The code security platform that enforces trust at every commit.
Paxley is our only product, built to operationalise the NS-CTAF and NS-AIGF frameworks at the point of development. GitHub-native, repo-priced, and designed for enterprises where AI writes a growing share of the code.
We don't describe security.
We measure and prove it.
Other firms deliver compliance reports. Nucleus Systems engineers, measures, and continuously proves digital trust, converting cybersecurity complexity into measurable, defensible, board-level confidence across 40+ countries.
One methodology. One trust score. Applied consistently across 40+ countries and six domains of digital trust.
Framework. Platform. Service.
Every engagement, in that order.
Most consultancies borrow public standards and apply them loosely. Nucleus Systems starts with proprietary frameworks we built, runs them through platforms we developed, and delivers findings through practitioners who know the difference.
Proprietary IP, built from first principles.
Four internally developed frameworks define every control, domain, scoring model and maturity level we use. Not adapted from existing public standards, designed from scratch to make trust scores consistent, comparable and defensible to boards and regulators.
Purpose-built delivery, not point-in-time audits.
Our Cybersecurity Maturity Platform and AI Security Assessment Platform turn framework controls into continuous, automated scoring. Every assessment generates a live trust index, not a PDF that sits on a shelf. Boards see real posture. Regulators accept the output.
Practitioner delivery, specialist, not generalist.
We deploy deep domain specialists across 40+ countries. Every engagement is led by a practitioner who has operated in the sector, understands the regulator's lens, and knows how to translate technical findings into language a board can act on.
From the Nucleus Systems desk
Built by practitioners.
Driven by trust.
Every engagement at Nucleus Systems is led by a specialist who has operated in the sector, not a generalist analyst reading a playbook. We deploy people with decades of hands-on experience in the most demanding regulated environments globally.
26+ years across African and Middle Eastern banking, payments and digital public infrastructure. Former Alinma Bank and MTN Fintech. Led 150+ M&A cyber due diligence engagements. Co-creator of OpenSwitchAfrica.
Our practitioners have built cryptographic systems for tier-one banks, led regulatory compliance programmes for central banks, architected cloud security for payment rails and contributed to the open-source platforms that underpin digital public infrastructure across Africa, the Middle East, and Europe.
This depth of direct operational experience is what separates us from advisory-only firms. When we assess your security posture, design your AI governance structure, or lead your M&A cyber due diligence, we are drawing on real-world knowledge, not frameworks read from a textbook.
Four domains of digital trust. Each with its own framework, platform and service.
Cybersecurity Trust & Resilience
188 controls across 6 NIST-aligned domains. L1→L5 maturity scoring. Board-ready trust index and remediation roadmaps.
AI Trust & Governance
60 controls across 7 governance domains. EU AI Act, ISO 42001 and NIST AI RMF aligned. AI system risk classification and governance assurance.
AI Security & Assurance
108 controls across 12 security domains. GenAI, Agentic AI and MLSecOps threat modelling and control validation.
Code Trust & Secure Digital Delivery
86 controls across 6 trust domains. CTA-1→CTA-4 certification. DevSecOps, SBOM governance, AI-assisted code security. Delivered via Paxley.
Where frameworks meet
specialised market demands.
Beyond the four core pillars, Nucleus Systems delivers specialist solutions in domains that require deep contextual knowledge, from payment rails to post-quantum cryptography.
24/7 MDR delivered in partnership with CyberOne MSSP, anchored to NS-CMMF maturity context. Threat detection with trust measurement built in, not bolted on.
Learn more →Security architecture for payment rails and digital public infrastructure across emerging markets. Mojaloop, Tazama, COMESA and PCI DSS expertise, deployed where trust is both mission-critical and newly built.
Learn more →Security assurance for national identity programmes and verifiable credential infrastructure. MOSIP, OpenG2P, W3C VC and DID ecosystem, securing identity at population scale.
Learn more →Mobile money, agent banking and microfinance security across Africa, Asia and the Pacific. Trust assurance where financial infrastructure is still being built.
Learn more →CBOM analysis, PQC readiness assessments, crypto agility architecture and NIST PQC migration roadmaps. Prepare for CRQC-era cryptographic risk now.
Learn more →Where trust carries the most weight.
We work where a failure of trust is not an inconvenience, it is a systemic event.
Financial Services
Banks, insurers and asset managers where a trust failure triggers systemic regulatory action.
Government
Public institutions where digital trust is foundational to governance and citizen confidence.
Digital Public Infrastructure
National identity, payment rails and data exchanges that underpin entire economies.
Fintech
Regulated disruptors building trust at speed across payments, lending and digital wealth.
Healthcare
Patient data, clinical systems and AI diagnostics where trust is a matter of life.
Technology
Platforms, SaaS and AI companies proving security posture to enterprise buyers and boards.
Private Equity
Deal teams and portfolio companies managing cyber risk through M&A and ownership cycles.
Critical Infrastructure
Energy, water and transport operators where a breach carries national consequences.
Don't see your industry?
We likely cover it.
Our practitioners have operated across 40+ countries and a wide range of regulated sectors. Tell us where you are, we'll tell you how we can help.
Ready to make trust
measurable and provable?
Tell us where trust matters most in your organisation, cybersecurity posture, AI governance, code security or digital infrastructure. We will show you how to engineer it, measure it, and keep proving it to your board and regulators.
The trust frontier, in writing.
Research, frameworks and field notes from our practitioners on the questions that matter most.
All Publications
Engineer trustfor a living.
We are a team of specialists who would rather measure trust than talk about it. If you want your work to show up as a number a board acts on, you will fit in here.
Work that proves itself.
We hire people who care about evidence. Here is what you can expect in return.
Real frontier work
AI security, post-quantum, DPI. You work on the problems most firms are only starting to name.
Flexible by default
Hybrid and remote roles across regions, built around outcomes rather than hours at a desk.
Certifications funded
We back the credentials that matter, from CISSP to ISO 42001 lead, and the time to earn them.
Measured growth
Clear progression mapped to skill, with the same rigour we bring to client maturity models.
Small, senior teams
You work alongside experts, not layers of management. Your name is on the assessment.
Global, balanced
Competitive packages, generous leave, and travel only when it genuinely moves the work forward.
No opportunities at the moment.
We are not actively hiring right now. We still review every application, so if you can prove trust, introduce yourself and we will reach out when the right role opens.
Don't see your role?
We are always interested in people who can prove trust. Tell us what you do best.
Let's prove it.
Tell us where trust matters most in your organisation. We will come back within one business day to set up a briefing.
Thank you. Your enquiry is in.
A Nucleus specialist will be in touch within one business day to set up your briefing.
Built by practitioners.
Driven by trust.
Our team brings together decades of hands-on experience in cybersecurity, digital finance, AI governance, and open-source infrastructure, deployed across Africa, the Middle East, and beyond.
A team forged in the world's most demanding digital environments.
Nucleus Systems was founded on a simple conviction: that digital trust must be engineered, measured, and continuously proven, not assumed. Our practitioners have built, broken, and secured the systems that underpin financial services, government infrastructure, and open-source platforms across Africa, the Middle East, and Europe.
We are practitioners first. Every member of the Nucleus team has operated in real environments, implementing cryptographic systems, leading regulatory compliance programmes, architecting cloud security for tier-one banks, and contributing to the open-source platforms that power digital public infrastructure worldwide.
