Platform
Continuous Azure compliance assurance for CyFun/NIS2.
Microsoft tells you what is wrong in Azure. Governator tells you what it means for CyFun/NIS2, who owns it, how to fix it, and what proof you can show to an auditor.
What Governator does
Governator collects configuration, security, access, cost, and activity data from your Azure subscriptions. It maps findings to the CCB CyberFundamentals framework (748 control-evidence links) and NIS2 Article 21 requirements, then presents an integrated dashboard for continuous compliance monitoring and audit readiness.
Control Mapping Engine
Azure findings mapped to CyFun/NIS2/CCB themes. Not just 'what is wrong' but 'what it means for your compliance obligation, which NIS2 article is affected, and who owns the gap.'
Evidence Vault
Timestamped proof, snapshots, manual attestations, exceptions, and a complete audit trail. The evidence your auditor needs, structured and exportable.
Remediation Factory
Owner assignment per finding, SLA tracking, and re-verification on each collection run. Findings do not just get reported, they get closed.
Executive Assurance Pack
Board-level dashboard with audit readiness percentage, risk trends, overdue owners, and management summaries. One page for the people who need to sign off.
Pre-Audit Mode
Assessment-ready export at your target CyFun assurance level. Executive summary, control evidence matrix, gap analysis, attestations, and exemptions. Color-coded XLSX.
Who it is for
Security teams
Day-to-day operational security: WAF assessment, public exposure analysis, RBAC audit, Defender finding triage, exemption workflows, drift alerting, cleanup tracking. Actionable insights, not just dashboards.
Management and audit
Compliance evidence, CyFun/NIS2 mapping, board reporting, audit-ready exports, gap narratives. Proof and accountability for the people who need to sign off.
How it works
Data collection
- ✓ Resource Graph (subscriptions, resources, tags, properties)
- ✓ Defender for Cloud (CSPM assessments, secure scores)
- ✓ Azure Policy (compliance states, definition resolution)
- ✓ RBAC (role assignments, principal resolution via MS Graph)
- ✓ Activity Log (90-day activity per resource)
- ✓ Cost Management (billing data, service breakdown)
- ✓ WAF Policies (CRS rules, paranoia level, exclusions)
- ✓ Azure Firewall (rule collection groups, DNAT exposure)
- ✓ Storage Metrics (transactions, capacity, egress)
- ✓ Tag Compliance, Cleanup Detection, Change Detection
AI-powered assessment
- ✓ Per-control gap narrative generated for auditor review
- ✓ Storage account deep inspection with PII detection
- ✓ Resource criticality and data sensitivity classification
- ✓ WAF security assessment with effective protection scoring
- ✓ Defender exemption justification drafting
Assessment or continuous assurance?
Governator powers both. A CyFun/NIS2 Readiness Assessment is a one-time engagement that uses Governator to produce a point-in-time compliance picture with expert interpretation. For organisations that need ongoing visibility, Governator runs continuously as a managed service with regular collection, drift detection, and management reporting.
Most organisations start with an assessment and move to continuous assurance when they see the value of the evidence trail.
Start with a Platform Health Check
Not sure where to begin? A quick architecture review gives you a clear picture. No obligation.
- ✓ Risk scorecard across identity, network, governance, and security
- ✓ Top 10 issues ranked by impact and effort
- ✓ 30-60-90 day roadmap with quick wins