Framework & Control Library
Pre-built framework templates with cross-framework mapping — every Pakistani framework loaded and updated as data, not code.
grComply — GRC Automation Platform
Compliance, Continuously — Not Once a Year
grComply is Mutex Systems' own multi-tenant GRC automation platform. Every capability — the framework library, automated discovery and monitoring, risk and audit workflow, AI-assisted compliance, reporting, and enterprise deployment — is live in production today, replacing the spreadsheet rebuild that happens before every audit with one continuously updated system of record.
Visibility by Role
- Client Executive (CEO/CTO): Read-only, org-wide compliance posture across every assigned framework — sign-off on risk acceptance.
- Tenant Admin / Compliance Officer: Full framework detail, evidence status, custom fields, AI-provider settings, and user management.
- Mutex Auditor: The assigned tenant’s controls, evidence, and findings — raises and tracks formal observations.
- Board / Governance Layer: Same posture data as the executive view, delivered as a scheduled weekly or monthly report.
Platform Modules
What grComply Automates
Dynamic Schema Engine
Add custom fields to any entity without a code deployment — CII designation, PowerCERT reference numbers, PTA CAT level, PDPB readiness flags.
Hybrid Discovery & Scanning
Agentless external scanning plus agent-based internal scanning — directly evidences CTDISR posture clauses, SBP’s mandatory-VAPT clause, and NEPRA’s continuous-monitoring requirement.
Risk Register & Audit Workflow
Structured risk entries with heat-map view, plus a formal raise / respond / review / close observation workflow with countersign — matching PTA, nCERT, and SBP examiner expectations.
AI Assistant (Claude-Powered)
Drafts policies and documents, explains gaps, and drafts observation responses — speeding PDPB-readiness policy drafting and PISF’s 13-document set.
Reporting & Multi-Tenant Administration
Live completion percentage rollup across every assigned framework with an immutable audit trail, role-scoped access across 7 defined roles, tenant-isolated at the data layer.
Framework Coverage
Loaded and Ready — Not Built to Order
Every framework below is imported into grComply as a versioned framework library, not a one-off consulting deliverable.
Pakistan Information Security Framework (PISF) 2026
nCERT
238 controls imported as a ControlNode tree, mapped 1:1 to ISO 27001, NIST CSF, and SOC 2 equivalents.
Critical Telecom Data and Infrastructure Security Regulations (CTDISR-2025)
PTA
Loaded as a seed framework — agentless external scans check posture continuously against CTDISR clauses.
SBP Cybersecurity Guidelines & Cloud Outsourcing Framework
SBP
Mandatory-annual-VAPT clause scheduled and evidenced automatically; vendors modelled via the Dynamic Schema Engine.
NEPRA Security of Information & OT Regulations 2022
NEPRA
OT/ICS-adjacent internal scanning via the local scan agent — SOC, log-retention, and PowerCERT-reporting tracked as controls.
National Registration & Biometric Policy Framework v2.0
NADRA
Biometric and citizen-data-handling controls tracked with AI-assisted narrative drafting.
National Cyber Security Policy 2021 & CERT Rules 2023
MoITT / nCERT
Loaded as reference metadata so generated evidence narratives cite the correct legal basis automatically.
FAQs
Common Questions About grComply
What is grComply?
grComply is Mutex Systems' own multi-tenant, multi-standard GRC automation platform — built to turn Pakistan's fragmented regulatory landscape into one tenant-isolated system of record. It covers the framework and control library, automated discovery and monitoring, risk and audit workflow, AI-assisted compliance, reporting, and enterprise deployment.
Which Pakistani regulatory frameworks does grComply support?
Every named framework identified in our Pakistan regulatory research is loaded into grComply — including PISF 2026 (nCERT), CTDISR-2025 (PTA), the SBP Cybersecurity Guidelines and Cloud Outsourcing Framework, NEPRA's Security of Information & OT Regulations 2022, NADRA's National Registration & Biometric Policy Framework, the National Cyber Security Policy 2021, CERT Rules 2023, and PECA 2016. The Personal Data Protection Bill is pre-loaded as a dormant framework, ready to activate the moment it becomes law.
Is grComply only for Pakistani businesses?
No. grComply's framework engine is designed to load any named standard as data rather than code — international frameworks like ISO 27001, SOC 2 Trust Services Criteria, and NIST CSF are supported alongside the Pakistan-specific instruments, with cross-framework mapping so one piece of evidence can satisfy more than one standard at once.
How does grComply reduce manual audit-season work?
Evidence is uploaded once and auto-linked to every control it satisfies across all assigned frameworks, rather than being chased from teams by email for weeks before each audit. Scheduled agentless scans auto-create findings mapped to controls, control-completion percentage is computed live instead of manually tallied, and a signed audit-package export assembles at click-time from live structured data.
Does grComply support on-premise or private deployment for government and CII clients?
Yes. grComply offers a private and on-premise deployment option that matches the data-locality intent required by government tenants and PISF-designated Critical Information Infrastructure entities, alongside its standard multi-tenant cloud deployment.
Can Mutex Systems set up grComply for our organisation?
Yes. As the platform's own developer and a PTA-Approved Cyber Security Auditor, Mutex Systems can onboard your organisation onto grComply, load the frameworks relevant to your regulatory obligations, and pair the platform with our audit and assessment services for a combined technology-plus-advisory engagement.
Let's Talk
See grComply Running Against Your Own Frameworks
Send us your current compliance obligations. Within two working days you will receive a written response and a proposed demo covering the frameworks relevant to your business.
No commitment requiredResponse within 2 working daysConfidential brief handling