Security control assessment and policy generation

The challenge

Preparing for frameworks such as NIST 800-53 or CMMC means reading large volumes of system documentation and mapping it to hundreds of controls. The work is slow, inconsistent between assessors, and hard to trace back to evidence.

What we built

The service receives jobs from AWS SQS and stores artefacts in S3 and Postgres. Pipelines extract and chunk uploaded documents, tag chunks to control and CMMC practice identifiers, and evaluate control implementation with a configurable LLM provider (Bedrock, OpenAI or a self-hosted model). A policy generator drafts framework-aligned documents and appends a references section listing the source chunks and similarity scores used. A recommendation stage enriches plan-of-action entries with weakness descriptions, remediation steps and risk ratings. LLM interactions are logged and traced, and deployment is handled through Helm values and per-environment workflows.

Key capabilities

• Control evaluation against NIST 800-53 style frameworks
• Document chunking and tagging to CMMC practices
• Policy generation with a source-reference section and relevance scores
• LLM enrichment of plan-of-action and milestone entries
• Provider-switchable LLM client with token accounting and interaction logs
• Asynchronous job processing with task status tracking

What it delivers

• Compliance conclusions can be traced to specific source document chunks
• Assessment work is split into resumable, queue-driven jobs rather than manual review
• The LLM provider can be changed by configuration without rewriting pipelines
• Remediation entries are produced in a consistent structure for reviewer sign-off