PThe platform behind DarkProtect
CSFaaS

Assess · Monitor · Protect

Compliance that runs continuously

Risk, controls, evidence and reporting in one system — the product we built, and the engine we run every engagement on. What follows is the real thing, screen by screen.

01The problem

Compliance is treated like a deadline, not a system

Most teams sprint to pass an audit, then let everything drift until next year. CSFaaS closes that gap.

  • Audit prep eats weeks of engineering and security time, every year.
  • Evidence lives in scattered spreadsheets, screenshots and Slack threads.
  • You answer the same security questionnaire from scratch, again and again.
  • Nobody actually knows the live compliance posture between audits.

Frameworks we implement & automate

01ISO 27001
02SOC 2
03NIST CSF
04NIST 800-53
05GDPR
06DORA
07NIS2
08PCI DSS
09HIPAA
10CIS Controls
02The platform, screen by screen

One system, from risk to proof

Everything the program needs in one place. Here is what it actually looks like in the product.

01Frameworks

Map once. Prove everywhere.

Start from 40+ prebuilt frameworks — ISO 27001, SOC 2, NIST CSF 2.0, GDPR — or build your own. Define one set of controls and map it across every standard at once, with versioning and approvals handled for you.

  • 40+ prebuilt frameworks
  • One control set, many standards
  • Versioning, approvals & audit trail
app.csfaas.com/dashboard/frameworks
AAcme Corp

Frameworks

8 active · 40+ available to import

Import
ISO/IEC 27001:2022v2.1
114 controls
Active
SOC 2 Type IIv1.4
64 criteria
Active
NIST CSF 2.0v2.0
106 subcat.
Active
GDPRv1.0
99 articles
Draft
ISO 42001 (AI)v0.9
38 controls
Draft
02Policies & controls

Controls, mapped and measured.

Define a control once and map it to policies and frameworks at the same time. Track implementation as a maturity level — from Initial to Optimized — with completion rolled up everywhere the control is referenced.

  • One control, many mappings
  • Maturity: Initial → Optimized
  • Completion rolled up automatically
app.csfaas.com/dashboard/controls
AAcme Corp
ControlsPoliciesFrameworks
142 controls
CodeControlMaturity
A.5.1

Policies for information security

ISO 27001
Optimized
A.8.24

Use of cryptography

ISO 27001
Managed
CC6.1

Logical access controls

SOC 2
Defined
PR.AC-01

Identities & credentials managed

NIST CSF
Developing
A.5.7

Threat intelligence

ISO 27001
Initial
03Risk demands

Every assessment starts here.

A risk demand captures the request — business context, systems, data classification — then moves through a defined workflow from initiation to risk response and assurance, with owners, priority and due dates throughout.

  • Structured intake
  • Initiation → response → assurance
  • Owners, priority & due dates
app.csfaas.com/dashboard/risk/demands
AAcme Corp

Risk demands

12 open · intake → analysis · SLA tracked

New demand
RD-018New CRM vendor onboarding5d
RD-017Cloud migration — EU dataSLA breach
RD-015AI feature data processing20d
RD-014Payroll system change1d
RD-011Office 365 tenant reviewSLA met
RD-009Endpoint MDM rollout9d
RD-018New CRM vendor onboarding5d
RD-017Cloud migration — EU dataSLA breach
RD-015AI feature data processing20d
RD-014Payroll system change1d
RD-011Office 365 tenant reviewSLA met
RD-009Endpoint MDM rollout9d
04Risk registry

Risk, scored and seen.

Identify, assess and treat risk with a structured method drawn from NIST, ISO and SABSA — threat- and asset-oriented, plotted on a live likelihood-by-impact matrix, from inherent through current to target.

  • Likelihood × impact matrix
  • Inherent → current → target
  • Owners, status & response
app.csfaas.com/dashboard/risk/registry
AAcme Corp
QualitativeQuantitative
36 risks
RiskTitleLvl
RISK-042Unencrypted backups at rest8.5
RISK-039Over-privileged service accounts7.2
RISK-051Vendor without SOC 2 report6.8
RISK-028No MFA on legacy VPN9.1

Likelihood × impact

Likelihood →Impact ↑
05Quantitative risk

Put a number on it.

