From a security assessment to an auditor-ready report, in one platform.
Assess your organisation against the frameworks it has to meet: 20 of them, from Cyber Essentials and ISO 27001 to NIS2, DORA and SOC 2. Rules work out where you stand in each standard’s own terms, and Phronesis, our AI, explains what that means and what to do next.
-
1 · Input
Assessments
20 frameworks across UK, EU and US standards, from Cyber Essentials to NIS2, DORA, SOC 2, ISO 42001 and CMMC.
Start with the free check -
2 · Decide
SCH engine
Rules work out the verdict, scores, target, gaps and roadmap.
Same answers, same result -
3 · Explain
Phronesis AI
Explains what it means: the summary, the priorities and their root causes.
Writes the words, never picks the score -
4 · Report
Your report
The verdict and your target, what to fix first, and a roadmap to get there.
PDF · PowerPoint · JSON · shared link -
5 · Prove
Auditor-ready
What good looks like for every gap, and the evidence behind every answer.
Audit Pack with integrity hashes
Your answers, checked against your own tools
- Microsoft 365
- Google Workspace
- Okta
- CrowdStrike Falcon
The SCH engine checks each answer against what your tools show. An answer they contradict counts lower until an evidence note explains it.
Risk management, with or without an assessment
Your risk register, risk method, RACI, business assets and Statement of Applicability, for ISO 27001, ISO 42001 and the CAF, for your organisation or for each client. None of it waits for an assessment: start here, and assess once your management system has taken shape. The assessment then builds on what you’ve recorded.
Supplier assurance that doesn’t stop at the questionnaire
- SendA security questionnaire to every supplier, by secure link.
- VerifyRisk Purview checks their answers against what their internet-facing estate shows.
- TrackWeekly re-scans, drift alerts and incident broadcasts.
Cyber Resilience Maturity Assessment
Map your cyber maturity across 14 dimensions — then see exactly which certifications you're already close to achieving, from Cyber Essentials to full ISO 27001.
- 14 themes: Governance, Risk, Resilience, Supply Chain & more
- Maturity pathway: Foundation → Developing → Established → Advanced
- Certify across CE, CAF, DORA, ISO 27001 and AI Governance; cross-map to NIS2, NIST CSF & SOC 2
- Evidence packaged for auditors via Audit Pack, plus a printable Compliance Passport summary
Cyber Essentials Readiness
Self-assess your organisation against all five Cyber Essentials v3.3 technical controls.
DORA Compliance Assessment
Evaluate your organisation against the EU Digital Operational Resilience Act for financial entities.
NCSC CAF Assessment
Evaluate your organisation against the NCSC Cyber Assessment Framework for operators of essential services.
ISO 27001 ISMS Assessment
Evaluate your Information Security Management System against ISO 27001:2022 clauses and Annex A controls.
AI Governance Assessment
Check your AI governance against what the EU AI Act asks of you, with ISO/IEC 42001 and NIST AI RMF as good practice.
Crosswalks: answer once, use it everywhere
Our own control-by-control mappings link Cyber Essentials, CAF, ISO 27001, ISO 42001, CIS Controls v8.1, NIST CSF 2.0, NIS2, DORA, SOC 2 Readiness, UK GDPR, DCC and AI Governance, with each link graded close or partial. For CMMC and FedRAMP, and for HIPAA and NIST CSF 2.0, we build on NIST’s published mappings.
- A finalised answer shows up as a reference on the related questions of your other frameworks. It never fills in an answer for you.
- Across your frameworks shows the gaps your linked frameworks share, ranked by how many frameworks one fix counts in
- Add a shared gap to the Remediation Tracker once, naming every question it also closes
- Compare a named scope, such as one essential function's CAF, with the ISO 27001 scope covering the same systems; print it for the board or export CSV