Cybersecurity maturity that goes beyond compliance

Most organisations can pass a compliance audit. Very few can demonstrate genuine operational resilience. Nucleus Systems built Core Pillar 1 to close that gap: a structured, scored, 5-level maturity model that assesses 188 controls across six NIST-aligned domains, then maps every finding to a board-readable trust score and a prioritised remediation roadmap.

The NS-CMMF framework and its supporting Cybersecurity Maturity Platform allow us to track improvement over time, compare performance against industry benchmarks and produce evidence that regulators, insurers and acquirers can rely on.

AI governance that boards and regulators can rely on

The proliferation of AI across enterprise operations has created a governance gap that is now receiving intense regulatory scrutiny. The EU AI Act imposes mandatory compliance obligations. ISO 42001 establishes a management systems standard for AI. Boards are being held accountable for AI decisions they don't yet have the tools to understand.

Nucleus Systems built the NS-AIGF — a 60-control AI governance framework spanning 7 domains — to give organisations a structured, auditable and continuously improving AI governance posture. Our Paxley AI Governance Platform delivers these controls at operational scale.

Security for AI systems, not just governance of them

Pillar 2A governs how AI is used and governed. Pillar 2B secures the AI systems themselves. These are distinct disciplines requiring different skills. The NS-AISCA framework was built to address the security risks unique to machine learning systems: adversarial attacks, data poisoning, model inversion, prompt injection, agentic AI autonomy risks and MLOps pipeline vulnerabilities.

With 108 controls across 12 domains, NS-AISCA provides the most comprehensive AI security assessment structure available from a single practitioner firm, delivering findings that technical teams and boards can both act on.

Trust in software has to be earned at every commit

Modern software supply chains are complex, distributed and increasingly AI-assisted. The risks are real: compromised open-source dependencies, unsigned binaries, insecure CI/CD pipelines, untested SBOMs and code written by AI models with no security accountability. Nucleus Systems built Core Pillar 3 to address this systematically.

The NS-CTAF framework defines 86 controls across 6 trust domains. The Paxley platform delivers these controls at the point of development — scanning every commit, validating every dependency, and producing a continuous Code Trust score that development teams, security teams and boards can all rely on.

Design philosophy

NS-CMMF was designed to close the gap between compliance and operational resilience. Most organisations can pass an ISO 27001 audit or a SOC 2 review while remaining genuinely vulnerable to real-world threats. NS-CMMF addresses this by defining 188 controls that go beyond procedural compliance to assess actual implementation depth, operational consistency and evidence-based practice.

The 5-level maturity model (L1 Initial → L5 Optimised) allows organisations to track improvement over multiple assessment cycles and compare against industry-specific benchmarks. The 5-axis scoring model evaluates each control across Policy, Process, Technology, People and Measurement dimensions.

Coverage

All 188 controls are organised across 6 NIST CSF-aligned domains, with explicit mapping to 32 external standards including ISO 27001, CIS Controls v8, NIST 800-53, PCI DSS, SOC 2, GDPR and sector-specific frameworks.

Design philosophy

NS-AIGF was designed for organisations deploying AI at scale who need to demonstrate to regulators, boards, customers and partners that their AI systems are governed responsibly. Unlike generic ethics checklists, NS-AIGF is a structured control framework: 60 controls, 7 domains, each control mapped to specific regulatory obligations and industry standards.

The framework is technology-agnostic — it covers all AI modalities including predictive models, large language models, generative AI and agentic AI systems — and it is designed to be continuously assessed rather than a one-time audit.

External alignments

Design philosophy

NS-AISCA addresses a gap that most cybersecurity frameworks do not cover: the security of AI systems as technical artefacts. General cybersecurity frameworks (ISO 27001, NIST CSF) treat AI systems like any other IT asset. They are not. AI models have unique attack surfaces — adversarial inputs, training data poisoning, model extraction, hallucination exploitation and agentic autonomy risks — that require specialised security controls.

NS-AISCA defines 108 controls spanning 12 domains, organised to cover the full AI system lifecycle from data ingestion through model training, deployment, monitoring and decommissioning. It is the technical counterpart to NS-AIGF's governance layer.

Threat model coverage

Design philosophy

NS-CTAF was built on the premise that trust in software must be established at the point of creation and continuously maintained through every change. It defines 86 controls across 6 trust domains — covering source code integrity, dependency trust, CI/CD pipeline security, SBOM governance, open-source risk and AI-assisted code — and introduces a four-tier certification model (CTA-1 through CTA-4) that allows organisations to communicate code trust levels to internal and external stakeholders.

