Question 1

What does NOVA Compliance do?

Accepted Answer

NOVA brings frameworks, controls, evidence, policies, risks, assets, ownership, testing, reporting and external assurance into one governed workspace. It maintains one connected compliance record instead of separate spreadsheets, folders and point-in-time status reports.

Question 2

What does NOVA actually do that spreadsheets and shared folders do not?

Accepted Answer

Spreadsheets and folders can store information, but they do not naturally maintain the relationships between requirements, controls, evidence, owners, policies, risks, test results, framework mappings and readiness reporting. NOVA maintains those relationships as governed records so changes and gaps can be traced across the programme.

Question 3

Who develops and operates NOVA?

Accepted Answer

NOVA Compliance is developed and operated by Eredox Pty Ltd.

Question 4

Can NOVA be used outside Australia?

Accepted Answer

Yes. NOVA is designed for organisations operating across multiple jurisdictions and supports global, regional and organisation-specific requirements. Some frameworks are jurisdiction-specific, so applicability must still be determined by the organisation.

Question 5

Do we need NOVA before we start an audit, or only once we are already compliant?

Accepted Answer

NOVA can be used before, during and after assessment: define scope, establish controls, assign owners, collect evidence, identify gaps, prepare for external review and maintain the programme afterwards. NOVA supports the work but does not make an organisation compliant by itself.

Question 6

Can NOVA replace our compliance consultant, vCISO or internal compliance team?

Accepted Answer

No. NOVA provides the governed system, workflows, evidence structure, control mapping and reporting. Human expertise may still be needed for scope, security design, remediation, interpretation, risk decisions and certification or attestation preparation.

Question 7

How long does it take to become audit-ready?

Accepted Answer

There is no fixed timeframe. Readiness depends on scope, existing controls, evidence history, remediation effort, staff availability, framework requirements and external assessor expectations. NOVA makes outstanding work visible and accountable but does not guarantee timing.

Question 8

What does "27 available frameworks" mean?

Accepted Answer

The governed NOVA catalogue contains 27 framework capabilities across native and configurable support. The catalogue includes frameworks available now and frameworks available by configuration; activation depends on customer scope, data and evidence. Activation also depends on applicable requirements, entitlement and the evidence available for the customer scope.

Question 9

Which frameworks are available today?

Accepted Answer

SOC 2, ISO/IEC 27001, Essential Eight, ISO/IEC 42001 are available now in the governed inventory. GDPR — General Data Protection Regulation (EU) 2016/679, PCI DSS v4.0.1 — Payment Card Industry Data Security Standard, HIPAA — Privacy, Security & Breach Notification, Cybersecurity Maturity Model Certification (CMMC) are available by configuration. The wider catalogue contains additional capabilities, and activation depends on scope and evidence.

Question 10

Can we manage several frameworks at the same time?

Accepted Answer

Yes. NOVA uses a shared control model so one legitimate control and its validated evidence can support multiple requirements where they are genuinely applicable.

Question 11

What happens when the same control applies to several frameworks?

Accepted Answer

The control is maintained once and mapped to each applicable requirement. Ownership is maintained once, evidence can be reused where valid, testing affects every framework relying on the control, and gaps remain visible across mappings.

Question 12

Can one evidence item support several frameworks?

Accepted Answer

Yes, where it legitimately demonstrates the mapped control or requirement. The mapping remains explicit and reviewable; evidence is not reused automatically without validation.

Question 13

Can we add a framework, regulation, customer requirement or internal standard that is not already listed?

Accepted Answer

Yes, through the Custom Framework capability. Additional requirements can be modelled and connected to controls, evidence, risks, owners, policies and reporting. NOVA does not provide legal interpretation.

Question 14

Does NOVA certify our organisation?

Accepted Answer

NOVA assists with readiness and evidence management. Certification, attestation and regulatory conclusions remain with authorised independent, regulatory or customer-appointed parties.

Question 15

Does NOVA guarantee we will pass an audit?

Accepted Answer

No. NOVA helps organisations understand and evidence readiness, but the outcome depends on actual controls, evidence, scope and the independent assessment.

Question 16

What does NOVA actually automate, and what still needs human approval?

Accepted Answer

NOVA reduces repetitive collection, organisation and mapping work through governed connectors and evidence workflows. It can assist with collecting evidence, organising artefacts, mapping evidence to controls, surfacing gaps, reminders, review workflows and reporting from governed records. It does not approve evidence, accept risk, approve policies, certify the organisation or declare audit readiness. Human approval remains required.

Question 17

Which integrations and connectors are available today?

Accepted Answer

GitHub, Manual upload are available now in the governed integration inventory. Other connector categories remain clearly marked with their source status, including Planned where they are not available today.

Question 18

What happens if NOVA does not have a connector for one of our systems?

Accepted Answer

Evidence can still be uploaded manually with structured metadata and mapped to the relevant controls. A missing connector does not prevent the programme from operating.

