[ IT and information security assessment / CBAR Decision 14/2 ]
Vigulo assesses the IT and information security of banks and non-bank financial institutions and produces a readiness map against the requirements of Central Bank Decision 14/2.
[ Services / 3 ]
An IT and security assessment that ends in one report with two results.
We test what you built, under rules agreed in writing, and show how it was done.
Ongoing support for teams that have no security officer in-house.
[ Who it is for / 6 ]
Tier A and Tier B: the full 14/2 clause map.
Entity profile applies the exemptions of its category.
Entity profile applies the exemptions of its category.
Entity profile applies the exemptions of its category.
Entity profile applies the exemptions of its category.
No 14/2 obligation: Tier A only, a maturity baseline.
Vigulo comes from the Latin vigil: the one who stays awake so the rest can work. We read your controls the way a watchman reads a perimeter: methodically, with evidence, and without drama. Then we tell you plainly what we found.
Tier A: how mature are your IT and security practices, scored 0 to 4, with the strength of evidence behind each score.
Tier B: where you stand against each clause of Decision 14/2.
Skip to the reportHover a spoke or clause, or drag the face to turn the sweep.
[ Report / PDF ]
With an evidence grade per score. Critical minimums are flagged on their own.
Compliant, partial, non-compliant, not applicable or not assessed.
Risk rated Critical, High, Medium or Low (likelihood x impact).
Placed in 0-30 days, 30-90 days and 3-12 months.
Both results, the findings and the roadmap in one document.
Each clause of Decision 14/2 gets exactly one status: compliant, partial, non-compliant, not applicable or not assessed. Nothing is left implicit.
| CL. | Status | |
|---|---|---|
| CL. 01 | Compliant | |
| CL. 02 | Compliant | |
| CL. 03 | Partial | |
| CL. 04 | Non-compliant | |
| CL. 05 | Compliant | |
| CL. 06 | Partial | |
| CL. 07 | Not applicable | |
| CL. 08 | Compliant | |
| CL. 09 | Non-compliant | |
| CL. 10 | Partial | |
| CL. 11 | Not assessed | |
| CL. 12 | Compliant |
[ How it works / 4 steps ]
We agree in writing what is assessed, for which entity type, who answers for each area, and on what terms. Work starts after that.
We collect documents, configurations and interviews. Each finding is tied to evidence of a stated grade.
One assessment is scored twice: maturity for Tier A, clause status for Tier B.
You receive one PDF with both results, findings by priority and a remediation roadmap.
Your data stays in Azerbaijan. Evidence, working files and reports are handled and stored in Azerbaijan.
[ FAQ / 7 ]
No. Vigulo Radar is an advisory assessment. It does not replace the external audit that Decision 14/2 requires.
It depends on scope and entity type. The timeline is set in the written scope and terms before any work starts.
Documents, configuration evidence and interviews with the people who run the controls. Interview-only evidence caps a score at 2, so documents and configurations raise the result.
In Azerbaijan. Evidence, working files and reports are handled and stored there.
Azerbaijani and English. Clause references follow the Azerbaijani original of Decision 14/2, which prevails over the English translation.
Yes. Non-regulated companies get Tier A only: the maturity score across the domains, with findings and a roadmap, without the 14/2 clause table.
Where the text leaves a question open, the report states how we read it, so you can see the assumption behind each status.
Tell us about your organisation. We will reply with scope and next steps.