Introduction

The documentation screenshots and examples throughout this guide use data from a fictional organization called NovaTrust Financial Services. This demo environment provides a realistic view of how vucavoid works in practice, complete with risks, controls, compliance requirements, incidents, and the connections between them.

Understanding this demo context helps you navigate the screenshots and relate what you see to your own organization's GRC needs.

About NovaTrust Financial Services

NovaTrust is a medium-sized fintech company specializing in digital payment processing and e-wallet solutions. Operating globally with headquarters in New York, the company faces the regulatory and security challenges typical of the financial services industry.

This profile was chosen because fintech organizations face comprehensive GRC requirements across multiple regulatory frameworks. The demo data demonstrates how vucavoid handles real-world complexity: overlapping compliance requirements, multi-jurisdictional operations, and the interconnected nature of risks, controls, and evidence.

What the Demo Includes

The NovaTrust demo environment contains a complete GRC dataset with realistic relationships between entities. Rather than isolated records, this data shows how everything connects, from risks linked to controls, controls mapped to requirements, and evidence supporting compliance claims.

Organization Structure

See Legal Entities, Locations, and Teams for details on modeling your organizational structure.

Asset Inventory

The demo includes assets with various lifecycle states, EOL/EOS tracking for IT assets, and business criticality ratings. See IT Assets, Information Assets, and Physical Assets.

Business Context

Third parties include cloud providers, payment processors, and consulting firms. Each has relationship context and risk considerations. See Third Parties and Engagements.

Risk & Control Framework

Risks include fintech-specific scenarios: payment card data breach, ransomware attacks, regulatory non-compliance, and third-party failures. Controls are mapped to the risks they mitigate. See Risks, Controls, and Control Effectiveness Reports.

Compliance Framework

The demo shows requirements at various fulfillment stages: fully compliant, partially compliant, and gaps requiring attention. See References, Requirements, and Evidence.

Operational Data

Findings and incidents demonstrate the full lifecycle from identification through remediation. Tasks show assignment patterns and overdue management. See Findings, Incidents, and Tasks.

Blueprints

Blueprints demonstrate how organizations can create reusable templates for common GRC elements. See Blueprints.

Demo Users

The demo environment includes users with different roles, demonstrating vucavoid's permission system and how various GRC responsibilities are distributed across an organization.

This distribution shows how vucavoid supports role-based access. The CISO has comprehensive access, while specialists focus on their domains, and executives have visibility without edit capabilities.

See User Management for details on configuring roles and permissions.

Using the Demo for Learning

When exploring the documentation, you'll see NovaTrust data in screenshots. Here are some ways to relate what you see to your own organization:

Understand the Connections

Notice how records link together:

• Risks reference the controls that mitigate them
• Controls map to the requirements they satisfy
• Findings generate tasks for remediation
• Incidents may trigger new risk assessments

These relationships aren't just organizational. They power reporting, VUCA score calculations, and audit evidence.

Follow Realistic Workflows

The demo data includes records at various lifecycle stages:

• Risks: Some newly identified, some under assessment, some with completed treatment
• Findings: Some open, some in remediation, some closed
• Tasks: Some pending, some overdue, some completed

This helps you understand how records progress through their lifecycles in practice.

See Multi-Framework Compliance

NovaTrust demonstrates managing multiple frameworks simultaneously:

• PCI DSS requirements for payment security
• SOC 2 criteria for service organization controls
• ISO 27001 controls for information security
• GDPR requirements for data protection

Notice how a single control can satisfy requirements from multiple frameworks, and how evidence can support multiple compliance claims.

VUCA Score in Demo Data

The NovaTrust demo includes a realistic VUCA score reflecting its GRC health:

• Some risks with overdue treatment deadlines (affects Volatility)
• A few controls missing recent effectiveness reports (affects Uncertainty)
• Multiple compliance frameworks creating cross-dependencies (affects Complexity)
• Some requirements without clear ownership (affects Ambiguity)

This demonstrates that even well-managed organizations have areas requiring attention. The VUCA score helps prioritize where to focus improvement efforts.

See VUCA Score for a complete explanation of how the score is calculated.

Related Resources

• Overview - Introduction to vucavoid and GRC management
• Key Concepts - Core terminology and platform philosophy
• Dashboard - Understanding your VUCA score and widgets
• Risks - Managing your risk register
• Controls - Implementing and tracking controls
• Requirements - Tracking compliance obligations