Question 19

Does evidence count as soon as it is uploaded or collected?

Accepted Answer

No. A reviewer validates that the evidence actually demonstrates the control before it contributes to readiness. Until review occurs, the item is held but does not count.

Question 20

How does NOVA keep evidence current?

Accepted Answer

Evidence has freshness expectations and review history. Ageing or expired evidence is surfaced for refresh before assessment so the programme record reflects current operation rather than a historical snapshot.

Question 21

Can one evidence item be reused across several frameworks?

Accepted Answer

Yes, where the evidence genuinely supports a shared control. The mapping remains explicit and reviewable across every framework that relies on it.

Question 22

Do we still need an independent auditor or certification body?

Accepted Answer

Yes, where the chosen framework requires independent assurance. NOVA organises the programme, evidence and readiness record but does not replace an external auditor, assessor or certification body.

Question 23

How does an auditor work with NOVA?

Accepted Answer

The Auditor Portal provides scoped engagement access, evidence requests, findings and controlled collaboration inside the tenant boundary. It does not provide unrestricted access to the customer workspace.

Question 24

Can NOVA help reduce repeated security questionnaires?

Accepted Answer

Yes. The Trust Centre can publish approved assurance content so common customer questions can be answered without exposing confidential underlying evidence. Publication requires explicit approval.

Question 25

What does readiness percentage mean?

Accepted Answer

Readiness is a decision-support indicator derived from the underlying control, test and validated evidence state. It is not certification, an audit outcome or a guarantee.

Question 26

How does NOVA help us govern AI use?

Accepted Answer

NOVA can connect AI requirements, policies, AI systems, risks, impact assessments, controls, owners, evidence, human oversight and monitoring. ISO/IEC 42001 is one relevant framework, but the same structure can support broader responsible-AI and organisational governance needs.

Question 27

Can NOVA help if we use AI but are not seeking ISO/IEC 42001 certification?

Accepted Answer

Yes. Organisations can use the same governance structure for internal AI policy, customer requirements, risk management, responsible AI, contractual obligations and other governance requirements.

Question 28

Can NOVA's AI Assistant approve policies, evidence or risks?

Accepted Answer

No. You retain final authority over approvals, risk acceptance, policies, readiness and all decisions made for your organisation. What you control: You retain final authority and accountability for policy approvals, risk acceptance, launch decisions, and all statements made to auditors, regulators, or customers.

Question 29

What can the AI Assistant actually do?

Accepted Answer

The governed AI Assistant supports requirement understanding, evidence exploration, drafting support, gap identification, readiness preparation. It works from the governed content in the workspace and presents output for human review rather than autonomous approval.

Question 30

What are the AI Assistant's limitations?

Accepted Answer

It can misunderstand context, produce an incorrect draft or miss information that is not available in the governed workspace. Outputs require human review before they are used, approved or published.

Question 31

Is our information separated from other NOVA customers?

Accepted Answer

Yes. Evidence, controls, policies, risks and reporting are scoped to the customer tenant with role-based access inside that tenant.

Question 32

Can auditors see all of our information?

Accepted Answer

No. Auditor access is scoped to the engagement through the Auditor Portal and remains within the tenant boundary.

Question 33

What can we safely publish through the Trust Centre?

Accepted Answer

Only explicitly approved assurance information should be published. Confidential underlying evidence remains internal unless separately authorised.

Question 34

Is Eredox certified?

Accepted Answer

The security and trust pages describe the practices in place. Eredox does not claim certifications that it has not obtained, and no unsupported certification is asserted on this website.

Question 35

How is NOVA priced?

Accepted Answer

NOVA is priced as a subscription with entitlements per plan. The pricing page is the commercial authority for current indicative amounts, approval status, included capabilities and Enterprise scope.

Question 36

Is the NOVA subscription the total cost of becoming certified?

Accepted Answer

No. External costs may include an auditor or certification body, consultants, remediation, internal staff time and technical implementation. The NOVA subscription covers the platform and plan entitlements.

Question 37

Can we change plans later?

Accepted Answer

Yes. Plans are subscription entitlements rather than separate products, so moving between them changes what is enabled in the same workspace.

Question 38

What support is included?

Accepted Answer

Support is plan-dependent: Free: Documentation and community resources; Launch: Email during business hours; Growth: Email with prioritised queue; Professional: Priority support with a named contact; Business: Priority support with onboarding assistance; Enterprise: Agreed support arrangements. The pricing page remains the source of truth for current support arrangements.

Question 39

Do you charge separately for auditor access?

Accepted Answer

Auditor Portal access is part of the plans that include it. Access is scoped to the engagement rather than sold per external user.

Frequently asked questions

About NOVA

Getting started

Frameworks & requirements

Evidence & automation

Audit & assurance

AI governance & human oversight

Security & trust

Commercial & support

See NOVA against your own compliance obligations

Start your compliance journey without spreadsheets