This depth of hands-on experience is what separates us from advisory-only firms. When we assess your security posture, design your AI governance framework, or guide your M&A cyber due diligence, we are drawing on direct operational knowledge, not theory.
Godfrey Kutumela
A seasoned expert in digital trust, fintech, and regtech with extensive experience across African and Middle Eastern banking and payments sectors. Godfrey has held pivotal roles at institutions like Alinma Bank and MTN Fintech, supporting financial innovation across 16 African markets. As CEO of Nucleus Systems, he specialises in Digital Financial Services, Digital Public Infrastructure, and Private Equity M&A technology due diligence, having led over 150 investment-focused engagements.
Co-creator of OpenSwitchAfrica and contributor to Mojaloop, Tazama, Mifos, MOSIP, and OpenG2P.
Our Practitioners
Aime Bukasa
Enterprise Security Architect with deep expertise in cryptography, EMV systems, PKI, ISO 20022, and blockchain, deployed across IBM, Standard Bank, Investec, and major financial institutions in South Africa, Europe, and the Middle East.
Kerlyn Manyi
Seasoned cybersecurity professional leading vulnerability assessments, secure SDLC integration, and compliance for platforms like Mojaloop. Pursuing a Ph.D. in Network Security, passionate about inclusive digital ecosystems in emerging markets.
Yash Sancheti
Cybersecurity researcher and solution architect specialising in DevSecOps, CI/CD security, and cloud-native infrastructure. Google Summer of Code contributor and mentor. 50+ verified vulnerabilities reported on HackerOne and OpenBugBounty.
Akshat Sharma
AI, machine learning, and cybersecurity engineer with published research on stock market prediction, breach analysis, and deep learning. GSoC 2025 mentor at The Mifos Initiative. LeetCode top 3%, active open-source contributor.
Ready to put this expertise to work for your organisation?
Whether you need a Fractional CISO, a cybersecurity maturity assessment, AI governance design, or M&A technology due diligence, our team is ready to engage.
The Digital Trust
Assurance Company.
Founded in 2014, Nucleus Systems is a globally active, practitioner-led firm that converts cybersecurity complexity into measurable, defensible, board-level confidence. We engineer, measure and continuously prove digital trust across 40+ countries.
We don't describe security.
We measure and prove it.
Nucleus Systems occupies a fundamentally different market position from global management consulting firms and specialist boutiques. The distinction is structural, not stylistic.
Our four proprietary frameworks are owned intellectual property, not adaptations of public standards. That ownership creates a moat that cannot be replicated by firms that borrow methodology from ISO or NIST. Our expert founder leads every major engagement, bringing 26+ years of practitioner experience and 250+ M&A cyber diligence transactions to each mandate.
We do not deliver compliance and audit reports. We engineer, measure, and continuously prove digital trust across cybersecurity, AI governance, software assurance, and digital ecosystems.
Why Nucleus Systems
The competitive advantage is structural. Owned intellectual property, founder-led delivery, and proprietary Trust Infrastructure Platforms create a market position that generalist advisory firms cannot replicate.
| Global Management Consulting Firms |
Specialist Cyber Boutiques |
Nucleus Systems Our Position |
|
|---|---|---|---|
| Methodology & IP | Primarily adapted public frameworks with standardised methodologies and reusable delivery templates | Deep expertise in specific technical domains, but limited cross-domain integration | Four proprietary frameworks integrating cybersecurity, AI governance, AI security, operational resilience, and Code Trust into a unified trust model |
| Leadership & Delivery | Senior leadership focused on sales and account management, with delivery delegated across layered teams | Principal-led delivery with strong niche expertise but narrower strategic breadth | Founder-led on major engagements with 26+ years of practitioner experience, 250+ M&A cyber diligence, and deep governance, engineering, and architecture capability |
| Evidence & Assurance | Governance-heavy assessments relying heavily on interviews, documentation review, and limited validation | Strong technical testing capability with more limited executive governance integration | Attacker-informed, evidence-driven assurance validations, governance oversight, operational resilience, and board-ready defensible reporting |
| Technology & Automation | Dependence on third-party tools and largely point-in-time reporting models | Select tooling with varying levels of automation and integration | Proprietary Trust Infrastructure Platforms delivering automated, continuous, and measurable trust validation rather than static assessment outputs |
| Speed & Agility | Large-scale mobilisation models with complex contracting and extended onboarding cycles | Faster delivery, but often narrower in operational scope | Rapid onboarding and operational activation with automated findings in minutes, and structured maturity assessments in days |
| Operational Continuity | Engagements typically conclude with reports and client-owned implementation responsibility | Advisory follow-through available but often resource-constrained | End-to-end operational support including Fractional CISO leadership, advisory retainers, DevSecOps integration, and CyberOne MSSP-enabled 24x7 operational capability |
Governance, engineering execution, and operational evidence — integrated.
Big digital transformation consulting and auditing firms describe how you should have secure systems. Nucleus Systems measures how secure you actually are and produces the evidence that proves it, with a clear maturity measurement and improvement roadmap.
Nucleus Systems Position StatementWhile many firms assess compliance posture, Nucleus Systems focuses on continuously measuring and proving operational trust across cybersecurity, AI governance, software assurance, and digital ecosystems.
The numbers behind the practice
Ready to make trust measurable?
Speak with a Nucleus Systems practitioner about your specific environment and objectives.
Cybersecurity Trust
& Resilience
Our Cybersecurity Maturity Management Framework & Measurement Model (NS-CMMF V1.0) helps organisations move beyond fragmented compliance towards measurable cybersecurity resilience — across cloud, enterprise, and critical infrastructure environments.
What NS-CMMF v1.0 Solves
The NS-CMMF is the most pragmatic, consultable, and regulatory-aligned cybersecurity maturity framework available for mid-market and enterprise organisations operating across multiple jurisdictions.
It addresses the single most persistent failure in cybersecurity governance: the gap between what organisations say they do and what they actually do.
Every control requires evidence of operation, not just evidence of policy. Compliance checks whether the right things are documented. NS-CMMF checks whether the right things actually work.
Framework Domains & Coverage
7 domains, 330 controls, one unified score. Each domain carries a weighted allocation — together they sum to 100% of your organisation's cybersecurity posture.
Framework Specification
NS-CMMF combines measurable cybersecurity maturity, operational assurance, and multi-framework regulatory alignment into a single integrated assessment and continuous improvement model.
Controls |
330 total controls — 270 fully re-engineered cybersecurity controls + 60 integrated AI governance controls, assessed together as one unified framework. |
Scoring Model |
5-Axis composite score per control: Policy & Governance · Implementation & Operationalisation · Monitoring & Measurement · Automation & Integration · Resilience & Assurance |
Maturity Scale |
5 defined levels with 7 Hard Scoring Gates that cannot be bypassed:
L1 Initial
L2 Developing
L3 Defined
L4 Managed
L5 Optimised
|
Framework Mapping |
32 frameworks mapped at article and clause level: NIST CSF 2.0, ISO 27001:2022, CIS Controls v8, GDPR, NIS2, DORA, EU AI Act, Cyber Resilience Act, PCI DSS v4, HIPAA, SOX, FedRAMP, CCPA, NIST SP 800-53, NERC CIP, IEC 62443, and more. |
Maturity Tool |
Excel-native and web-based assessment workbook with auto-scoring, domain heatmaps, priority gap analysis, framework filter, and board-ready report generation. |
Delivery Model |
5-phase client programme: Baseline Assessment → Gap Analysis → Improvement Roadmap → Implementation Oversight → Continuous Reassessment |
Engagement Duration |
Initial assessment2–4 weeks
Ongoing advisory retainerMonthly
Full maturity programme12–24 months
|
Services Delivered Under This Pillar
All services anchored to NS-CMMF and delivered through the Cybersecurity Maturity Platform.
