Run your security and compliance programme end to end
Lighthouse brings security compliance and governance into one product: program design from a ready-made control catalogue, evidence tracking, ISO 27001 and TISAX compliance tracking, a center for policies and roles with a Policy Design Agent, and management reviews. Routine work runs by itself, and a person makes each decision.
One product for your whole compliance programme
Lighthouse does the routine work in each feature and leaves the decisions to a person.
Program Design
- Lighthouse
- Shows the catalogue as a map of domains and levels, and adds everything your objective needs in one step.
- You
- Set the target level and frameworks, then apply the selection.
Evidence Tracking
- Lighthouse
- Collects answers from Shield daily, tracks what is due, and flags controls when evidence expires or a check fails.
- You
- Accept uploaded evidence, record manual checks, and confirm that a control is implemented.
Compliance Tracking
- Lighthouse
- Recalculates coverage and gaps for ISO 27001 and TISAX whenever a control changes.
- You
- Choose which frameworks are goals, and close the gaps.
Policy & Roles Center
- Lighthouse
- The Policy Design Agent proposes wording from your controls. Lighthouse shows which topics no policy covers, suggests 12 security roles, and counts vacant ones.
- You
- Accept or reject each proposed edit, publish each policy, and name who holds each role.
Management Reviews
- Lighthouse
- Lists what changed since the last review, with who changed it and why, and carries your work across new framework releases.
- You
- Hold the management review, and confirm each implemented control after a release.
Works with Shield
- Lighthouse
- Runs the checks the ASF defines against Shield’s records every day, and stores each result as a dated check.
- You
- Open a failed check’s link to see the affected records in Shield.
Build the programme from a ready-made catalogue
Lighthouse starts from the Aegyx Security Framework, a catalogue of plainly worded controls you can test. You set an objective, and the Program Designer builds the programme from it.
The Aegyx Security Framework
255 controls in 21 domains, grouped by who does the work (governance, people, IT operations, resilience, partners), plus domains that apply only to some organisations.
Testable controls
Each control has an objective, a statement of what is true when it is in place, a test procedure, the evidence that proves it and the policy statements that commit to it.
Objective
Set the level and the frameworks you are aiming for, with target dates. Each control sits at Essential, Standard or Advanced, so a level can be the goal without a certification.
Program Designer
Add a control, take a domain up to a level, add a whole level, or add everything your objective needs. Nothing is recorded until you apply the selection, and whatever you leave out is excluded.
Tiers
Apply a control at Basic, Extended or Strict. A 20-person remote company and a 2,000-person manufacturer can adopt the same control at different tiers.
Collect evidence as the programme runs
Each control lists the evidence it needs. Lighthouse collects what it can, tracks when the rest is due, and keeps each control’s status up to date.
Required evidence
Each control lists the evidence the ASF expects, such as a policy, a setting or a review, with how it is collected, how often, and when it is next due.
Daily answers from Shield
Lighthouse asks Shield questions such as “does every active asset have an owner?” each day, and stores each answer as a dated check linked to the records.
Status that updates itself
Expiring evidence or an overdue check moves a control to “Needs attention” without anyone editing it, and shows the owner why.
Uploaded evidence
Files, links and attestations, each dated and valid for a set period. By default a person accepts each item, and a small organisation can switch that step off.
Proposed implementation
Once every requirement on a control holds, Lighthouse proposes marking it implemented, and one click from a person records it.
One record per control
Its decision, status, what you actually do, its owner, evidence and checks, the ASF text and framework mappings, and its history.
ISO 27001 and TISAX from one programme
Each framework’s requirements are mapped onto your controls, so several frameworks share one programme and coverage updates as you work.
ISO/IEC 27001:2022
The management-system clauses and Annex A, each requirement mapped onto the controls that meet it.
VDA ISA 6 — TISAX
Requirements split by level (must, should, high and very high protection), so you can track each level separately.
Gap analysis
Each requirement shows as implemented, partial or not implemented, and updates whenever a control changes. Requirements with no control, and controls below the required tier, show as gaps.
Adding a framework
Certified to ISO 27001 and asked for TISAX? Add it as a goal and see which additional controls it requires.
Write, import and publish your policies
Each policy statement is linked to the controls it commits to, so Lighthouse can show which topics are covered and which commitments no control supports.
Statements linked to controls
A policy consists of readable text and statements, and each statement is linked to the controls it commits to. Lighthouse shows what a policy covers and what a draft leaves out.
Structure policies your way
46 topics a policy set needs to cover and 24 suggested policies to start from. Whether you write one document or ten, coverage is tracked per topic.
Import existing policies
Import a policy as plain text or Markdown. It is split at its headings, and its list items are offered as statements.
Approval and versions
The owner approves and publishes in one step. Every published version is kept, with its author and approver.
Policies as evidence
When a policy is published, Lighthouse adds it as evidence for the controls that require it.
The Policy Design Agent
Writing policies is the slowest part of a programme. The agent works beside the editor, in a conversation about the policy, a section or a statement. It starts from your own controls rather than a generic template, and never changes a word a person did not accept.
Starts from your controls
It proposes wording from the controls behind a section’s topics and their template statements.
Every edit waits for you
Each proposed edit waits in the draft, where it would land, citing what it comes from, until the author accepts it, as it stands or reworded, or rejects it.
Commitments nobody could evidence
It points out what a policy commits to that nobody could evidence.
Works on imported policies
It marks topics and controls on an imported text.
Asks before it guesses
If it needs to know whether contractors use the company’s accounts, it asks. It keeps an answer for later when the author says so.
Optional
Lighthouse works fully without agents. Every claim the agent makes cites the ASF or a published text.
Define the security roles you need
The roles register lists the security roles your organisation has and who holds them, starting from a suggested set.
Role definitions
Each security role with its purpose, responsibilities, authority, reporting line, current holder and previous holders.
Suggested roles
12 suggested roles from the ASF that you can adopt, reword, merge or replace.
Vacancies
Roles nobody holds are counted and shown.
Prepare management reviews from the programme’s history
Every decision is versioned, so you can answer what changed, who changed it and why from Lighthouse itself.
Overview
Controls implemented, verified and needing attention, checks due in the next 30 days, the controls map, and coverage for each framework.
Changes since any date
See what changed since a snapshot, the last 30 or 90 days, the last upgrade or a date you choose. Each change shows what moved, who did it and why.
Snapshots
Take a snapshot at each management review. Compare the headline figures then and now, and open the controls map as it stood.
New ASF releases
Moving to a newer release carries over every decision, check and piece of evidence, and asks owners to confirm that each implemented control still holds.
Connected to your security operations
Where Shield holds the records (assets, applications, suppliers, risks), Lighthouse runs the checks the ASF defines against them every day and stores each result as a dated check. If three laptops lose their owner, the “every asset has an owner” check fails the next morning, and its link opens those three laptops in Shield.
One sign-in covers both products, and Lighthouse also runs without Shield.
Part of the Aegyx Suite
Lighthouse works best alongside the rest of the platform.
Shield
Efficient maintenance of your cybersecurity measures — work in tandem with our agents to minimize the time needed for cybersecurity activities, without ever losing control or oversight.
Spear
Assure your cybersecurity beyond basic cyber-defense; leverage a tailored, automated penetration testing strategy to continuously test your organization & its products against what's out there.
Ready to talk about Lighthouse?
Get in touch and we'll walk you through what Lighthouse can cover for your organization.