Security Compliance Hub
Security Compliance Hub

From a security assessment to an auditor-ready report, in one platform.

Assess your organisation against the frameworks it has to meet: 21 of them, from Cyber Essentials and ISO 27001 to NIS2, DORA and SOC 2. Rules work out where you stand in each standard’s own terms, and Phronesis, our AI, explains what that means and what to do next.

Start free — no account needed How it all fits together
21 frameworks, each in its own terms Answers checked against your own tools Audit Pack export built in Risk management, before or after you assess
How it works
  1. 1 · Input

    Assessments

    21 frameworks across UK, EU and US standards, from Cyber Essentials to NIS2, DORA, SOC 2, ISO 42001 and CMMC.

    Start with the free check
  2. 2 · Decide

    SCH engine

    Rules work out the verdict, scores, target, gaps and roadmap.

    Same answers, same result
  3. 3 · Explain

    Phronesis AI

    Explains what it means: the summary, the priorities and their root causes.

    Writes the words, never picks the score
  4. 4 · Report

    Your report

    The verdict and your target, what to fix first, and a roadmap to get there.

    PDF · PowerPoint · JSON · shared link
  5. 5 · Prove

    Auditor-ready

    What good looks like for every gap, and the evidence behind every answer.

    Audit Pack with integrity hashes
Optional · Connected tools, read‑only

Your answers, checked against your own tools

How the checks work
  • Microsoft 365
  • Google Workspace
  • Okta
  • CrowdStrike Falcon

The SCH engine checks each answer against what your tools show. An answer they contradict counts lower until an evidence note explains it.

Or start here · Run your ISMS

Risk management, with or without an assessment

Your risk register, risk method, RACI, business assets and Statement of Applicability, for ISO 27001, ISO 42001 and the CAF, for your organisation or for each client. None of it waits for an assessment: start here, and assess once your management system has taken shape. The assessment then builds on what you’ve recorded.

Risk Management datasheet
Supplier risks into your register, kept current Each supplier’s open risks, back on its card
Your suppliers too · Third Party Risk Hub

Supplier assurance that doesn’t stop at the questionnaire

Third Party Risk Hub
  1. SendA security questionnaire to every supplier, by secure link.
  2. VerifyRisk Purview checks their answers against what their internet-facing estate shows.
  3. TrackWeekly re-scans, drift alerts and incident broadcasts.
68% of UK SMEs lack formal patch management policies 73% of organisations fail Access Control on first CE assessment 82% of breaches involve a human element — DORA addresses operational resilience 45% of organisations have no incident response plan (CAF Objective C) Only 29% of firms are fully ISO 27001 compliant within 12 months 91% of cyber attacks start with a phishing email Average CE certification takes 4–8 weeks with proper preparation NIS2 affects 160,000+ entities across the EU EU AI Act full compliance deadline: August 2026 for high-risk AI systems Only 14% of organisations have a formal AI governance framework in place

Compliance Hub Frameworks

Each scored in its own terms. Every framework without a lock is in the Assessment Bundle, with a 7-day free trial; a lock marks a specialist assessment, bought on its own or as an add-on to the Bundle.

Not sure where to start?

Free · no account

Compliance Readiness check

30 questions, mapped to Cyber Essentials, ISO 27001, NCSC CAF and DORA at once. See which framework you’re closest to before you choose one.

Start free
7-day free trial

Cyber Resilience Maturity Assessment

Map your cyber maturity across 14 themes, then see which frameworks you’re already close to, from Cyber Essentials to ISO 27001, CAF, DORA and AI Governance.

Start CRMA

Supplying the MOD? Take the free DCC Level 0 check The seven Level 0 questions, scored in your browser.

Crosswalks
★ Featured

Crosswalks: answer once, use it everywhere

Our own control-by-control mappings link Cyber Essentials, CAF, ISO 27001, ISO 42001, CIS Controls v8.1, NIST CSF 2.0, NIS2, DORA, SOC 2 Readiness, UK GDPR, DCC and AI Governance, with each link graded close or partial. For CMMC and FedRAMP, and for HIPAA and NIST CSF 2.0, we build on NIST’s published mappings.

  • A finalised answer shows up as a reference on the related questions of your other frameworks. It never fills in an answer for you.
  • Across your frameworks shows the gaps your linked frameworks share, ranked by how many frameworks one fix counts in
  • Add a shared gap to the Remediation Tracker once, naming every question it also closes
  • Compare a named scope, such as one essential function's CAF, with the ISO 27001 scope covering the same systems; print it for the board or export CSV
See your shared gaps