Cybersecurity Maturity Assessment & Roadmap
Evidence-based baseline across all 13 domains with IC-ready outputs, scored maturity report, and prioritised improvement roadmap.
Advisory Retainer & Fractional CISO
Embedded cybersecurity leadership, board risk reporting, SOC2/ISO 27001 readiness coordination, and monthly governance rhythm.
M&A Cyber & Compliance Advisory
Buy-side/sell-side cyber diligence using attacker-validated evidence, Investment Committee evidence packs, and integration risk planning.
M&A Cyber Advisory for Seed & Pre-Series
Security foundations for pre-seed; risk validation for Seed→Series A; growth maturity for Series A→B; exit-readiness for Series B+.
DPI Cybersecurity Design, Assessment & Roadmap
NS-CMMF applied to national digital public infrastructure projects with multi-stakeholder governance and public-sector delivery expertise.
Threat, Risk & Vulnerability Assessments
Penetration testing, vulnerability assessments, and Business Exposure Management including Dark Web scanning and attack surface reduction.
CyberOne-Powered MSSP Services (Managed Detection & Response)
24x7 AI-augmented MXDR, SOC, Endpoint Security, Zero Trust, and Incident Response delivered in partnership with CyberOne.
Every service we deliver is powered
by one of these frameworks.
These are not theoretical models or static compliance checklists. They are operational trust instruments actively used in real-world delivery, engineering governance, executive reporting, and continuous assurance programmes globally.
A world where trust is no longer assumed. It is engineered, measured, and continuously proven.
As digital ecosystems become increasingly interconnected, AI-driven, software-defined, and globally regulated, organisations require more than advisory reports. They require measurable trust, defensible assurance, operational resilience, and security programmes that can continuously adapt to emerging threats, regulatory change, and evolving technology complexity.
Start your maturity assessment
A Nucleus Systems practitioner will scope the right NS-CMMF assessment tier for your organisation and produce a trust score within an agreed timeframe.
NS-AIGF v1.0
An integrated framework that simultaneously satisfies EU AI Act, ISO/IEC 42001, and NIST AI RMF obligations — consolidating fragmented compliance into a unified, evidence-based, board-ready model for continuous AI accountability.
The Nucleus Systems AI Governance Framework and Maturity Measurement Model (NS-AIGF v1.0) was purpose-built to address the single most critical governance gap of our era: organisations are deploying AI at speed while governing it at near-zero velocity.
The EU AI Act carries penalties of up to 7% of global annual turnover. ISO 42001 certification is becoming part of enterprise procurement requirements. NIST AI RMF is board-level currency across 40+ jurisdictions.
NS-AIGF converts AI governance from regulatory anxiety into a managed, auditable, board-reportable programme with measurable progress.
Framework Domains & Coverage
7 integrated governance domains, 60 controls, one unified maturity score. Each domain carries a weighted allocation reflecting EU AI Act enforcement priorities — together they sum to 100%.
Framework Specification
NS-AIGF provides a structured, measurable, and regulatory-aligned framework for operationalising AI governance, safety, security, and continuous assurance across enterprise AI ecosystems.
Controls |
60 fully defined governance controls with core requirements, implementation guidance, and regulatory alignment citations for EU AI Act, ISO 42001, and NIST AI RMF. |
Scoring Model |
5-axis maturity assessment with domain weights reflecting EU AI Act enforcement priorities: D2 Risk & Compliance at 22% (highest weight, reflecting enforcement severity) through D7 Audit at 8%. |
Maturity Scale |
L1 Initial → L2 Managed → L3 Defined → L4 Quantitative → L5 Optimising — with 300 control-specific level interpretations (5 levels × 60 controls).
L1 Initial
L2 Managed
L3 Defined
L4 Quantitative
L5 Optimising
|
Regulatory Alignment |
Simultaneous alignment to: EU AI Act (Reg. EU 2024/1689) · ISO/IEC 42001:2023 · NIST AI RMF v1.0 · GDPR · POPIA · OWASP LLM Top 10 · OECD AI Principles |
Scoping Mechanism |
20-question organisational profiler automatically tailors control applicability to each client's context, AI footprint, sector, and regulatory jurisdiction. |
Assessment Tool |
8-module AI Governance Maturity Management Excel-Native Tool producing board-ready governance reports, prioritised improvement roadmaps, ISO 42001 readiness indicators, and longitudinal maturity tracking automatically. |
Delivery Model |
5-phase programme: Baseline Assessment → Gap Analysis → Remediation Programme → Assurance Review → Continuous Reassessment (quarterly or annual) |
ISO 42001 Pathway |
Integrated 5-phase certification pathway with Nucleus Systems as advisory partner from baseline through certification readiness. |
Paxley AI Governance & Maturity Management Platform
The technology delivery engine for NS-AIGF assessments and ongoing AI governance programmes. Provides a structured AI Trust Framework assessment engine, five-level maturity scoring with domain heatmaps, a policy library aligned to the EU AI Act and NIST AI RMF, regulatory alignment modules, AI risk register management, ISO 42001 readiness tracking, and board-ready reporting. Organisations can conduct self-assessments or run Nucleus Systems-facilitated governance programmes at scale.
Services Delivered Under This Pillar
All services anchored to NS-AIGF v1.0 and delivered through the Paxley AI Governance Platform.
AI Governance Assessment & Maturity Programme
NS-AIGF assessment covering risk classification, governance gaps, and compliance posture — with board-ready AI Risk Report and 12-month roadmap.
EU AI Act Compliance Programme
End-to-end programme from Article 11 technical documentation through Article 43 conformity assessment for high-risk AI systems, with Nucleus as named advisory partner.
ISO 42001 Certification Management
Structured 5-phase certification pathway using NS-AIGF as the assessment instrument — gap analysis, remediation, and certification readiness reporting.
Board AI Risk Advisory
Translating AI risk into business and regulatory language for boards, audit committees, and investment committees — supporting AI disclosures in annual reports and regulatory filings.
Build an AI governance programme your board can stand behind
We scope NS-AIGF assessments to your current AI footprint and regulatory obligations, delivering a prioritised roadmap your board can act on.
NS-AISCA v1.0
A complete, evidence-based, maturity-scored AI security controls architecture securing the entire AI attack surface — across data, model, prompt, RAG, agent, tool, pipeline, cloud runtime, monitoring, assurance, and incident response.
The Nucleus Systems AI Security Controls Architecture (NS-AISCA v1.0) is the technical security counterpart to AI governance. It converts AI security principles, standards, threat models, and regulatory obligations into a single control-driven architecture that can be assessed, evidenced, scored, reported, and continuously improved.
NS-AISCA was built because AI security is not a single prompt filter, model test, cloud setting, or policy. It is a layered control architecture protecting the entire AI decision and action chain across classical ML, GenAI, RAG, AI APIs, autonomous agents, cloud-hosted AI services, AI-enabled products, and third-party foundation-model consumption.
