GIAP™ — Multi-Agent GRC Automation Platform¶

Updated: January 9, 2026

End-to-End Workflow¶

GIAP™ implements a two-phase workflow with a clear deposit gate separating pre-engagement qualification from paid consulting work. CISO Assistant serves as the single GRC platform for both phases — API-first with 100+ framework mappings.

flowchart TB
    subgraph PRE["PRE-ENGAGEMENT"]
        direction TB
        P["Prospect"]
        PIF["Pre-Intake"]
        CA["CISO Assistant"]
        QG["Gap Analysis"]
        FS["Framework Fit"]
        RP["Risk Profile"]
        CRM["SuiteCRM"]
        DS["DocuSeal"]

        P --> PIF --> CA
        CA --> QG
        CA --> FS
        CA --> RP
        QG --> CRM
        FS --> CRM
        RP --> CRM
        CRM --> DS
    end

    DG["DEPOSIT GATE"]

    subgraph POST["POST-ENGAGEMENT"]
        direction TB
        CA2["CISO Assistant"]
        RM["Risk Register"]
        CT["Control Testing"]
        NC["Nextcloud"]
        POA["POAM Agent"]
        REM["Remediation"]
        VCISO["vCISO Cycle"]

        CA2 --> RM
        CA2 --> CT
        RM --> NC
        CT --> NC
        NC --> POA
        POA --> REM --> VCISO
    end

    DS --> DG
    DG --> CA2
    VCISO -.-> CA2

    style PRE fill:#e8f4ea,stroke:#2e7d32,stroke-width:2px
    style POST fill:#e0f2fe,stroke:#0284c7,stroke-width:2px
    style DG fill:#fff3e0,stroke:#ef6c00,stroke-width:3px

Platform Roles¶

Why Single GRC Platform?¶

Architecture Overview¶

GIAP™ is a streamlined GRC automation platform with n8n orchestration and a single GRC platform (CISO Assistant):

flowchart TB
    subgraph EDGE[EDGE LAYER]
        CF[Cloudflare DNS/WAF]
        NPM[Nginx Proxy Manager]
    end

    subgraph UI[PRESENTATION LAYER]
        PORTAL[Intake Portal v2.2]
    end

    subgraph ORCH[ORCHESTRATION LAYER]
        N8N[n8n Workflows]
        RESEND[Resend API]
    end

    subgraph DATA[DATA LAYER]
        direction LR
        CA[CISO Assistant]
        CRM[SuiteCRM]
        NC[Nextcloud]
        DS[DocuSeal]
    end

    CF --> NPM
    NPM --> PORTAL
    NPM --> N8N
    PORTAL -->|HMAC Webhook| N8N
    N8N --> CA
    N8N --> CRM
    N8N --> NC
    N8N --> DS
    N8N --> RESEND

    style EDGE fill:#fef2f2,stroke:#dc2626,stroke-width:2px
    style UI fill:#f3e8ff,stroke:#7c3aed,stroke-width:2px
    style ORCH fill:#fef3c7,stroke:#d97706,stroke-width:2px
    style DATA fill:#e0f2fe,stroke:#0284c7,stroke-width:2px

n8n Workflow Pipeline¶

Working Workflow: GIAP Intake Simple¶

The first n8n workflow is operational and logging intake submissions to Nextcloud:

flowchart TD
    subgraph WORKFLOW["GIAP Intake Simple Workflow"]
        direction LR
        A["Portal v2.2"]
        B["n8n"]
        C["Nextcloud WebDAV"]
    end
    D["Log File"]

    A -->|"POST /webhook/giap-simple"| B
    B -->|"HTTP Request PUT"| C
    C -->|"Output: /GIAP-Intakes/....json"| D

    style C fill:#f9f,stroke:#333,stroke-width:2px
    style D fill:#bbf,stroke:#333,stroke-width:2px

Verified: End-to-end test successful (2025-12-31). Intake JSON files automatically created in Nextcloud GIAP-Intakes/ folder.

