For CIOs, CTOs and compliance leads

Manage your IT, your technology and its risks in one place

AI Pazz Govnex gives a CIO, a CTO and a compliance lead one record of what the organization runs — its applications, cloud and hardware providers, and their contracts, renewal dates and cost — beside the processes that depend on it, the risks it carries, the controls that answer for it and the audits that test them.

Most organizations keep their technology in a spreadsheet, their contracts in someone's inbox, their risks in a slide and their ISO 27001 evidence in a shared drive. Govnex keeps them in one product, under one set of people and permissions, so the question a board or an auditor asks has one answer.

Start free See pricing

What each of you gets

For the CIO

Know what you run and what it costs

  • Every application, cloud provider and hardware provider in one list, each with the company behind it, its criticality and its status
  • Every contract and licence with its department, vendor, owner and value — and the total in force, by department, vendor and item
  • Ninety days' notice, to the contract's owner, before anything expires or renews by itself

For the CTO

Know what depends on what

  • Each application tagged with the cloud and hardware it runs on, so every provider shows what stops if it does
  • Processes and services catalogued with their owners, criticality, dependencies and SOPs — and the critical ones with no procedure in force called out
  • Cloud providers recorded with what each provides and the countries your data is hosted in

For the Compliance lead

Show that it is under control

  • ISO 27001, SOC 2 and GDPR controls adopted from the Compliance Library, each with an owner and evidence recorded cycle by cycle
  • Technology risks scored on your own matrix, treated with actions people own, and closed only on evidence
  • Internal audits run against the controls you already track, with every finding followed to a validated fix

Questions you can answer the day they are asked

By a board, an auditor, a regulator or a finance director — from the record, not from a week of chasing people.

  • Which applications do we run, who makes them and how critical is each?
  • What stops working if this cloud provider does?
  • Which contracts and licences expire or renew by themselves in the next ninety days — and what are they worth?
  • What do our software and providers cost, by department and by vendor?
  • Which critical processes have no SOP in force, and which reviews are overdue?
  • In which countries is our data hosted?
  • Which of our technology risks are high, and who is treating them?
  • Where is the evidence for this control, and who recorded it?

What you manage, and where

Applications, providers and their contracts
One list of applications, cloud providers and hardware providers. Each carries its contracts and licences — department, vendor, owner, document, expiry and renewal dates, and value — with a renewals report, a notice to the owner ninety days ahead, and a dashboard of what the contracts in force cost.Process and Technology Governance
Processes, services and SOPs
What the organization does, under the unit that does it: an owner, a criticality, what it depends on, its SOPs and KPIs, and a review cycle with overdue reviews flagged.Process and Technology Governance
Technology and operational risk
Risk registers at organization, unit or team level, scored on a 5 × 5 matrix or your own scales, shown as a heat map, treated with delegated actions and closed on evidence. A risk names the processes and services it concerns.Risk Tracking
Controls and standards
Adopt the controls of ISO 27001, SOC 2, GDPR and the rest of the Compliance Library, give each an owner, and record a verdict and evidence for every one, cycle by cycle, until the report is ready for the auditor.Compliance and Control Tracker
Issues, incidents and findings
Log what is wrong, assign it to whoever has to put it right, escalate it when it runs late, and close it on evidence a second person validates.Issue & Remediation
Internal audit
The year's audit plan, fieldwork against the controls you track, workpapers reviewed by a second auditor, findings answered by management, and corrective actions followed to closure.Audit Management
Personal data and where it lives
The data you hold by entity and record, Records of Processing Activities with their checklist and risk rating, and the DPIAs and LIAs they call for.Data Compliance Tracker
Regulations that apply to you
The regulations, standards and frameworks you answer to, each with an owner, a rationale and a review date, and the work to comply tracked.Regulatory Change