Framework Domains & Coverage
12 weighted security domains, 108 controls, one unified posture score. Each domain secures a distinct layer of the AI attack surface — together they sum to 100%.
Framework Specification
NS-AISCA combines AI security architecture, adversarial testing, secure AI development, cloud runtime controls, monitoring, and continuous assurance into a single evidence-based assessment and improvement model.
Controls |
108 fully defined AI security controls across 12 weighted domains, each aligned to evidence requirements, maturity expectations, and framework mapping. |
Scoring Model |
Weighted average of domain maturity supported by automatic gap scoring, evidence-grade constraints, risk heatmaps, control failure visibility, KRIs, roadmap, and dashboard outputs. |
Maturity Scale |
L1 Initial → L2 Managed → L3 Defined → L4 Quantitative → L5 Optimising
L1 InitialL2 ManagedL3 DefinedL4 QuantitativeL5 Optimising
|
Evidence Standard |
5 evidence grades gate maturity progression:
E1 InformalE2 ManualE3 StructuredE4 System-generatedE5 Adaptive
|
Standards Alignment |
20+ standards including: EU AI Act · ISO 42001 · ISO 23894 · ISO 27001 · ISO 27090 · NIST AI RMF · NIST AI 600-1 · NIST CSF 2.0 · NIST SSDF · OWASP LLM Top 10 · MITRE ATLAS · CSA AICM · Google SAIF |
Assessment Tool |
12 domain sheets with maturity dropdowns, auto-scoring, evidence register, remediation roadmap, board dashboard, architecture patterns, and assurance outputs. |
Primary Purpose |
Secure the entire AI attack surface: data · model · prompt · RAG · agent · tool · pipeline · API · cloud runtime · monitoring · assurance · incident response |
Operating Model |
Baseline assessment → Gap analysis → Remediation planning → Independent validation → Continuous reassessment as AI systems, prompts, models, vendors, and threats change |
NS-AISCA Assessment Workbook & Operating Model
The technology delivery engine for AI security architecture assessments and continuous control improvement. Provides 12 domain assessment sheets, control-level maturity dropdowns, automatic gap scoring, evidence register, remediation roadmap, board dashboard, architecture patterns, and assurance outputs. Enables organisations to measure AI security posture across classical ML, GenAI, RAG, agentic AI, AI APIs, MLOps pipelines, and cloud AI runtime environments using a single evidence-based model.
Services Delivered Under This Pillar
All services anchored to NS-AISCA v1.0 and delivered through the AI Security Controls Architecture Assessment Platform.
AI Security Controls Architecture Assessment & Roadmap
NS-AISCA baseline across all 12 domains with AI Security Posture Score, maturity heatmap, evidence register, and prioritised remediation roadmap.
AI Threat Modelling & Secure Design Review
Threat modelling covering misuse cases, trust boundaries, abuse paths, secure reference architectures, human oversight, and design gate requirements.
LLM, Prompt, RAG & GenAI Security Assessment
Assessment of prompt injection, system-prompt protection, input/output validation, RAG authorisation, context isolation, data leakage, and GenAI telemetry controls.
Agentic AI, Tool & Autonomy Security Review
Review of agent permissions, tool registry, autonomy limits, high-impact human approvals, memory governance, credential isolation, sandboxing, and kill-switch procedures.
MLSecOps & AI Supply Chain Security Programme
Integration of AI security controls into repositories, ML pipelines, model registries, dependency scanning, SBOM/AI-BOM linkage, artifact signing, and reproducible deployment workflows.
AI Runtime, Cloud, API & Monitoring Assurance
Review of AI workload segmentation, endpoint and API security, secrets, encryption, tenant isolation, consumption controls, logging, drift monitoring, SOC integration, and KRIs.
AI Red Teaming, Incident Response & Continuous Validation
Adversarial ML testing, LLM and agent red teaming, regression testing, AI incident playbooks, rollback readiness, forensic evidence capture, and continuous reassessment.
Secure your AI systems with a defensible, evidence-based architecture
We baseline your AI security posture across all 12 domains and deliver a prioritised remediation roadmap your board can act on.
NS-CTAF v1.0
A cryptographically grounded, continuously measurable standard for software trust — ending code trust theatre and establishing a unified architecture for proving that software is trustworthy across identity, integrity, supply chain, and runtime.
NS-CTAF introduces Code Trust Assurance (CTA) as a distinct discipline — the practice of establishing, measuring, and continuously maintaining evidence-based trust in software across its full lifecycle: from developer identity and build integrity to deployment, runtime behaviour, and software supply-chain assurance.
Built for the supply-chain attack reality of 2026 — SolarWinds SUNBURST, Log4Shell, XZ Utils, Polyfill.io — where traditional scanning and compliance programmes cannot answer the trust questions now being asked by regulators, enterprise customers, investors, and acquirers.
Framework Domains & Coverage
6 integrated trust domains, 86 controls, one unified trust score. Each domain targets a critical layer of software trust exposure identified through real-world supply-chain attacks — together they sum to 100%.
Framework Specification
NS-CTAF combines cryptographic assurance, software supply chain governance, secure development maturity, and continuous operational validation into a single, measurable Code Trust Assurance model.
Controls |
86 fully defined trust controls with requirements, cryptographic grounding requirements, implementation guidance, and framework alignment citations across 30+ standards. |
Scoring Model |
5-axis maturity with domain weights reflecting supply chain risk concentration: D3 Secure Development at 22% (highest), D4 Supply Chain at 20%, D1/D2 Identity & Integrity at 18% each. |
Maturity Scale |
L1 Initial → L2 Developing → L3 Defined → L4 Managed → L5 Optimised — with 430 control-specific maturity interpretations (5 levels × 86 controls).
L1 InitialL2 DevelopingL3 DefinedL4 ManagedL5 Optimised
|
Certification Programme |
The first external software trust certification backed by a structured maturity model:
CTA-1 TransparentCTA-2 VerifiedCTA-3 AssuredCTA-4 Adaptive Trust
|
Framework Alignment |
30+ standards including: NIST SSDF SP 800-218 · SLSA · in-toto · Sigstore · OWASP SAMM · BSIMM · ISO/IEC 27001 · EU Cyber Resilience Act · US EO 14028 · NIS2 · DORA · PCI DSS v4 |
Management Tool |
Excel-native workbook with auto-scoring, 340+ improvement recommendations, certification readiness tracker, roadmap generation, and board-ready Trust Score report. |
Delivery Model |
Repository-based assessment model. First automated results in <5 minutes via Paxley. Full advisory assessment: 1–3 weeks. Ongoing continuous monitoring via the Paxley platform. |
Unique Differentiator |
The only code security framework requiring cryptographic evidence, not self-reported status. A control cannot be rated above L2 without evidence that cannot be fabricated without computational effort proportional to the security claim. |
Paxley Code Security Platform
The automated delivery engine for NS-CTAF assessments and continuous code trust monitoring. Provides SAST (15+ languages, dataflow analysis), Software Composition Analysis with CVE detection, SBOM generation in CycloneDX and SPDX formats, IaC scanning (Terraform, Kubernetes, Pulumi, CDK), container image scanning, secrets detection (200+ patterns), and policy governance — all in one unified interface. Repository-based pricing from $99/repo/month delivers a 79% cost reduction vs per-seat incumbents. First scan results in under 5 minutes. SaaS or self-hosted deployment.