Data Flow¶

flowchart TB
    subgraph PRE["PRE-ENGAGEMENT"]
        direction TB
        PORTAL["Intake Portal"] --> N8N1["n8n: Intake"]
        N8N1 --> NC1["Nextcloud JSON"]
        N8N1 --> CRM["SuiteCRM Lead"]
        N8N1 --> RESEND1["Resend: Notification"]
        CRM --> DS["DocuSeal"]
        DS --> N8N2["n8n: Signed Callback"]
        N8N2 --> RESEND2["Resend: Confirmation"]
    end

    DG["DEPOSIT GATE"]

    subgraph POST["POST-ENGAGEMENT"]
        direction TB
        CA["CISO Assistant"] --> N8N3["n8n: Assessment"]
        N8N3 --> NC2["Nextcloud Evidence"]
        NC2 --> POA["POAMAgent"]
        POA --> REM["Remediation"]
        REM --> VCISO["vCISO Cycle"]
    end

    DS --> DG
    DG --> CA
    VCISO -.-> CA

    style PRE fill:#e8f4ea,stroke:#2e7d32,stroke-width:2px
    style POST fill:#e0f2fe,stroke:#0284c7,stroke-width:2px
    style DG fill:#fff3e0,stroke:#ef6c00,stroke-width:3px

POAMAgent — Custom POA&M Generator¶

No dedicated open-source POA&M generator exists. For a boutique consulting firm, custom tooling is the right choice:

POAMAgent Capabilities¶

# POAMAgent outputs
poam_agent = {
    "inputs": ["ciso_assistant_gaps", "aam_unified_controls", "client_context"],
    "outputs": {
        "executive_summary": "1-page risk overview (PDF)",
        "detailed_poam": "Full remediation plan with milestones (MD/CSV/PDF)",
        "task_export": "Task list for remediation tracking (JSON)"
    },
    "templates": "Jinja2 → Markdown → WeasyPrint PDF",
    "branding": "AAM Cyber deliverable format"
}

Implementation Scope¶

Future: MCP Integration¶

GIAP™ can integrate with Claude and other AI assistants via Model Context Protocol (MCP) for natural language queries against GRC data:

Example Conversation¶

User: New prospect came in — healthcare practice, 25 employees, M365 + on-prem EHR.
      Quick assessment before our sales call?

Claude: [Reads giap://controls/frameworks/hipaa/quick-assessment]
        [Reads giap://controls/frameworks/soc2/quick-assessment]

Quick Assessment for Healthcare Practice:

Recommended Frameworks: HIPAA (required), SOC 2 (recommended for vendors)

Likely Gaps (based on profile):
- §164.312(a) Access Control — EHR access reviews needed
- §164.308(a)(1) Risk Analysis — Likely missing formal risk assessment
- CC6.2 Logical Access — M365 MFA status unknown

Suggested Engagement: HIPAA Security Rule assessment + SOC 2 readiness
Estimated Scope: 40-60 hours

Ready to create intake in SuiteCRM?

Technology Stack¶

CISO Assistant — Single GRC Platform¶

CISO Assistant serves as the single GRC platform for both pre-engagement and post-engagement work:

Why CISO Assistant over Eramba CE?

Framework Coverage¶

CISO Assistant provides 100+ pre-loaded frameworks with auto-mapping. Current implementation depth for GIAP™ intake workflows:

HIPAA Coverage¶

GIAP™ supports HIPAA Security Rule and Privacy Rule compliance for healthcare clients and business associates:

Industry Profiles¶

GIAP™ intake schema includes jurisdiction-aware, industry-specific modules with auto-detected compliance requirements:

PropTech/IoT Compliance (Emerging Use Case)¶

GIAP™ extends to PropTech and IoT vendor compliance — an emerging challenge for regulated workspaces operating in smart buildings or residential environments:

PropTech Compliance Workflow:

flowchart LR
    subgraph INTAKE[VENDOR INTAKE]
        VI[Vendor Info]
        PP[Privacy Policy]
        TC[Technical Capabilities]
    end

    subgraph ANALYSIS[GAP ANALYSIS]
        CR[Control Requirements]
        GA[Gap Assessment]
        RS[Risk Score]
    end

    subgraph OUTPUT[DECISION]
        RM[Risk Memo]
        ER[Exception Request]
        ET[Evidence Trail]
    end