When qualitative scoring is not enough, model risk in money — probability, single- and annual-loss expectancy, and a loss-exceedance curve — so treatment decisions rest on cost-benefit, not on gut feel.

  • Probability × SLE → ALE
  • Inherent vs residual exposure
  • Cost-benefit on every treatment
app.csfaas.com/dashboard/risk/registry
AAcme Corp
QualitativeQuantitative
ALE · cost-benefit
RiskScenarioALEResidual
RISK-028No MFA on legacy VPN$504k$88k
RISK-042Unencrypted backups$248k$61k
RISK-051Vendor without SOC 2$180k$94k
RISK-067Public S3 misconfig$156k$40k

Annualised loss exposure

Inherent

$1.21M

Residual

$312k

74% exposure reduction · treatment $190k

Loss exceedance

06Remediation

Findings become work.

Every gap becomes a tracked plan with an owner, a due date and a path to closure — linked back to the risk it answers, with a complete activity trail behind it.

  • Owners & due dates
  • Linked to the originating risk
  • Progress through to closure
app.csfaas.com/dashboard/risk/remediation
AAcme Corp

Remediation plans

19 plans · 4 owners

In progress2
RP-014

RISK-042

65%
RP-021

RISK-028

40%
On track1
RP-009

RISK-039

80%
At risk1
RP-017

RISK-051

25%
Completed1
RP-003

RISK-011

100%
07Systems catalog

Know what you're protecting.

A living inventory of the systems that matter, classified by sensitivity and tied to the risks, controls and evidence that cover them — so scope is never a guess.

  • Data classification
  • Linked risk assessments
  • Owners & review cycles
app.csfaas.com/dashboard/systems
AAcme Corp

Systems catalog

23 systems · classified

IDSystemReviews
SYS-001Production Postgres2 active
SYS-004Customer web app3 active
SYS-009Internal wiki1 active
SYS-012Backup vault2 active
SYS-018Marketing site1 active
08Third parties

The supply chain, watched.

Tier every vendor by criticality, assess residual risk and keep reviews on a cycle — so the partners you depend on never quietly drift out of view.

  • Tiered by criticality
  • Residual risk scored
  • Reviews kept on schedule
app.csfaas.com/dashboard/third-parties
AAcme Corp

Third parties

17 vendors · tiered · SLA tracked

IDVendorReviewed
TP-001
StripeTier 1
Payments
14d
TP-004
AWSTier 1
Infrastructure
30d
TP-008
HubSpotTier 2
Marketing
60d
TP-013
NotionTier 3
Productivity
90d
TP-019
Acme PayrollTier 2
HR
overdue
09Reviews & periodicity

Nothing drifts out of date.

Controls, systems, vendors and risks each carry a review cadence and an owner. The platform surfaces what is overdue, due this month, unscheduled or unowned — long before it becomes a finding.

  • A cadence for every item
  • Ownership coverage at a glance
  • Overdue surfaced early
app.csfaas.com/dashboard/reviews
AAcme Corp

Reviews & periodicity

Review & ownership coverage

live
3
Overdue
12
This month
5
No schedule
8
No owner
ItemNextStatus

A.8.24 · Cryptography

Control
5dDue

SYS-001 · Production Postgres

System
overdueOverdue

TP-001 · Stripe

Third party
22dScheduled

RISK-042 · Backups

Risk
3dDue

RD-014 · Payroll change

Demand
8dScheduled
10Audit manager

Audits that close themselves out.

Plan, run and track audits in one place — findings, responses and closure evidence — with progress visible at a glance and nothing slipping between cycles.

