For heads of IT, IT risk and security · Malaysia
You will run it. You do not want to build it.
Sastrum runs as SaaS, in your own cloud account or in your data centre, with the AI model you choose, roles and approval chains you configure in the browser, and a record that answers BNM's Risk Management in Technology (RMiT) questions without a project.
Your situation
Every GRC tool promises integration. You end up owning the glue.
Problems
- Controls, evidence and policies sit in tools that do not talk to each other, and you are the one asked to reconcile them.
- BNM's Risk Management in Technology (RMiT) wants evidence that is current; what you have is a folder from the last audit.
- An NCII entity has six hours to report incident details to NACSA, and the PDPA gives 72 hours to notify the Commissioner.
Needs
- A deployment choice that fits the policy: SaaS, your own cloud account, or on-premise, the same product in each case.
- Roles, separation of duties and approval chains you configure yourself, without a change request to the vendor.
- A way to load what you already have: registers, controls and incidents, by file, not by re-keying.
Desires
- An AI assistant that drafts controls and policies but never publishes without a named approver.
- An audit trail you can hand to the auditor as it is, filtered by module, actor and date.
What you would love
- A system the business runs itself, where you are consulted and not paged.
- Sensitive work routed to a model inside your perimeter, and everything else to the cloud, by rule.
Three things that are different
Yours to run, not yours to build.
- 01
Deploy it your way, including the AI.
SaaS, private cloud in your account, or on-premise with the models inside. Hosting in or near Malaysia is stated in the contract, and the on-premise option keeps everything, including the AI models, in your data centre. Per-task routing keeps high-sensitivity work on the model you choose; keys are encrypted at rest and masked on screen.
- 02
Configure, do not customise.
Nine permission areas, custom roles from a permission matrix, conflict rules for separation of duties, and review chains and templates set in the browser. What you change is recorded, not patched.
- 03
A record built for BNM's Risk Management in Technology (RMiT).
Every change in an immutable trail, including requests to Lumina. Maker, checker and head of department on every approval, with an SLA clock, so the evidence for the auditor is the system itself.
Coverage for Malaysia
The standards you are measured against, already mapped.
BNM RMiT, Shariah governance, PayNet and the PDPA are mapped, alongside ISO 27001 and the other global standards your controls already follow. The chip colour says whether each is in the product today or comes as a content pack.
Your regulators
Frameworks for you
- BNM RMiT
- BNM Shariah governance
- PayNet
- PDPA
- ISO/IEC 27001
- NIST CSF
- PCI-DSS
Your industry pack
Banking and finance
Islamic banks, DFIs, takaful operators, capital market intermediaries
BNM RMiT, Shariah governance, PayNet, PDPA
Why this matters now
The obligations are dated and the penalties are public.
Malaysian figures, each linked to its source.
RM1m
maximum fine for breaching the PDPA's data protection principles, from April 2025
72 hours
to notify the Personal Data Protection Commissioner of a significant data breach
6 hours
for an NCII entity to report incident details to NACSA
US$4.12m
average cost of a data breach in ASEAN, 2026
Bring your questions. We open on the admin console.
Sixty minutes with the product team: the role matrix, the approval chain, the audit trail, model routing and the deployment options, on a sample Malaysian tenant.