    VI --> CR
    PP --> GA
    TC --> GA
    CR --> GA
    GA --> RS
    RS --> RM
    RS --> ER
    RM --> ET
    ER --> ET

    style INTAKE fill:#e8f4ea,stroke:#2e7d32
    style ANALYSIS fill:#fff3e0,stroke:#ef6c00
    style OUTPUT fill:#e0f2fe,stroke:#0284c7

Why this matters: Remote work and regulated home offices are increasing. Smart building technology creates compliance conflicts that traditional GRC tools don't address. GIAP™ provides a structured approach to vendor risk assessment for IoT deployments.

AAM Unified Controls¶

Proprietary control framework that normalizes intake responses and maps to all supported frameworks:

framework: AAM-Custom-GRC
client: Healthcare Practice A
version: 1.0
controls:
  - id: AAM.ACCESS-01
    status: partial
    notes: Offboarding not documented
    frameworks:
      SOC2: CC6.2
      NIST-CSF: PR.AC-1
      CISv8: 6.2
      HIPAA: §164.312(a)(1)

Control Mapping Examples¶

Target Metrics¶

Metrics represent design targets based on architecture specifications.

vCISO Continuous Compliance¶

GIAP™ supports 90-day recurring assessment cycles for vCISO engagements:

1. CISO Assistant → Delta assessment questionnaire, control re-testing
2. n8n Workflow → Trigger assessment, collect evidence, update records
3. Nextcloud → Evidence vault updates
4. POAMAgent → Updated POA&M (new gaps vs. closed items)
5. SuiteCRM → Timestamped audit trail, billing trigger

Business Impact: Enables recurring vCISO engagements with automated quarterly reviews and continuous compliance monitoring.

Implementation Status¶

Security Architecture¶

Portal Security Hardening (v2.2)¶

The intake portal underwent comprehensive security hardening with expert panel review:

Code Sample — Security Implementation:

// XSS Prevention - strips HTML tags to prevent injection
const stripHtml = (str) => {
  if (typeof str !== "string") return "";
  return str.replace(/<[^>]*>/g, "").trim();
};

// RFC 5322 compliant email validation
const isValidEmail = (email) => {
  const emailRegex = /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(?:\.[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
  return emailRegex.test(email) && email.length <= 254;
};

// Rate limiting - 5 second throttle prevents form spam
let lastSubmission = 0;
const THROTTLE_MS = 5000;

// Honeypot - fake success for bots filling hidden field
if (error === "HONEYPOT") {
  showAlert("Thank you! Your request has been submitted.", "success");
  return; // Don't actually submit
}

Webhook Authentication (HMAC-SHA256)¶

Portal-to-n8n webhook communication uses HMAC-SHA256 signature verification to ensure request authenticity, payload integrity, and replay prevention:

sequenceDiagram
    participant P as Portal
    participant N as n8n Webhook

    P->>P: Build payload
    P->>P: Get timestamp (epoch ms)
    P->>P: Compute HMAC-SHA256
    P->>N: POST with X-GIAP-Timestamp and X-GIAP-Signature headers
    N->>N: Extract timestamp and signature
    N->>N: Recompute HMAC with same secret
    N->>N: Compare signatures
    N->>N: Verify timestamp less than 5 min old
    alt Valid
        N->>N: Process request
    else Invalid
        N->>P: Reject 401
    end

Attack Prevention:

Code Sample — HMAC Signature Generation:

// Generate HMAC-SHA256 signature for webhook authentication
async function generateSignature(payload, secret) {
  const timestamp = Date.now();
  const message = `${timestamp}.${JSON.stringify(payload)}`;

  const encoder = new TextEncoder();
  const key = await crypto.subtle.importKey(
    'raw', encoder.encode(secret),
    { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']
  );

  const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(message));
  const hex = Array.from(new Uint8Array(signature))
    .map(b => b.toString(16).padStart(2, '0')).join('');

  return { timestamp, signature: `sha256=${hex}` };
}

Signal Integration¶

GIAP™ implements a hybrid notification model using both Signal and email for operational alerts and status monitoring.