Services Delivered Under This Pillar
All services anchored to NS-CTAF v1.0 and delivered with the Paxley Code Security Platform as the automated evidence layer.
Code Trust Assurance Assessment & Roadmap
NS-CTAF baseline across all 6 trust domains with automated Paxley scanning, Trust Score and Maturity Report, SBOM generation, and prioritised roadmap.
CTA Certification Programme Management
Structured pathway from CTA-1 Transparent through CTA-4 Adaptive Trust — Nucleus as advisory partner, delivering a validated software trust signal for procurement.
DevSecOps Transformation & Secure Engineering Enablement
Integration of NS-CTAF controls into CI/CD pipelines, engineering workflows, release governance, IaC security, and developer security operating models.
Virtual DevSecOps Champion Support Service
Structured retainer for organisations needing practical, independent, sustained secure SDLC leadership without committing to a full-time AppSec or product security function.
Code Security Risk Assessment
Automated repository scanning via Paxley — SAST, SCA, SBOM, IaC, container security, and secrets detection as a unified, continuous evidence layer.
M&A-Focused Code Risk Assessment
Pre-close assessment of product and supply-chain risk embedded in codebase — IP and licensing exposure identification, attacker-validated evidence for investment committees.
DPI & Digital Public Goods Code Trust Service
NS-CTAF assessment and secure development advisory for DPGs and DPI — ensuring community-built software meets regulatory and trust requirements for public-purpose digital systems.
SBOM Governance & Continuous Software Transparency
Enterprise SBOM governance, supplier software transparency assessments, continuous dependency trust monitoring, and customer-facing software trust reporting aligned to CRA, NIS2, DORA.
Open Source Software Trust & Community Governance Advisory
Governance, contributor trust validation, secure open-source release management, dependency risk governance, and cryptographic integrity assurance for open-source software ecosystems and community-led engineering environments.
Prove your software is trustworthy — cryptographically, continuously
We baseline your code trust posture across all 6 domains and deliver a roadmap from assumed confidence to verifiable, board-reportable software trust.
NS-CMMF v1.0
The most comprehensive, consultable, and regulatory-aligned cybersecurity maturity framework available — replacing fragmented compliance checklists and opaque maturity ratings with a single, evidence-based instrument for measurement and continuous improvement.
Ask any experienced CISO whether their organisation is compliant, and you'll hear 'yes'. Ask them whether it is secure, and the conversation becomes considerably more nuanced. This gap is a structural failure of frameworks relied on for more than two decades.
A single Level 3 rating for 'Endpoint Protection' can conceal an enormous range of operational realities — full-coverage behavioural EDR, automated patch management, and application allowlisting scores identically to legacy antivirus on 70% of endpoints with no formal patch process. The difference is the difference between containing a ransomware attack and losing 60% of systems before detection.
NS-CMMF addresses this through Cybersecurity Maturity Intelligence — 270 specific, auditable controls replacing broad categories, with control-level regulatory mapping at article granularity, and financial quantification of every finding.
Domain Weights & Coverage
NS-CMMF maps to the 6 NIST CSF 2.0 domains. Domain weights reflect empirical observation of where organisations actually fail under regulatory scrutiny — PROTECT carries the highest weight at 27%.
Framework Specification
NS-CMMF scores every control across five independent dimensions, applies seven non-negotiable hard gates, and maps each finding to its applicable regulatory obligations at the article level — producing an assessment that is simultaneously board-ready, audit-ready, and investment-grade.
Design · 20% |
Is the control well-designed for its intended purpose? Policy documented and reviewed within 12 months; regulatory mapping explicit; design addresses the specific threat scenario; approved by the appropriate authority. |
Coverage · 25% |
Is the control deployed across 100% of the in-scope population? Coverage ≥ 95% of in-scope assets; exceptions formally documented with named owner and expiry; scope confirmed through automated discovery. |
Operating · 25% |
Does the control operate consistently in production? 3-month operational evidence available; SLA adherence ≥ 95%; exceptions trigger formal exception process; no evidence of control bypassing or workarounds. |
Monitoring · 20% |
Is the control independently tested and validated? KPI or KRI defined and measured; annual independent test; exceptions trigger formal escalation; trend reporting active. |
Automation · 10% |
Is the control automated, self-healing, and continuously evidenced? Partial automation of evidence generation; alert on control failure; evidence does not rely entirely on manual collection. |
Framework Alignment |
32 frameworks and regulations mapped at article and section level — NIST CSF 2.0 · ISO/IEC 27001:2022 · CIS Controls v8 · GDPR · NIS2 · DORA · Cyber Resilience Act · HIPAA · SOX · PCI DSS v4 · FedRAMP · EU AI Act · NIST AI RMF · ISO 42001 · OWASP LLM Top 10 · IEC 62443 and more. |
Hard Scoring Gates |
Seven non-negotiable ceiling constraints prevent any composite score from exceeding a defined level regardless of the five-axis score:
No owner → Max L2
No 3-month evidence → Max L3
No KPI/KRI → Max L4
No automation → Max L5
Reg obligation unmet → Max L2
Interview-only evidence → Max L2
Attestation-only → Max L1.5
|
Assessment Tool |
Excel-native workbook with auto-scoring, 1,350 auto-generated recommendations (5 per control × 270 controls), priority roadmap auto-sorted by Gap × Domain Weight, 32-framework filter for instant regulatory evidence packaging, 44-row assessment history for longitudinal tracking, and 200-row evidence register with expiry management. |
Delivery Model |
10–12 business day engagement from scoping to final delivery. 188+ stakeholder interviews across CISO, CTO, DPO, Head of IT, AppSec, Cloud, and OT leads. Deliverables: scored assessment tool, regulatory exposure matrix, prioritised 12-month roadmap, board presentation, and 32-framework compliance reports. |
AI, Cloud & OT — Natively Addressed
Legacy frameworks respond to new threats at the pace of their governance committees — typically 3–5 years between major updates. NS-CMMF was built from the ground up for today's attack landscape, not retrofitted from a 2018 baseline.
What an NS-CMMF Assessment Produces
The output is not a report — it is an evidence base, a precision roadmap, and a financial model that any board member, regulator, or investor committee can act on directly.
Board-Ready Maturity Score
A weighted overall score defensible before a board audit committee — based on specific, documented evidence at the control level, not a traffic-light dashboard. A board member who asks "how do we know this control works?" gets directed to 3-month operational evidence and KPI trend data.
Regulatory Evidence Packages
The 32-framework filter generates instant regulatory evidence packages. When a regulator requests DORA ICT risk management capability evidence, the package for all DORA-mapped controls is immediately available — assembled during the assessment, not reconstructed under time pressure.
Prioritised Improvement Roadmap
1,350 auto-generated recommendations sorted by Priority Score (Gap × Domain Weight). A control currently at L2 receives the L2→L3 recommendation — not generic advice to 'improve'. Each recommendation includes effort estimate, target quarter, owner assignment, and status tracking.
Longitudinal Assessment History
44-row assessment history providing a board-presentable, audit-ready evidence trail demonstrating consistent security programme maturity over 3–5 years of quarterly or semi-annual assessments — one of the most compelling evidence artefacts in regulatory investigations and M&A due diligence.
