Board & corporate governance
Sets risk appetite, approves the published control rule set, and reviews every material change to how a verdict is computed.
Accountable for
Rule-set approval, risk appetite, disclosure integrity
Corporate profile
A compliance technology company built for regulated institutions.
DeshCyber is a compliance technology company that observes how an organization already operates, maps that activity to published control rules, and produces audit evidence a regulator or assessor can verify without taking our word for it.
We are organized like the institutions we serve: separate engineering, research and assurance functions, a published rule set, and a governance line that keeps evidence independent of the people who benefit from it.
Corporate profile at a glance
01The structural facts an assessor, a procurement team or an answer engine asks for first.
- Organization type
- Private compliance technology company
- Operating model
- Deterministic evidence platform
- Regulatory coverage
- SEC 8-K, PCI DSS 4.0, CMMC Level 2, SWIFT CSP
- Assurance posture
- Evidence reproducible by third parties
- Delivery footprint
- Enterprise and mid-market, remote-first
- Working languages
- English and Bangla
Product engineering, control research and assurance under one operating structure.
Rules are published before a verdict is issued; no model decides a control outcome.
Each framework is maintained by a named control owner inside the research function.
Every verdict carries its inputs, rule version and timestamp so it can be recomputed.
Deployed into the client environment; data stays inside the client's boundary.
Product surfaces, documentation and evidence exports ship in both.
How the company is structured
02Six standing functions with separate charters. Evidence is produced, reviewed and signed by different people on purpose.
Control research
Reads the primary regulation, translates each obligation into a testable rule, and versions it so an old verdict stays reproducible.
Accountable for
Framework interpretation, rule versioning, regulatory change tracking
Platform engineering
Builds the collection, evaluation and attestation pipeline that turns operational activity into signed, timestamped evidence.
Accountable for
Evidence pipeline, platform reliability, export integrity
Assurance & quality
Independently recomputes a sample of verdicts against the published rules and blocks release when the two disagree.
Accountable for
Verdict reproducibility, release gates, audit-readiness reviews
Security & trust
Owns our own control environment, third-party review, and the boundary that keeps client data inside client infrastructure.
Accountable for
Internal controls, vendor review, incident response
Client operations
Runs onboarding, evidence walkthroughs and the standing review cadence with each client's compliance and audit teams.
Accountable for
Onboarding, audit support, service reviews
How an engagement actually runs
03The same four stages for every framework, so a finding in one program is explainable in the language of another.
- 01
Observe what already runs
We connect to the systems your business already uses instead of asking teams to restate their work in a questionnaire.
OutputA live inventory of systems, owners and control-relevant activity
- 02
Map to published rules
Each obligation is expressed as a rule with a version number, so the basis of a verdict is readable before the verdict exists.
OutputA versioned rule set mapped to every in-scope obligation
- 03
Verify continuously
Controls are evaluated on their own cadence, not at quarter end, and drift is raised the day it appears.
OutputContinuous control status with dated evidence behind each result
- 04
Attest and file
Evidence is packaged into the artefact the recipient expects — an assessor workbook, a board pack, or an SEC filing.
OutputSigned, timestamped evidence packages ready for external review
Audit and validation transparency
04What we evaluate, what counts as evidence, and how a change to a rule or a verdict is reviewed before anyone relies on it.
Evaluation scope
Every engagement states, in writing, which systems, entities and obligations are inside the assessed boundary — and which are explicitly not.
In practice
- In-scope systems, owners and data flows are listed before the first evaluation runs.
- Each obligation is bound to a named framework requirement and a rule version.
- Exclusions and compensating controls are recorded with the reason and the approver.
- Scope changes create a new evaluation period rather than silently amending an old one.
Evidence types we accept
A verdict is only as good as the artefact behind it, so each evidence type carries its source, collection method and retention rule.
In practice
- System-collected telemetry: configuration state, logs and API responses with timestamps.
- Generated artefacts: exports, filings and assessor workbooks signed at the moment of creation.
- Attested statements: human sign-off, identified by role, used only where no machine signal exists.
- Third-party reports: vendor assurance and external test results, dated and version-tracked.
How updates are reviewed
Rules, thresholds and evidence models change as regulation changes. Every change is reviewed, versioned and replayable against past periods.
In practice
- Control research proposes the change with a citation to the primary regulation.
- Assurance recomputes a sample of historical verdicts under both rule versions.
- The board-level rule set approval gate blocks release when results are unexplained.
- The change ships with an effective date; earlier verdicts keep their original rule version.
ReproducibilityAnyone holding the same inputs and the same published rule version can recompute any verdict we have issued and reach the identical result.
Frameworks we are accountable for
05Each program has a named control owner, a versioned rule set and its own evidence model.
- SEC & Exchange reportingMaterial-event disclosure and 8-K/EDGAR filing evidence inside the statutory four-day clock.
- Payment card securityPCI DSS 4.0 control evidence across cardholder data environments and their service providers.
- CMMC 2.0Level 2 practice evidence for defense supply-chain organizations handling controlled unclassified information.
- SWIFT CSPCustomer Security Programme attestation evidence for institutions on the global payment network.
Go deeper on who we are
06The principles, people and engagement model behind the structure above.
Questions people ask about the company
07Short, checkable answers — the same wording we use in the platform.
See the evidence model against your own environment
Bring one framework and one system. We will show the rule, the evidence behind it and the record an assessor would receive.