IT and technology governance: questions and answers

What is IT governance software?
Software that keeps a record of the technology an organization runs, who answers for it, what it costs, what depends on it and what risk it carries, and shows that the controls over it are working. In AI Pazz Govnex that record is the Applications & Providers inventory and the process catalogue, connected to risk registers, compliance controls and internal audits.
Is AI Pazz Govnex a CMDB or an asset discovery tool?
No. It does not scan your network or discover devices. It is a governed register that your people maintain: applications, cloud providers and hardware providers, each with its criticality, what it depends on and its contracts and licences. It records what a governance, risk or audit question needs, not every configuration item.
How does it help with software licence and contract renewals?
Every contract and licence has an owner, an expiry date and, where it renews by itself, the date it does. The owner is emailed ninety days before each date, sees it in My Tasks, and the Renewals report lists everything coming up or already expired, with its value, and exports as a spreadsheet.
Can we see what our technology costs?
Yes. Each contract can carry its value in your organization's base currency. The dashboard totals the contracts in force and breaks the figure down by category, business department, vendor and item, with the amount at stake in the next ninety days. Amounts entered in another currency are shown separately and never added in.
Does it support ISO 27001 and SOC 2?
Yes. The Compliance Library carries ISO 27001, SOC 2, GDPR and other standards as controls you adopt as your own, assign to owners and evidence cycle by cycle. Internal audits generate their work programme from the same controls.
Who in the organization uses it?
Each person gets a role per module. An IT manager can run Process and Technology Governance, a risk owner can work in Risk Tracking, and an auditor in Audit Management, all sharing one organization, one set of people and one set of permissions.

The modules behind it

Small business and up

Process governance, application inventory and IT contract management software

Process and Technology Governance

Govern what the organization does and what it runs on: its processes, services and capabilities — each with an owner, SOPs, KPIs and a review cycle — and its applications and providers — the cloud and hardware they depend on, with their contracts and licences.

  • What the organization does, placed under the unit that does it — capabilities holding the processes that deliver them, and the services it provides
  • SOPs inside each process and service — the procedure written out, with its forms and documents uploaded or linked, and its own review date
  • Applications, cloud providers and hardware providers in one list, told apart by category — each with the company behind it, its criticality and its status
More about Process and Technology Governance
Small business and up

Risk management software

Risk Tracking

Risk registers at every level of the organization: score risks, treat them, evidence their closure, and raise the ones the board should see.

  • As many registers as your organization needs, each run by its own administrator
  • Risks at organization, unit or individual level, each with an owner
  • Optional approval before a risk closes — by the register’s administrator or someone you name
More about Risk Tracking
Every plan

Compliance management software

Compliance and Control Tracker

Track recurring compliance obligations, assign owners and record the evidence, cycle by cycle.

  • Adopt controls from the Compliance Library — ISO 27001, SOC 2, GDPR, Sri Lanka PDPA and more — as your own editable copies
  • Cycles and assessments whose scope is fixed the moment they open
  • Coverage and maturity scoring, withheld below a coverage floor you set
More about Compliance and Control Tracker
Small business and up

Issue and remediation tracking software

Issue & Remediation

Log what is wrong — gaps, findings, incidents — assign it to whoever has to put it right, and see it closed with evidence and a second pair of eyes.

  • Anyone can open a register and run it: its own severities with target days, categories, custom attributes and visibility
  • A due date from the severity, moved only with a reason that is logged
  • A ladder per register: overdue by so many days, escalate to the administrator, the Module Admins or a named person — worked out live, never stale
More about Issue & Remediation
Small business and up

Internal audit management software

Audit Management

Run internal audit programmes: the scopes audited in each, tests with their samples, findings answered by management, issued reports, and every finding handed over to Issue & Remediation for tracking.

  • The year's audits in one plan, approved by an audit lead — anything added afterwards is marked unplanned until the plan is approved again
  • A work programme generated from the controls you track for the standards in scope — with each control's latest recorded verdict and evidence beside the auditor's own conclusion, never written back
  • Findings written as condition, criteria, cause, effect and recommendation, rated on your own scale, with a link to the earlier finding they repeat
More about Audit Management
Small business and up

Data protection compliance software

Data Compliance Tracker

What you hold data about and what you do with it: entities and their records with a business owner and a data owner for each, and Records of Processing Activities with a compliance checklist answered item by item, rated for risk, with the DPIAs and LIAs they need.

  • Entities — Customer, Employee, Supplier — each with a business owner and a data owner
  • A RoPA for each activity: its purpose, its owners, and the records it processes — what they hold read beside it
  • Every RoPA rated low, medium, high or critical from its checklist answers — worked out each time it is read, never typed in — and told when it needs a DPIA or an LIA, and why
More about Data Compliance Tracker

Put your technology on the record

Start with the applications you run and the contracts behind them. The rest joins as you need it.

Start free Every module