NormSentry · Governance, risk and compliance
Security, risk and compliance — from the boardroom to the plant floor
One platform replaces the GRC suite, the OT spreadsheets and the audit scramble, and keeps risk continuously audit-ready across IT and OT.
Request a demo Become a partner
What manual compliance really costs
Risk assessed once a year
Stale the day it is signed. New CVEs and end-of-life assets pile up unseen for months.
Five tools, many spreadsheets
GRC suite, OT sheets, scanners, BCM tool and the evidence chase — no shared model.
Everything rests on a few experts
Framework know-how lives in people's heads, so every audit becomes a fire drill.
Nine modules, one system of record
Compliance management
IM8, ISO, IEC 62443, NIST, PCI DSS, NIS2 and DORA on one control schema.
Continuous risk engine
Quantified five-stage pipeline that re-runs whenever something changes.
OT / ICS cell risk
IEC 62443 zones, conduits and per-cell target security levels (SL-T 1–4).
Asset & lifecycle
Inventory, criticality and end-of-life / end-of-support tracking.
Vulnerability & CVE
Nessus, OpenVAS or CSV import with automatic risk assessment.
Change requests
Four-eyes approval and segregation of duties, fully logged.
Continuity (ISO 22301)
BCM, business impact analysis, computed RTO and RPO.
Compliance calendar
RACI-routed recurring tasks so nothing slips between audits.
Reporting & insight
Board-ready reporting with AI assistance.
Frameworks available today
More in development, including MAS TRM, SOC 2, ISO 42001, TISAX and FedRAMP.
Who it is for
| Segment | Why they call | What we lead with |
|---|---|---|
| Government agencies & suppliers | IM8 obligations, agency audits | IM8-native controls, Singapore-hosted |
| Critical infrastructure / OT | IEC 62443, NIS2, plant audits | Per-cell SL-T; IT and OT in one model |
| Financial services | DORA, PCI DSS, MAS TRM | Map once, reuse evidence; resilience plans |
| EU essential entities | NIS2 deadlines, incident reporting | NIS2 and DORA incident response, continuity |
Why it pays for itself
~163 hours a month back
Risk runs, evidence, EOL tracking, reporting and change control largely automated.*
Four tools retired
GRC suite, OT spreadsheets, BCM tool and evidence chase in one licence.
Under 12 months payback
Typical payback against licence and onboarding in a mid-size regulated estate.*
*Illustrative model for a mid-size regulated organisation (~500 assets, IT + OT). We build it with your own labour rates, tools and audit calendar.
Built and hosted on Singapore cloud, or fully on-premise. Singapore IP. Trusted in Singapore public-sector and critical-infrastructure environments.
See it on your own estate
Book a guided walkthrough. We will contact you to arrange it.