- What happens to our evidence and control data if the engagement ends?
Technical Detail
For Architects and Engineers
Designing Automated Evidence Collection
Automated collection typically uses read-only API connectors to identity providers, cloud platforms, endpoint management and ticketing systems. Each pull records the source, query, timestamp and a cryptographic hash of the returned data, so an assessor can confirm the artifact has not changed since collection. Normalizing results into a common schema lets one test, such as every privileged account having multifactor authentication, run across several platforms. Least-privilege service accounts limit the risk of the collection layer itself. Retention should match the longest applicable audit period, and exports should preserve metadata. Manual attestations need named approvers, dates and expiry, because they are the weakest evidence type.
Building a Defensible Control Crosswalk
A crosswalk links requirements to controls in a many-to-many structure. Start with a canonical control statement, then attach each framework clause it satisfies and record coverage as full, partial or none. Partial coverage matters. A NIST CSF outcome may be met at a general level while PCI DSS demands specific parameters, such as defined review frequencies or scoped system components. Store those parameters on the control, not in narrative text, so tests can verify them. Version the crosswalk with effective dates, since ISO/IEC 27001:2022 and PCI DSS v4.0.1 changed requirements that older mappings miss. Legal duties such as incident reporting should link to procedures and named owners.
Glossary
Key Terms
- Crosswalk
- A many-to-many mapping between framework requirements and the controls that satisfy them.
- Operating Effectiveness
- A measure of whether a control actually ran as designed throughout the audit period.
- Control Drift
- The gradual divergence of a live system from the documented control state.
- Audit Period
- The span of time over which an assessor tests whether controls operated consistently.
FAQ
Questions About CompaaS — Compliance as a Service
DAAKYI Intelligence
Ask Kasara About CompaaS — Compliance as a Service
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step