Cybersecurity Maturity Platform
Purpose-built for continuous NS-CMMF assessment, scoring, and executive reporting. Turns point-in-time audits into a live maturity index that boards can track and regulators will accept. Auto-populates the roadmap from assessment findings, generates 32-framework regulatory evidence packages on demand, tracks evidence expiry through a 200-row evidence register, and produces board-ready reports with a single export.
Move from checkbox compliance to measurable, defensible security maturity
We assess your posture across all 270 controls, produce a precision roadmap, and deliver regulatory evidence packages your team can act on immediately.
NS-AIGF v1.0
A proprietary, structured, and automation-ready approach to AI governance for organisations deploying, developing, or procuring AI in regulated and high-impact environments — replacing fragmented compliance efforts and aspirational governance with a single, evidence-based, board-ready model for continuous AI accountability.
For most of the past decade, organisations deploying AI have operated on a fundamentally flawed premise: that having an AI ethics policy, a responsible AI statement, and a risk committee that meets quarterly constitutes AI governance. It does not. It constitutes AI governance theatre — the appearance of accountability without the operational substance that accountability requires.
That world is over. The EU AI Act entered into force in August 2024. ISO/IEC 42001, the world's first AI Management System standard, was published in December 2023. Regulators across 40+ countries reference the NIST AI RMF. AI governance is no longer an ethical aspiration — it is a regulatory obligation.
NS-AIGF v1.0 was designed from first principles as a purpose-built AI governance architecture for this regulatory environment. Every control was designed through four lenses: specificity (one auditable requirement per control), regulatory alignment (specific article or clause mapping), evidence clarity (what adequate evidence looks like at L1–L5), and maturity differentiation (distinct criteria distinguishing ad hoc intent from automated, continuously validated governance).
Domain Weights & Coverage
7 weighted governance domains across 60 controls. Domain weights reflect EU AI Act enforcement priorities and ISO 42001 certification requirements — not arbitrary allocation. D2 Risk Classification carries the highest weight because getting AI risk classification right is the prerequisite for all other compliance obligations.
Framework Specification
NS-AIGF v1.0 replaces voluntary principles with 60 specific, auditable controls — each with 300 control-specific maturity interpretations, a 5-level maturity scale, and simultaneous alignment to the EU AI Act, ISO/IEC 42001, and NIST AI RMF at the article and clause level.
Controls |
60 fully defined governance controls across 7 weighted domains — each addressing one auditable governance requirement with specific evidence standards at every maturity level. 300 control-specific interpretations eliminate assessor-dependent scoring. |
Maturity Scale |
L1 Initial (ad hoc, no structured evidence) → L2 Managed (manual, partially defined) → L3 Defined (standardised, repeatable — baseline for EU AI Act compliance and ISO 42001 certification readiness) → L4 Quantitative (automated, metrics-driven) → L5 Optimising (self-improving, predictive).
L1 InitialL2 ManagedL3 DefinedL4 QuantitativeL5 Optimising
|
Framework Alignment |
Every control maps simultaneously to all applicable frameworks at the specific article, clause, and function level: EU AI Act (Articles 9–14, 43, 50, 73) · ISO/IEC 42001 (§4–§10) · NIST AI RMF (GOVERN, MAP, MEASURE, MANAGE functions). One control satisfies obligations across all three frameworks from a single evidence base. |
ISO 42001 Pathway |
Completing an NS-AIGF v1.0 assessment simultaneously completes a pre-certification readiness assessment. The ISO 42001 Readiness module maps domain scores directly to §4–§10 clauses and calculates a gap-to-certification score — the assessment IS the gap analysis. One improvement programme serves EU AI Act compliance, NIST AI RMF alignment, and ISO 42001 certification simultaneously. |
Scoring Formula |
Domain maturity scores = mean of all in-scope control scores within the domain. Overall score = sum of domain scores × domain weights. Priority Score = Gap × Domain Weight — a control in D2 with a 3-level gap scores 0.66; the same gap in D7 scores 0.24. Roadmap auto-sorts by priority to direct governance investment where it reduces the most risk. |
Assessment Tool |
Eight interconnected modules: 20-question Scoping Module (auto-applies control applicability logic), 7 Domain Assessment Modules, auto-generated Board Report, Prioritisation Engine, Evidence Register (collection date, expiry date, owner, status), ISO 42001 Readiness module, and Assessment History for longitudinal maturity tracking across multiple cycles. |
Delivery Model |
Structured engagement delivering 60-control baseline assessment, domain maturity scores, board governance report, prioritised improvement roadmap, ISO 42001 readiness indicator, and regulatory evidence packages per framework. Continuous reassessment cadence recommended quarterly for high-priority controls. |
The Operational Controls Principles Cannot Replace
The controls most consistently absent from enterprise AI governance programmes are not strategic — they are operational, technical, and specific. And they are the ones regulators are actively enforcing.
AI Inventory Ownership
A complete register of every AI system deployed, consumed, or integrated across the enterprise — with a named owner accountable for each system's governance compliance. Almost universally missing despite its fundamental importance. At L4, auto-updated through deployment pipeline integrations.
Prohibited Use Controls
Technical and procedural controls that actively prevent the 6 EU AI Act banned AI categories from reaching production — social scoring, real-time biometric surveillance, subliminal manipulation, emotional inference in workplaces. At L4, embedded in deployment pipelines and fire automatically.
Rollback Capability
When a model begins producing incorrect, biased, or harmful outputs in production, the organisation needs the ability to revert to a prior known-good version rapidly. Consistently one of the least mature and most consequential controls in initial assessments. The difference between L2 and L3 here could be the difference between a contained incident and a sustained public AI failure.
Shadow AI Detection
A significant proportion of AI usage in organisations with 100+ employees occurs without IT or governance awareness — ChatGPT, Copilot, Claude, and dozens of vertical-specific tools processing sensitive customer data, proprietary information, or regulated health records without DLP controls or audit trails. At L4, detection is continuous through CASB and network monitoring.
Data Drift Detection
Automated monitoring to detect when the statistical distribution of production data has drifted significantly from the training distribution — causing well-validated models to produce degraded, unreliable, or unsafe outputs silently over time. EU AI Act Art. 9 requires post-market monitoring. This is the technical mechanism through which that obligation is operationalised.
Prompt Injection Defence
OWASP LLM Top 10 #1 — consistently absent or immature in organisations deploying large language models. Prompt injection attacks override model instructions via malicious inputs, causing models to disclose confidential information, ignore safety guardrails, or perform actions outside their intended scope. At L4, automated testing is integrated into the deployment lifecycle.
AI Governance Maturity Assessment Tool
The delivery vehicle for NS-AIGF v1.0 — transforming a governance evaluation into a living management system. Eight interconnected modules automatically generate board-ready governance reporting, a prioritised improvement roadmap, ISO 42001 certification readiness indicators, and longitudinal maturity tracking across assessment cycles. The board report translates maturity scores into governance health narrative that audit committees can act on directly. The evidence register tracks every governance artifact with collection date, expiry date, owner, and status — transforming a week-long audit preparation exercise into a dashboard query. The governance programme generates management intelligence as a natural output of operations rather than as a separate, expensive reporting effort.
End AI governance theatre — permanently
We assess your AI governance posture across all 60 controls, identify your highest-priority gaps, and build you the board-ready, regulator-ready evidence infrastructure that genuine AI accountability requires.
NS-AISCA
Nucleus Systems AI Security Controls Architecture. A comprehensive technical security framework for AI systems, models, pipelines and infrastructure.
