Article
The Compliance App: a cluster's compliance evidence, read where it was produced
The Compliance and Assurance Convoy writes a dated report for each regulatory regime every day, in the regulator’s own numbering, from the cluster it runs on. Until now, reading that report meant asking whoever operates the cluster for a copy. The Compliance App changes who reads it, and where.
The app gives a result for every requirement of the Saudi NCA Essential Cybersecurity Controls (ECC-2:2024) and of the Qatar Central Bank’s technology risk regulation, under each regulator’s own numbering, from inside the customer’s own cluster, with no evidence leaving it.
What the app is
The Compliance App is an add-on to the convoy. It runs in the organisation’s own Kubernetes cluster, beside the convoy, and reads the convoy’s evidence where the convoy writes it. It sends nothing out of the cluster: the reports, the evidence and the record of who read them stay on the organisation’s own volumes.
People sign in through the organisation’s own identity provider, by OpenID Connect, or, where no provider is connected yet, with local accounts defined in a Kubernetes Secret. Groups in the provider are mapped to the app’s four roles when it is installed, and an administrator can add mappings, each with an expiry.
| Role | What it sees |
|---|---|
| Auditor | Every regime and every run, read-only |
| Compliance lead | What an auditor sees, and each regime’s results over time |
| Namespace owner | The findings in their own namespaces, and what to fix first there |
| Administrator | The settings, the role mappings and the access log, and no report unless also given another role |
A namespace owner sees only their own namespaces. The scope is enforced twice, once by the policy that admits each request to its roles and again where the data is read, and the tests check every route against every role, including the requests that must be refused.
What it shows
For each regime the app shows the latest run requirement by requirement: every requirement of the regime, under the regulator’s own identifier, with exactly one result, and for each technical requirement the checks behind its verdict and the objects that fail them. Requirements that are the organisation’s to evidence are listed as such, rather than counted as passed.
A compliance lead sees the same results over time, run by run. A namespace owner sees what to fix first in their namespaces, in the order the report gives.
Every file the convoy writes for a run can be downloaded as it was written: the report in HTML and PDF, the assessment results in OSCAL, and the signed manifest. Each download is checked against the manifest first, and a file that no longer matches is not served.
Who read what
Every request to a report, a run or a file is recorded, allowed or refused, with the person, the action and the result. Each entry is signed, so an entry edited afterwards is shown as such, and the same record is written to the app’s log for an organisation that collects its logs elsewhere. A read of a report or of evidence that cannot be recorded is refused rather than served unrecorded.
Who it is for
The app is for the people who must answer for a regime without operating the cluster: internal and external auditors, risk and compliance teams, and the owners of the applications in it. Each reads the evidence directly, at the level their role allows, instead of receiving a copy at second hand.
The regimes it carries
The app shows whatever regimes the convoy holds a licence for. Two are available today:
- the Saudi National Cybersecurity Authority’s Essential Cybersecurity Controls, ECC-2:2024;
- the Qatar Central Bank’s Technology Risks circular.
The SAMA Cyber Security Framework and the UAE Information Assurance Standard v2.1 are expected in the first quarter of 2027. The convoy’s page lists every regime with its expected quarter.
What it does not do
The app reads evidence. It does not certify compliance. The organisational requirements of each regime remain the organisation’s to evidence, and compliance is determined by its assessor. The mapping of each regime’s requirements to the cluster’s controls is Mamluk’s reading of the regime, and the authoritative wording remains the regulator’s.
Availability
The Compliance App is installed with the convoy’s chart, and requires the Compliance and Assurance Convoy and Kubernetes 1.36 or later, on the Bahriya Kubernetes Engine or any conformant distribution. It is licensed as an add-on to the convoy at USD 12,000 per organisation, per year, whatever the number of regimes. The convoy’s own web view and email reports remain included with the convoy. Organisations can discuss the convoy and the app through mamluk.net.