A compliance assessment should end in a verdict you can defend

Compliance Re-engineered

Twenty frameworks. Four live integrations. One platform built for the SMEs and regulated organisations the GRC market forgot.

AI that does the thinking,
not the ticking

Phronesis AI runs on every assessment. Not a chatbot. A structured analysis engine that reads your gaps and tells you what to do about them.

Standard mode scores your answers against the framework. Deep Analysis goes further — it reads your evidence notes, cross-references your connected tools (Entra ID, CrowdStrike, Okta, Google Workspace), and grounds every judgement against the framework’s own official guidance, flagging contradictions between what you said and what your tools actually show. Every finding it raises becomes a tracked action in the Remediation Tracker — not a paragraph you’ll forget by Friday.

That contradiction-flagging goes furthest on SOC 2 Readiness, because SOC 2 itself is built around a distinction most frameworks don’t make: a control being designed — a policy exists on paper — is a different question from whether it’s actually operating, which is what a Type II auditor spends 6–12 months sampling evidence for. A self-reported “yes” can only ever speak to design. A live pull from a connected tool is a genuine, if partial, step toward operating evidence — it confirms the control is true right now, not just written down. Run a Deep Analysis with Entra ID, Okta, CrowdStrike Falcon, or Google Workspace connected, and every control your tools can actually speak to gets checked against what you declared:

Risk Scenarios aren’t hypothetical. A scenario is only surfaced when its enabling weaknesses are actually present — a vulnerability becomes “enabled” when a specific assessment answer fails, when a section score drops below a set threshold, or when a connected tool signal (CrowdStrike, Entra ID, Okta, Google Workspace) surfaces something the self-reported answer didn’t. Close the gap and the scenario’s exposure drops, or it disappears from the list entirely.

Your assessment gaps mapped to real-world loss events — in business terms, not just IT findings.

Not every risk comes from a scored control. The Risk Register in My Hub tracks your organisation’s standing risks — a likelihood and impact you set yourself, an owner, and a decision on how you’re handling it (treat, transfer, accept, or avoid) — whether promoted from a Risk Scenario above, pushed from a Remediation Tracker action, or logged manually for something no assessment can see.

“Compliance shouldn’t require a consultant, a spreadsheet, and a prayer.
It should be continuous, connected, and proportionate to what you actually face.”

One answer, twelve frameworks

Finish a Cyber Essentials assessment on Monday. See it referenced on your CAF assessment Tuesday — without touching a spreadsheet.

Most organisations working toward more than one framework end up answering close to the same question five or six times, once per framework, because CE, CAF, ISO 27001, CIS Controls, NIST CSF 2.0, NIS2 and DCC all ask about MFA, patching, incident response and supplier access — just worded differently and scored differently. ISO 42001 shares its audits, reviews and risk process with ISO 27001, and much of what AI Governance asks. DORA asks much of what NIS2 and ISO 27001 do, from ICT risk management to incident reporting and suppliers. SOC 2 Readiness covers much the same ground as ISO 27001 and NIST CSF 2.0, from access and change to monitoring and recovery. UK GDPR’s security of processing, breach handling and processors meet ISO 27001’s controls, and its notices, consent and individuals’ rights meet SOC 2’s privacy criteria. SCH cross-references every finalised assessment you’ve completed and surfaces what you already said, right underneath the related question on the next framework you run.

Here’s what it looks like in practice — a practitioner who finalised Cyber Essentials starts a NIST CSF 2.0 assessment next, and sees this beneath the related question:

Two more pairs go a step further than the hub above. CMMC Level 2 ↔ FedRAMP and NIST CSF 2.0 ↔ HIPAA aren’t part of the hub — each is backed by a real, official NIST-published control mapping, not our own interpretation, so instead of just showing what you answered elsewhere, SCH suggests a translated answer at medium confidence, which you can accept or override on the spot.