  • Findings → responses → closure
  • Internal & external audits
  • Progress tracked to 100%
app.csfaas.com/dashboard/audit
AAcme Corp

Audit manager

3 plans · findings & responses

active

ISO 27001 surveillance 2026

14 findings · 9 closed · lead A. Kerr

In progress
64%

SOC 2 Type II readiness

scope being defined · lead M. Diaz

Planning
8%

GDPR internal review

6 findings · 6 closed · lead L. Okoye

Completed
100%
11Evidence hub

Audit-ready, quietly.

Evidence is collected and versioned continuously and attached where it belongs — frameworks, controls, demands, remediation, third parties — so audit prep stops being a scramble and becomes a download.

  • Continuous collection
  • Versioned & fully traceable
  • Attached across the platform
app.csfaas.com/dashboard/evidences
AAcme Corp

Evidence hub

Collected & versioned continuously

collecting
All files318
Frameworks74
Controls129
Risk demands22
Remediation31
Third parties40
Audit responses22
Recent evidence318 files
CSVaccess-review-Q2.csv2m
PDFpentest-report-2026.pdf1h
DOCencryption-policy-v4.docx3h
PDFvendor-soc2-acme.pdf5h
LOGbackup-restore-test.log8h
CSVmfa-coverage-export.csv11h
CSVaccess-review-Q2.csv2m
PDFpentest-report-2026.pdf1h
DOCencryption-policy-v4.docx3h
PDFvendor-soc2-acme.pdf5h
LOGbackup-restore-test.log8h
CSVmfa-coverage-export.csv11h
12Form builder

Ask once, track everything.

Build questionnaires for vendors, systems and control owners, send them where they are needed, and watch responses and completion roll in — without a single spreadsheet.

  • Custom questionnaires
  • Sent across the platform
  • Live response tracking
app.csfaas.com/dashboard/forms
AAcme Corp
BuilderSendAnalytics
4 templates

Third-party risk assessment

FORM-002 · Published

Sent24
Responses18
Response rate75%
Send form
Recipientslive
StripeReviewed
AWSSubmitted
HubSpotPending
NotionOpened
Acme PayrollPending
DatadogSubmitted
StripeReviewed
AWSSubmitted
HubSpotPending
NotionOpened
Acme PayrollPending
DatadogSubmitted
03How it works

Three steps to always-on compliance

01

Connect your scope

Pick your frameworks and workspaces. CSFaaS maps them to a unified control set so you never duplicate work.

02

Collect evidence continuously

Owners attach evidence against controls as work happens — versioned, timestamped and always audit-ready.

03

Prove it, anytime

Export audit packages and answer security questionnaires from a live posture, not a year-end scramble.

04Inside CSFaaS

The modules that run your program

One connected system instead of a dozen disconnected tools and spreadsheets.

Frameworks & Controls

40+ prebuilt frameworks — ISO 27001, SOC 2, NIST CSF 2.0, GDPR — mapped to a single control set, with policy versioning and approvals.

Risk Registry

Document, score and treat risk — threat- and asset-oriented, inherent through target, with owners, status and response.

Demands

Structured risk-assessment requests: business context, systems and data classification gathered before analysis begins.

Remediation

Action plans that drive risk down to closure — owners, due dates, progress and a full activity trail.

Evidence Hub

Attach and version evidence across frameworks, controls, demands, remediation and third parties — always traceable.

Posture & Audit

Live readiness by framework, control and owner, with audit planning and exportable packages on demand.

05Software + expertise

Buy the tool, or have us run it

CSFaaS stands on its own. But the fastest path to audit-ready is letting DarkProtect deploy it, configure your controls and operate the program alongside your team.

Frameworks & Controls

40+ prebuilt frameworks — ISO 27001, SOC 2, NIST CSF 2.0, GDPR — mapped to a single control set, with policy versioning and approvals.

Risk Registry

Document, score and treat risk — threat- and asset-oriented, inherent through target, with owners, status and response.

Demands

Structured risk-assessment requests: business context, systems and data classification gathered before analysis begins.

Remediation

Action plans that drive risk down to closure — owners, due dates, progress and a full activity trail.

Let's talk about your security program

A free 30-minute conversation, no pitch. We'll map where you stand, the standards you need to meet, and the most direct path to get there.