Compliance

Overview

Compliance is the governance component of Monago that aggregates policies, assets, audit, and risk signals into framework readiness scoring. A tenant administrator subscribes to the frameworks that apply, after which Monago computes per-clause readiness and per-dimension maturity automatically.

Supported frameworks include both international standards and Indonesian regulations, among others:

• UU PDP 2022 — Indonesia's Personal Data Protection law.
• POJK 11/2022 — Otoritas Jasa Keuangan, IT risk management.
• NIST AI RMF 1.0 — NIST AI Risk Management Framework.
• ISO/IEC 42001:2023 — AI management system standard.
• ISO/IEC 27001:2022 — Information security management.

Why the compliance subsystem matters:

• Multi-framework requirements — organisations typically have to comply with several frameworks in parallel. Tracking manually per framework is inefficient and error-prone.
• Evidence automation — every policy, asset, and audit log entry is automatically linked to a framework clause through the framework_mapping field. Manual mapping becomes an audit-prep bottleneck.
• Posture visibility — the dashboard shows readiness percentage, gap clauses, and maturity level per framework.
• Audit preparation — the forensic-query audit (4-eyes / dual approval) satisfies privileged access control requirements.

Audience for this page: compliance officers and tenant administrators managing framework subscriptions and monitoring readiness posture.

Concepts

Setup

Prerequisites

• The admin role to subscribe or unsubscribe.
• Policies and assets with the framework_mapping field set (the primary signal for clause coverage detection).
• A clear picture of which frameworks apply to the organisation's context.

Subscribe to a framework

After subscription, Monago automatically links policies and assets that have been annotated with framework_mapping to the clauses of the framework as evidence references. The audit log records the subscription event.

Manage subscriptions

The Framework tab shows the subscriptions table: framework and version, status, target certification, subscribe date, and actions.

Unsubscribing is a soft suspend — evidence references are retained for audit. Re-subscribing restores posture tracking immediately.

Usage

Posture tab

Per-framework readiness cards:

• Readiness percentage (0-100%).
• Critical clauses coverage.
• Maturity level (1-5) — aggregated from the dimension matrix.
• Click a card to drill down to detail.

Cards are colour-coded:

• Green (90-100%): production-ready.
• Yellow (70-89%): mature with some gaps.
• Orange (40-69%): in-progress.
• Red (0-39%): early-stage.

Gap analysis tab

The per-clause table for the selected framework:

• Code + title — identifier and clause name.
• Category — clause grouping.
• Priority — Critical, High, or Normal.
• Evidence status — Covered or Gap.

Filter by priority, category, or status. Sort descending by priority.

Gap clauses are action items for the compliance officer — high-priority gaps require new policies or assets to close.

Evidence tab

A list of every active evidence reference:

• Clause addressed.
• Type — policy_version, asset, audit_row, or risk_snapshot.
• Reference — link to the source artifact.
• Created at.

Use case: drill into specific evidence when an auditor asks which policy or asset covers a particular clause.

Maturity matrix tab

Per-dimension level (1-5):

NIST AI RMF dimensions:

• GOVERN — governance and policy framework.
• MAP — context and risk identification.
• MEASURE — assessment and monitoring.
• MANAGE — risk treatment and incident response.

ISO/IEC 42001 phases:

• PLAN — establish the AI management system.
• DO — implement and operate.
• CHECK — monitor and measure.
• ACT — continual improvement.

Level interpretation:

Forensic query audit (privileged access)

For sensitive data extraction (audit log export, personal data for regulator requests), Monago applies the 4-eyes / dual approval principle:

This supports privileged access control under UU PDP Pasal 16-22 and POJK § audit.

Compliance mapping

Per-framework coverage matrix:

Per-clause mapping detail and the evidence package are delivered in a separate procurement document — contact support@monago.io.

Troubleshooting

Readiness percentage stuck low

Inspect the Gap analysis tab — the list of gap clauses appears. Common causes:

• A policy lacks the framework_mapping field — edit the policy and add a mapping.
• The asset registry is empty — register AI assets in the Asset Registry.
• The audit log is not yet mature (a new tenant, a sparse signal feed).

Resolution: prioritise critical gaps; add policies or assets that map to those clauses.

Evidence auto-mapping does not trigger

Auto-mapping runs on a fixed background cadence. Refresh the page after a policy change to see the latest update.

Check the framework_mapping shape:

"framework_mapping": [
  {"framework": "UU_PDP_2022", "clause": "Pasal 39"}
]

The framework enum and clause code must match the registered framework clauses in the backend catalogue.

Does unsubscribe + re-subscribe lose posture?

No. Evidence references are retained in a soft-suspend state. Re-subscribing restores posture immediately.

Maturity level shows blank / N/A

The maturity-matrix evaluator needs a minimum sample size (tenants with sufficient audit history). New tenants see "Pending — insufficient data" until enough data accumulates.

Forensic query returns no response

Forensic queries are async (audit log + email notification to the administrator). Check the inbox and the Audit tab in Observability for query status.

FAQ

Can I subscribe to multiple frameworks simultaneously?

Yes. A tenant can subscribe to every applicable framework. Evidence references are shared — one policy can map to multiple clauses across multiple frameworks.

How do I onboard a new framework (e.g. a UU PDP amendment)?

New framework versions are managed by the Monago team and added to the catalogue on a regular cadence. Tenants receive an email notification when a new version is available. Migration is seamless: the old version is retained for historical posture, and the new version begins tracking from the subscription point.

What's the difference between Compliance and the Risk subsystem?

• Risk — quantitative (0-100), per-asset, signal-driven, near-real-time, for operational vigilance.
• Compliance — qualitative (Ready, Gap), per-framework clause, evidence-driven, daily aggregate, for audit readiness.

The two are complementary.

Can workspace_admin manage subscriptions?

No. Framework subscription is a tenant-level configuration (admin only). workspace_admin can view the posture for the workspace they manage.

How is evidence revoked when a policy is removed?

Soft cascade. When a policy is archived, evidence references pointing to that policy_version are marked revoked (the status is flagged while the row is retained for audit). The readiness score is recalculated on the evaluator's next run.

Is PCI-DSS supported?

Pilot scope: UU PDP, POJK, NIST AI RMF, ISO 42001, ISO 27001. PCI-DSS support is on the development roadmap — contact the team for a timeline if you process card data.

How do I prepare for an audit with regulator-approved documents?

Workflow:

A procurement-grade audit deliverable template is available on request — contact support@monago.io.

Related

• Policies — framework_mapping feeds evidence auto-mapping.
• Risk — the risk score informs the compliance posture.
• Workspaces — workspace_id on evidence supports per-workspace posture.
• BYOK — BYOK encryption is evidence for ISO 27001 clauses.