Version 1.1.0 · 2026Design philosophy
NS-AISCA addresses a gap that most cybersecurity frameworks do not cover: the security of AI systems as technical artefacts. General cybersecurity frameworks (ISO 27001, NIST CSF) treat AI systems like any other IT asset. They are not. AI models have unique attack surfaces, adversarial inputs, training data poisoning, model extraction, hallucination exploitation and agentic autonomy risks, that require specialised security controls.
NS-AISCA defines 108 controls spanning 12 domains, organised to cover the full AI system lifecycle from data ingestion through model training, deployment, monitoring and decommissioning. It is the technical counterpart to NS-AIGF's governance layer.
Threat model coverage
Domain coverage
Data Security & Integrity
Training data validation, poisoning detection, data provenance and pipeline integrity controls.
Model Security
Model file integrity, access controls, serialisation security and model registry governance.
Adversarial Robustness
Input validation, adversarial testing, evasion attack resistance and robustness benchmarking.
LLM & GenAI Security
Prompt injection prevention, output validation, system prompt security and hallucination risk controls.
Agentic AI Security
Agent boundary controls, tool use authorisation, autonomy constraints and multi-agent trust architecture.
MLOps & Pipeline Security
CI/CD pipeline security for ML, experiment tracking security, model versioning controls and deployment governance.
Infrastructure Security
GPU/TPU security, inference endpoint hardening, API security and compute isolation.
Privacy & Inference Attacks
Membership inference defences, model inversion prevention, differential privacy implementation and data minimisation.
Supply Chain Security
Third-party model vetting, pre-trained model integrity, dataset provenance and open-source AI component risk.
Monitoring & Detection
Runtime anomaly detection, model drift monitoring, adversarial input detection and security telemetry.
Incident Response
AI-specific incident classification, model rollback procedures and post-incident forensic analysis.
Compliance & Assurance
OWASP ML Top 10 alignment, MITRE ATLAS mapping and regulatory reporting for AI security incidents.
Apply NS-AISCA to your AI systems
Book an NS-AISCA scoping call to define which domains are most relevant to your current AI deployment and threat model.
NS-CTAF
Nucleus Systems Code Trust Assurance Framework. A structured certification model for software trustworthiness across the full development and delivery lifecycle.
Version 2.0.1 · 2026Design philosophy
NS-CTAF was built on the premise that trust in software must be established at the point of creation and continuously maintained through every change. It defines 86 controls across 6 trust domains, covering source code integrity, dependency trust, CI/CD pipeline security, SBOM governance, open-source risk and AI-assisted code, and introduces a four-tier certification model (CTA-1 through CTA-4) that allows organisations to communicate code trust levels to internal and external stakeholders.
The Paxley platform is the primary delivery vehicle for NS-CTAF, scanning every commit, PR and release against the framework's control definitions and maintaining a live Code Trust Score.
Certification tiers
| Tier | Definition |
|---|---|
| CTA-1 | Foundational code trust, basic security hygiene, secrets scanning, known vulnerability prevention |
| CTA-2 | Structural trust, dependency governance, SBOM management, licence compliance, signed commits |
| CTA-3 | Pipeline trust, CI/CD security, container image hardening, IaC security, deployment integrity |
| CTA-4 | Advanced trust, AI-assisted code security, supply chain integrity, provenance attestation, adversarial code testing |
Domain coverage
Source Code Integrity
Secrets scanning, SAST, code signing, commit attribution and malicious code pattern detection.
Dependency & Supply Chain Trust
SCA, SBOM generation, dependency pinning, licence compliance and open-source risk scoring.
CI/CD Pipeline Security
Pipeline hardening, workflow integrity, runner security, artefact signing and deployment controls.
Container & Infrastructure Security
Container image scanning, IaC security, registry trust and runtime environment integrity.
AI-Assisted Code Trust
AI-generated code security assessment, copilot policy governance, AI code review and hallucination risk controls.
Governance & Assurance
Security policy enforcement, developer security training, audit trail management and Code Trust Score reporting.
Certify your software supply chain
Start with a Paxley demo to see NS-CTAF controls in action, or request a scoping call for a standalone code trust assessment.
The code security platform that enforces trust at every commit, from your first repository to your thousandth agentic AI workflow.
Paxley for Code Trust
GitHub-native scanning across every commit, pull request and release. Continuous NS-CTAF control enforcement, SBOM management, dependency governance and CTA-1 to CTA-4 certification scoring.
Paxley for AI Governance
Continuous NS-AIGF control monitoring for AI systems in production. Audit trails, governance dashboards, EU AI Act compliance tracking and board-level AI trust reporting.
What makes Paxley different
Built on Nucleus Systems proprietary frameworks, not generic rulesets.
NS-CTAF & NS-AIGF enforced
Every scan maps directly to Nucleus Systems proprietary control frameworks, not commodity SAST rules.
GitHub-native
Installs as a GitHub App. Scans every PR and commit in context. No agent to deploy, no pipeline to maintain.
Repo-based pricing
Priced per repository, not per developer. Security costs scale with your codebase, not your team size.
Continuous trust scoring
Live Code Trust Score across all repositories. Track improvement over time. Report to boards and auditors.
SBOM & dependency governance
Automatic SBOM generation, dependency health scoring, licence compliance and open-source risk tracking.
Hybrid deployment
SaaS or self-hosted. Data residency options. Designed for enterprises with strict infrastructure requirements.
Supported frameworks
Paxley operationalises Nucleus Systems proprietary frameworks at the point of development.
Ready to see Paxley in action?
Book a 30-minute demo with a Nucleus Systems practitioner. We'll show you Paxley running against your own repositories.
Cybersecurity Maturity Platform
The purpose-built platform for delivering, scoring and tracking NS-CMMF cybersecurity maturity assessments at enterprise scale.
Built to deliver NS-CMMF, not adapted from a generic tool
The Cybersecurity Maturity Platform is the operational engine for Core Pillar 1. It implements all 188 NS-CMMF controls as structured assessment modules, calculates domain scores using the 5-axis model, produces board-ready trust scores and generates remediation roadmaps automatically from assessment findings.
The platform enables continuous assessment rather than point-in-time audits, so organisations can track maturity improvement between assessments, monitor regression risks and benchmark against sector-specific maturity targets.
Key capabilities
- 188-control NS-CMMF assessment engine
- 5-axis scoring per control (Policy, Process, Technology, People, Measurement)
- Domain-level and aggregate trust score calculation
- Industry benchmark comparison
- Automated remediation roadmap generation
- Board-level executive reporting suite
- Multi-period trend tracking and maturity progression charts
- Evidence management and audit trail
See the platform in action
Request a platform walkthrough or book an NS-CMMF scoping call with a Nucleus Systems practitioner.
AI Security Assessment Platform
The structured assessment and reporting platform for delivering NS-AISCA evaluations across AI systems, pipelines and infrastructure.
Structured assessment for AI security findings
The AI Security Assessment Platform operationalises all 108 NS-AISCA controls as structured assessment modules. Assessors use the platform to evaluate controls across all 12 security domains, with each finding automatically categorised by severity, domain, control ID and remediation effort.
The platform produces findings reports, risk-scored remediation roadmaps and executive summaries aligned to technical and board audiences. It supports both point-in-time assessment engagements and ongoing monitoring programmes.
