Compliance Has Been
Broken for a Decade
UK SMEs spend 3× more hours on compliance admin than their US counterparts.
The output is a Word document. No one is safer.
We built SCH because the GRC SaaS market spent a decade ignoring the UK. The current landscape is dominated by vendors built for VC-backed startups chasing SOC 2 logos: cloud-native stacks, six-figure contracts, and a US sales motion. Not one of them has invested a single engineer hour in the NCSC Cyber Assessment Framework, the framework UK Critical National Infrastructure actually has to comply with.
Meanwhile the people who genuinely need this stuff, UK SMEs chasing Cyber Essentials, FCA-regulated firms, NHS suppliers, CNI operators, vCISOs, are still running compliance on spreadsheets, Word documents, and three consultants in a Teams call.
“This is not a tooling gap. This is a market failure.”
- Manual questionnaires, blank Word templates
- PDF reports that age badly the moment they’re saved
- Consultant-dependent: expert knowledge locked away
- One framework at a time, one point-in-time snapshot
- No evidence trail, certificates living in email inboxes
- Automated assessment with live tool signals pre-filled
- Real-time scoring that updates as you act and remediate
- Self-serve with expert AI guidance on demand
- CE, CAF, DORA, ISO 27001, AI Act in parallel
- Built-in Evidence Vault with certifier-ready audit pack export
Compliance Re-engineered
Seven frameworks. Four live integrations. One platform built for the SMEs and regulated organisations the GRC market forgot.
Seven production-grade frameworks
Cyber Essentials v3.3, CAF (incl. NHS DSPT), DORA, ISO 27001:2022, AI Governance (EU AI Act / ISO 42001 / NIST AI RMF), SOC Maturity, and the Cyber Resilience Maturity Assessment. 70-question assessments. Weighted scoring. Gap analysis. Not a checklist generator.
Your tools are already producing the signal. We read it.
Microsoft Entra ID, Google Workspace, CrowdStrike Falcon, and Okta connect once and push live telemetry including MFA coverage, endpoint compliance, prevention policies, and identity posture directly into your assessment as pre-filled hints. No manual evidence gathering.
Built for portfolios, not point-in-time projects
Multi-tenant client management, per-client assessment scoping, remediation tracking, AI-generated policy documents, and a public Trust Centre so your clients can show prospects they take security seriously.
AI that does the thinking,
not the ticking
Phronesis AI runs on every assessment. Not a chatbot. A structured analysis engine that reads your gaps and tells you what to do about them.
Analysis, guidance & remediation
Reads your scores, identifies critical gaps, maps your 90-day remediation roadmap, and generates board-ready output. Ask it anything mid-assessment: per-control regulatory guidance, remediation options, what a finding means for your sector. It answers in context. Not generic boilerplate. Calibrated to your actual gaps.
External verification, not self-attestation
Questionnaire distribution to suppliers with no login required. Passive domain scanning across DNS, TLS, breach databases, and Companies House cross-checks self-reported answers against live signals. Monthly automated re-scans alert you when a supplier’s posture degrades between assessments.
- UK SMEs and mid-market organisations chasing Cyber Essentials
- FCA-regulated firms assessing DORA readiness
- NHS suppliers navigating CAF-aligned DSPT obligations
- PE firms doing cyber due diligence on acquisitions
- CNI operators with CAF compliance requirements
- MSPs and vCISOs managing multi-client compliance portfolios
“Compliance shouldn’t require a consultant, a spreadsheet, and a prayer.
It should be continuous, connected, and proportionate to what you actually face.”
How it all fits together
The assessment engine, Phronesis AI, and Supply Chain Risk Manager run on a shared services foundation, with live security-tool integrations feeding real tenant data directly into assessment questions.
See where you actually stand
Start with the Compliance Readiness Assessment. Free, no account needed, cross-framework picture in under 15 minutes. Or go straight to the framework that matters most to your obligations.