Signal Command Bot¶

A dedicated Signal bot (+16026938732) monitors the GIAP Alerts group and responds to 10 operational commands:

Notification Events¶

Technical Implementation¶

• Bot Infrastructure: signal-cli-rest-api container (bbernhard/signal-cli-rest-api:latest)
• Polling Interval: 15 seconds for command responsiveness
• API Version: signal-cli v0.96
• Group: GIAP Alerts (base64-encoded group ID)

Why Signal? End-to-end encryption, no vendor lock-in, mobile-first alerts for time-sensitive GRC operations. The hybrid model ensures redundancy — if email is delayed, Signal provides immediate notification.

Output Artifacts¶

POA&M Example¶

{
  "poam_id": "AAM-POAM-2025-0042",
  "client": "Healthcare Practice A",
  "generated": "2025-01-15T10:00:00Z",
  "generator": "POAMAgent v1.0",
  "frameworks": ["HIPAA", "SOC2"],
  "summary": {
    "total_items": 12,
    "high": 3,
    "medium": 6,
    "low": 3
  },
  "items": [
    {
      "id": "POAM-001",
      "control": "AAM.ACCESS-01",
      "issue": "No documented offboarding process",
      "severity": "High",
      "recommended_action": "Implement offboarding checklist and admin access revocation SOP",
      "target_date": "2025-02-01",
      "frameworks": ["SOC2_CC6.2", "HIPAA_164.312(a)"],
      "ciso_assistant_task_id": "CA-TASK-4521"
    }
  ]
}

Intake JSON Schema¶

{
  "intake_id": "GIAP-2025-0042",
  "phase": "post-engagement",
  "client": "Healthcare Practice A",
  "industry": "Healthcare",
  "size": 25,
  "tech_stack": ["M365", "EHR System", "Nextcloud"],
  "risk_profile": "PHI-heavy",
  "frameworks": ["SOC2", "NIST-CSF", "HIPAA"],
  "pre_engagement": {
    "ciso_assistant_assessment_id": "CA-2025-0042",
    "quick_gaps_identified": 5,
    "deposit_received": true,
    "engagement_signed": "2025-01-10T14:30:00Z"
  },
  "post_engagement": {
    "ciso_assistant_project_id": "CA-PRJ-2025-0042",
    "full_gaps_identified": 12,
    "poam_generated": true
  }
}

Skills Demonstrated¶

What This Demonstrates¶

• Senior-level systems architecture — Multi-agent orchestration with clear two-phase workflow
• Operational automation — End-to-end intake workflow with n8n, webhooks, and WebDAV integration
• Security engineering discipline — Comprehensive portal hardening with XSS prevention, rate limiting, and WCAG 2.1 AA compliance
• API security maturity — HMAC-SHA256 webhook authentication with replay attack prevention and cryptographic integrity verification
• Right tool for the job — CISO Assistant for both speed and depth with 100+ frameworks
• Custom tooling capability — POAMAgent built in-house for branded deliverables
• Enterprise GRC platform experience — CISO Assistant for production risk, compliance, and control management
• AI/LLM integration expertise — MCP protocol for natural language GRC queries
• Healthcare compliance depth — HIPAA Security/Privacy Rule implementation
• Production-grade security — RBAC, audit logging, PHI protection, deposit gate
• Emerging vertical expertise — PropTech/IoT compliance for regulated workspaces
• GRC domain depth — Cross-framework mapping, POA&M generation, evidence pipelines
• Full-stack capability — Static portal + n8n workflows + infrastructure automation
• Consulting delivery model — Productized vCISO service with 90-day cycles

Pairs with Cloud Control Pack for cloud governance and TraceLock™ for RF/physical security — demonstrating end-to-end security engineering capability.

Contact LinkedIn

¶