Key capabilities
- 108-control NS-AISCA assessment engine
- 12-domain security coverage with severity scoring
- Automated remediation roadmap generation
- MITRE ATLAS & OWASP ML Top 10 cross-mapping
- Technical findings report and executive summary
- Multi-engagement trend tracking
- Agentic AI and GenAI-specific assessment modules
Assess the security of your AI systems
Book a scoping call to define which NS-AISCA domains are most relevant to your current AI environment.
Managed Detection & Response
24/7 managed detection, investigation and response services delivered in partnership with CyberOne, one of Africa's leading MSSP providers, underpinned by the NS-CMMF framework.
Continuous threat detection backed by NS-CMMF maturity
Nucleus Systems partners with CyberOne to deliver managed detection and response services that go beyond standard MSSP tooling. Every MDR engagement is anchored to the NS-CMMF framework, so detected threats are contextualised against the client's actual maturity posture, not a generic baseline.
This integration means that when a threat is detected and responded to, the findings inform the client's broader cybersecurity maturity programme. Detection events become data points in continuous improvement rather than isolated incidents.
Technology & standards
Services included
- 24/7 Managed Security Operations Centre (SOC)
- Threat Detection & Correlation (SIEM/SOAR)
- Endpoint Detection & Response (EDR/XDR)
- Threat Hunting & Proactive Investigation
- Security Incident Management & Response
- Vulnerability Management & Prioritisation
- Threat Intelligence Integration
- NS-CMMF Maturity Integration for Detection Context
- Monthly Threat & Posture Reporting
- Incident Response Retainer
Get continuous threat detection backed by maturity intelligence
Contact us to scope an MDR engagement that integrates with your NS-CMMF maturity programme.
Payment Security & Digital Public Infrastructure
Security advisory and assurance for payment systems, real-time payment infrastructure and digital public infrastructure, with specialist expertise in Mojaloop, Tazama and COMESA frameworks.
Payment security at the infrastructure layer
Nucleus Systems has deep specialist expertise in the security of digital payment infrastructure, particularly open-source payment systems and digital public infrastructure (DPI) frameworks deployed across Africa, Asia and the Middle East. Our practitioners have direct experience with Mojaloop (the real-time payments platform), Tazama (transaction monitoring) and the COMESA framework.
We combine payment-specific security expertise with our NS-CMMF maturity methodology to deliver security assessments that address both technical vulnerabilities and institutional governance gaps.
Technology & standards expertise
Services included
- Payment System Security Assessment (PCI DSS, ISO 20022)
- Mojaloop Platform Security Review
- Tazama Transaction Monitoring Security Assessment
- Digital Public Infrastructure (DPI) Security Advisory
- Real-Time Payment System Security Architecture
- Financial Crime & Fraud Risk Assessment
- SWIFT Customer Security Programme (CSP) Assessment
- Central Bank Digital Currency (CBDC) Security Advisory
- Payment API Security Assessment
- Correspondent Banking Security Review
Secure your payment infrastructure
Speak with a Nucleus Systems payments security specialist about your specific infrastructure and regulatory obligations.
Verifiable Credentials & Digital Identity Security
Security advisory and assurance for digital identity systems, verifiable credential infrastructure and national identity programmes, with expertise in MOSIP, OpenG2P, GovStack and OSIA.
Securing the infrastructure of trust for digital identity
National digital identity programmes are among the most sensitive and highest-risk digital transformation initiatives any government undertakes. Nucleus Systems brings specialist expertise in the security of identity platforms, particularly open-source DPI stacks such as MOSIP (Modular Open Source Identity Platform) and OpenG2P, and in the verifiable credential ecosystems being deployed across Africa, Asia and the Pacific.
Our engagement model combines security assessment, architecture review and ongoing advisory to ensure that identity programmes are secure from inception, compliant with international standards and resilient to the specific threat models that national identity infrastructure attracts.
Technology & standards expertise
Services included
- Digital Identity Security Architecture Review
- MOSIP Platform Security Assessment
- OpenG2P Security Review
- Verifiable Credential System Security Assessment
- Decentralised Identity (DID) Infrastructure Review
- Biometric System Security Assessment
- National ID Programme Security Advisory
- eIDAS 2.0 Compliance Advisory
- Identity Proofing & Verification Process Review
- Privacy-Preserving Identity System Design
Secure the infrastructure that underpins digital identity
Speak with a Nucleus Systems digital identity specialist about your programme and risk environment.
Financial Inclusion & Emerging Markets
Security and trust assurance for financial services providers operating in emerging markets, mobile money, off-grid payments, microfinance and inclusive fintech ecosystems.
Trust infrastructure for the next billion users
Financial inclusion requires security inclusion. Mobile money operators, microfinance institutions, agent banking networks and fintech platforms serving unbanked and underbanked populations face security and regulatory challenges that are distinct from those of established financial institutions. They operate at the intersection of fintech innovation, telecoms infrastructure and regulatory uncertainty, often with limited internal security capacity.
Nucleus Systems brings practitioner experience across sub-Saharan Africa, East Africa, West Africa, South-East Asia and the Pacific, with deep familiarity with the mobile money ecosystem, the regulatory frameworks that govern it and the specific threat models that emerging-market financial services providers face.
Market expertise
Services included
- Mobile Money Platform Security Assessment
- Agent Banking Network Security Review
- Off-grid & Last-Mile Payment Security Advisory
- Microfinance Institution Security Programme
- Financial Inclusion Fintech Security Assessment
- GSMA Mobile Money Security Guidelines Compliance
- Regulatory Readiness Assessment (emerging market)
- Digital Financial Services Risk Framework Design
- Fraud & Social Engineering Risk Assessment
- Digital Onboarding & KYC Security Review
Build trust infrastructure for financial inclusion
Our practitioners bring first-hand experience in emerging market financial services security across multiple continents.
Post-Quantum Cryptography Advisory
Preparing enterprises and governments for the quantum threat, cryptographic inventory, PQC readiness assessment, CBOM analysis, crypto agility design and migration roadmaps aligned to NIST PQC standards.
The quantum clock is running. Most organisations are not ready.
NIST finalised the first post-quantum cryptography standards in 2024. Cryptographically Relevant Quantum Computers (CRQCs) may be capable of breaking current public-key cryptography within a decade. Harvest-now-decrypt-later attacks, where adversaries collect encrypted data today to decrypt once quantum capability arrives, are already documented.
Nucleus Systems provides the advisory capability organisations need to understand their cryptographic exposure, build a credible migration roadmap and implement crypto agility architectures that can adapt as the quantum threat evolves. We work across enterprise, government and financial services sectors, with particular focus on organisations that manage long-lived sensitive data or critical infrastructure.
Standards & frameworks
Services included
- PQC Readiness Assessment
- Cryptographic Bill of Materials (CBOM) Analysis
- Cryptographic Inventory & Risk Mapping
- Harvest-Now-Decrypt-Later Threat Assessment
- Crypto Agility Architecture Design
- NIST PQC Standards Migration Roadmap
- TLS & PKI Infrastructure PQC Readiness Review
- Long-lived Data Encryption Risk Assessment
- PQC Vendor & Product Evaluation
- Executive PQC Briefing & Board Reporting
Start your PQC readiness programme now
The time to prepare is before quantum capability arrives, not after. Contact us to scope a CBOM analysis or PQC readiness assessment.