Cybersecurity compliance workflow

NCELT

NCELT is a local web app for organizing cybersecurity compliance evidence. It helps teams track files, map them to NIST CSF 2.0 outcomes, assign owners, and monitor review timing so evidence stays ready for audits, internal reviews, and GRC workflows.

Problem

Why NCELT exists

Evidence collection gets fragmented across shared drives, email threads, and spreadsheets. I also wanted to get a better understanding of GRC workflows and a cybersecurity framework. I got advice from my professor Albert Tay on this project.

Research

How I validated it

I had to learn how evidence is collected, managed, and reviewed in cybersecurity contexts. What types of evidence to people use the most, and how do compliance professionals interact with it? I learned that someone needs to own it, that evidence needs to be mapped to specific controls, and that it should be reviewed periodically.

Decisions

What shaped the product

1
The Data ModelCreated an Entity Relationship Diagram (ERD) that would shape how data was processed in this web application, the core entity being the evidence record.
2
Locally Hosted ApplicationDue to the sensitive nature of the data, I decided to build a locally hosted application to ensure data security and compliance. Nothing is uploaded to the cloud, and evidence names are edited for privacy.
3
The Review LifecycleDesigned the review process around audit readiness rather than simple file storage. Review times can be manually changed based on compliance requirements.
4
Ownership and Access ControlImplemented a system for assigning and managing ownership of evidence records, ensuring proper access controls are in place. Establishing who's in charge of each piece of evidence was a key consideration.

What I learned Product Principles

NCELT taught me GRC fundamentals as much as product thinking. The core problem was fragmented evidence collection across drives, email, and spreadsheets, so I researched how compliance professionals actually manage evidence before designing anything. That research drove four key decisions: an ERD centered on evidence records as the core entity, a locally hosted architecture to prioritize data security over cloud convenience, a review lifecycle built around audit readiness rather than simple storage, and ownership and access controls so accountability was always clear. Even outside a typical product context, the discipline was the same: understand the domain's real constraints before designing around them.

AI uses

Product design

Although I brought the data model and features to the table, AI helped create the visual design and user interface elements. Through multiple iterations with Codex, I landed on a sleek tech design.

Local Stack selection

ChatGPT helped me compare options for the local app and introduced me to technologies I didn't know about. This allowed me to use optimize effectively.

Implementation

Codex supported routes and app logic, including connecting my local database to the frontend and debugging issues.