Compliance rules. Evidence capture.
From attestation to continuous evidence.
Argus adds automated compliance checks to your development pipeline. Turn procedures into repeatable rules, make failures visible, and capture evidence on every run.
From policy to practice
Your procedures are written. Put them to work.
Procedures can be approved and published in an information security management system (ISMS) while everyday development drifts. Argus turns the requirements that can be automated into checks the team sees as it works.
A missing SBOM in a new project, or evidence older than your policy allows, becomes a failing pipeline check. The team can prioritise it in sprint planning, assign the fix and see the result on the next run, just like any other development issue.
Periodic attestation
“The SBOM was present when I checked.”
checked: on review day
recorded: by the reviewer
Continuous evidence
“The SBOM was present in every checked build.”
checked: on each pipeline run
recorded: result, time and commit
How Argus works
A rules engine that keeps the evidence.
Define the checks
Translate your requirements and procedures into rules. Start with supplied rule sets or define your own checks for documents, specified content and evidence freshness.
Run with development
Add Argus to your pipeline and choose when it runs. Pass/fail results make the checks part of the team’s normal workflow. Jira and GitLab connectors can add evidence from your development systems.
Capture the evidence
Capture each run’s results with the check time and Git commit when available. Keep reports locally or submit them to Command Central to build an evidence history as development proceeds.
Your compliance programme
Start where you are.
Established compliance team
Automate the procedures you already have.
Your CISO and compliance team know the requirements. Turn the automatable parts of your ISMS controls, contractual obligations and internal policies into rules that run with development.
The rules engine can serve your own compliance profile, including requirements beyond EU regulations.
Building your approach
Get started with rules and guidance.
Use the supplied rule sets as a starting point. If you need support, Attigo can help you define the rules and the complementary manual procedures that fit your company.
Consulting is available alongside the product, from initial guidance to implementing your approach.
Starter rule sets
A starting point for your rules.
EU Regulation 2024/2847
Cyber Resilience Act
Rules for evidence supporting product cybersecurity and vulnerability handling, as part of the compliance plan for products within CRA scope.
EU Directive 2022/2555
Network and information security
Rules for evidence supporting an organization’s cybersecurity risk management under the applicable national implementation of NIS2.
Industrial and OT standard
Secure products for OT
The current template checks development artifacts relevant to IEC 62443-4-1, supporting the secure development lifecycle for industrial and OT products.
These starter sets provide selected checks for each framework. Combine them with your own rules and the other procedures in your compliance programme.
Before you start
Not sure which rules apply to you?
Answer a few questions about your product, organization and intended use. The checker highlights where CRA, NIS2 or IEC 62443 may be relevant and what to review next.
Argus by Attigo
Make compliance part of everyday development.
Start with a procedure you want to automate. Let’s turn it into a check your team can use and evidence you can keep.
In early access with a small number of design partners.