The Paxley platform is the primary delivery vehicle for NS-CTAF, scanning every commit, PR and release against the framework's control definitions and maintaining a live Code Trust Score.

Certification tiers

Built to deliver NS-CMMF, not adapted from a generic tool

The Cybersecurity Maturity Platform is the operational engine for Core Pillar 1. It implements all 188 NS-CMMF controls as structured assessment modules, calculates domain scores using the 5-axis model, produces board-ready trust scores and generates remediation roadmaps automatically from assessment findings.

The platform enables continuous assessment rather than point-in-time audits — so organisations can track maturity improvement between assessments, monitor regression risks and benchmark against sector-specific maturity targets.

Key capabilities

• 188-control NS-CMMF assessment engine
• 5-axis scoring per control (Policy, Process, Technology, People, Measurement)
• Domain-level and aggregate trust score calculation
• Industry benchmark comparison
• Automated remediation roadmap generation
• Board-level executive reporting suite
• Multi-period trend tracking and maturity progression charts
• Evidence management and audit trail

Structured assessment for AI security findings

The AI Security Assessment Platform operationalises all 108 NS-AISCA controls as structured assessment modules. Assessors use the platform to evaluate controls across all 12 security domains, with each finding automatically categorised by severity, domain, control ID and remediation effort.

The platform produces findings reports, risk-scored remediation roadmaps and executive summaries aligned to technical and board audiences. It supports both point-in-time assessment engagements and ongoing monitoring programmes.

Key capabilities

• 108-control NS-AISCA assessment engine
• 12-domain security coverage with severity scoring
• Automated remediation roadmap generation
• MITRE ATLAS & OWASP ML Top 10 cross-mapping
• Technical findings report and executive summary
• Multi-engagement trend tracking
• Agentic AI and GenAI-specific assessment modules

Continuous threat detection backed by NS-CMMF maturity

Nucleus Systems partners with CyberOne to deliver managed detection and response services that go beyond standard MSSP tooling. Every MDR engagement is anchored to the NS-CMMF framework — so detected threats are contextualised against the client's actual maturity posture, not a generic baseline.

This integration means that when a threat is detected and responded to, the findings inform the client's broader cybersecurity maturity programme. Detection events become data points in continuous improvement rather than isolated incidents.

Technology & standards

Payment security at the infrastructure layer

Nucleus Systems has deep specialist expertise in the security of digital payment infrastructure — particularly open-source payment systems and digital public infrastructure (DPI) frameworks deployed across Africa, Asia and the Middle East. Our practitioners have direct experience with Mojaloop (the real-time payments platform), Tazama (transaction monitoring) and the COMESA framework.

We combine payment-specific security expertise with our NS-CMMF maturity methodology to deliver security assessments that address both technical vulnerabilities and institutional governance gaps.

Technology & standards expertise

Securing the infrastructure of trust for digital identity

National digital identity programmes are among the most sensitive and highest-risk digital transformation initiatives any government undertakes. Nucleus Systems brings specialist expertise in the security of identity platforms — particularly open-source DPI stacks such as MOSIP (Modular Open Source Identity Platform) and OpenG2P — and in the verifiable credential ecosystems being deployed across Africa, Asia and the Pacific.

Our engagement model combines security assessment, architecture review and ongoing advisory to ensure that identity programmes are secure from inception, compliant with international standards and resilient to the specific threat models that national identity infrastructure attracts.

Technology & standards expertise

Trust infrastructure for the next billion users

Financial inclusion requires security inclusion. Mobile money operators, microfinance institutions, agent banking networks and fintech platforms serving unbanked and underbanked populations face security and regulatory challenges that are distinct from those of established financial institutions. They operate at the intersection of fintech innovation, telecoms infrastructure and regulatory uncertainty — often with limited internal security capacity.

Nucleus Systems brings practitioner experience across sub-Saharan Africa, East Africa, West Africa, South-East Asia and the Pacific — with deep familiarity with the mobile money ecosystem, the regulatory frameworks that govern it and the specific threat models that emerging-market financial services providers face.

Market expertise

The quantum clock is running. Most organisations are not ready.

NIST finalised the first post-quantum cryptography standards in 2024. Cryptographically Relevant Quantum Computers (CRQCs) may be capable of breaking current public-key cryptography within a decade. Harvest-now-decrypt-later attacks — where adversaries collect encrypted data today to decrypt once quantum capability arrives — are already documented.

Nucleus Systems provides the advisory capability organisations need to understand their cryptographic exposure, build a credible migration roadmap and implement crypto agility architectures that can adapt as the quantum threat evolves. We work across enterprise, government and financial services sectors, with particular focus on organisations that manage long-lived sensitive data or critical infrastructure.

Standards & frameworks