Security Compliance Hub — Knowledge Base

🏠What is Security Compliance Hub?

Security Compliance Hub (SCH) is a client-side web platform that helps organisations assess their readiness across the major UK and EU cybersecurity compliance frameworks. It runs entirely in the browser — assessments are saved locally and submitted to the platform only when you run a Phronesis AI analysis.

Frameworks covered

Seven specialist assessments — PE Cyber Due Diligence, SOC Maturity & AI Readiness, the full SOC-CMM assessment (included with SOC Maturity access), CMMC Level 2 Readiness, FedRAMP Rev5 Moderate Readiness, HIPAA Security Rule Assessment, and DCC Readiness Assessment — are bought separately: each on its own, or as an add-on to the Assessment Bundle for less (see Pricing). MSP & vCISO practices add them to their tenancy. All seven are also shown as Restricted-access cards on the public landing page's "More Frameworks" section.

How results work

Every question feeds its section's score, and the section scores make the overall score. Each assessment then rates the result in its own terms, because "ready" means something different in each framework:

• Cyber Essentials, ISO 27001 and ISO 42001: Ready, Nearly ready or Not ready for the target you chose (Cyber Essentials or CE Plus; your next Stage 1, Stage 2 or surveillance audit), worked out from your answers.
• NCSC CAF: how many outcomes meet the target profile you declared.
• CRMA, SOC Maturity and PE Cyber Due Diligence: a maturity tier or level, measured against the target you chose.
• SOC-CMM: a maturity score from 0 to 5 for each domain and overall, worked out as the SOC-CMM tool does, and a capability score from 0 to 3 for Technology and Services, measured against the level you chose.
• DCC Readiness: the highest DCC level your answers meet.
• CMMC Level 2: your SPRS score, out of 110, and the status your answers qualify for: Final Level 2 ready, Conditional Level 2 ready (88 or more, with everything not met allowed on a POA&M) or Not yet ready.
• SOC 2 Readiness: a readiness stage, from Not Yet Ready to Audit-Ready, set by your control design and operating scores.
• NIST CSF 2.0: an Implementation Tier for each Function and for your organisation (its weakest Function's), measured against the target Tier you chose.
• UK GDPR: legal requirements come first. Any one not met makes the result Not Yet Compliant, whatever the maturity score.
• HIPAA: a readiness position. Ready needs 80 % or more, every question answered and every Required specification met.
• CIS Controls v8.1: how many of your Implementation Group's Safeguards are implemented, and how many are left to close. CIS sets no overall score or pass mark.
• NIS2 Directive: how many of the Directive's requirements you meet (or, if you choose, every measure in place, good practice too), and how many are left to close. NIS2 sets no overall score or pass mark.
• DORA: how many of DORA's requirements that apply to you are met (or, if you choose, every measure in place, good practice too), and how many are left to close. DORA sets no overall score or pass mark either.
• AI Governance: how many of the measures that apply to you are met: every requirement met (the EU AI Act's duties for your role and your AI, and data protection law where your AI uses personal data) or, if you choose, every measure in place, good practice too. No law or standard here sets an overall score or pass mark.
• FedRAMP Moderate: how many of your target's controls are in place (the fourteen fix-first controls, or every control in the baseline), and how many are left to close. FedRAMP sets no score or pass mark: an independent assessor tests every control.
• Compliance Readiness: 70 % or above is in good standing, 40–69 % is partial, and below 40 % is a critical gap needing priority remediation.

The printed report shows a section with nothing to score in grey: Not applicable when it is outside your scope, Not answered when you haven't reached it. Neither counts as a failure.

🚀Quick Start

1. Visit securitycompliancehub.io and click Sign In. Create an account with email, Google or Microsoft, and set up two-factor authentication — your 7-day free trial begins automatically.
2. From the landing page, click Compliance Readiness (the "START HERE" card). This 30-question assessment maps your current posture across all frameworks and recommends where to focus next.
3. Answer each question honestly. Use the Phronesis AI button at any point during an assessment for context-aware guidance on a specific question.
4. Click Analyse with Phronesis to generate your full AI report — scores, critical gaps, strengths, and a prioritised roadmap.
5. Open My Hub to see all your results in one place, track progress over time, and access the Compliance Passport for a printable summary.

🔐Signing In & Two-Factor Authentication

Sign in with your Microsoft (work or school, or Outlook.com) account, your Google account, or an email address and a password of at least 8 characters.

Two-factor authentication is required for every account. Your results describe how your organisation could be attacked, so a password alone isn't enough. The first time you sign in, you set it up before going any further:

1. Email and password only: confirm your email address first. Click the link we send you, then I've verified my email. Can't find it? Check your spam folder, or click Resend the email.
2. Install an authenticator app on your phone if you don't have one: Microsoft Authenticator, Google Authenticator or similar.
3. Scan the QR code with the app (or type in the key shown under it), then enter the 6-digit code it shows and click Verify & Enable.

From then on you enter a code from the app each time you sign in. You can't skip the set-up; if you need to stop, Sign out and come back to it.

Microsoft says "Need admin approval"

The first time anyone from your organisation signs in with a work or school account, Microsoft asks whether Security Compliance Hub may sign you in. We're a Microsoft-verified publisher, shown by a blue badge on that screen, so if your organisation lets people approve apps from verified publishers you just click Accept.

If your organisation lets only its administrators approve new apps, you see Need admin approval or Approval required instead. An administrator approves it once, for everyone in your organisation. Nobody needs to register or set up anything in Azure.

Signing in asks only who you are: your name, your email address and your Microsoft account ID. It can't read your email, files, calendar or directory.

Your administrator can approve it in either of two ways:

• Approve your request. If Microsoft shows Request approval, send it with a short reason. Your administrator finds it in the Microsoft Entra admin center under Enterprise applications → Admin consent requests. Once they approve it, sign in again.
• Sign in once themselves. An administrator who can approve apps for your organisation (a Global Administrator, Cloud Application Administrator or Application Administrator) clicks Sign in with Microsoft on our sign-in page, ticks Consent on behalf of your organization on Microsoft's screen, and clicks Accept. That also gives them an account, and they can sign out straight away.

Connecting your Microsoft 365 tenant, so your answers are checked against it, is a separate approval with its own permissions. A Global Administrator gives it through a connection link: see Integrations.

🗺️Choosing a Framework

Start with Compliance Readiness if you're unsure — it identifies your priority framework in 10–15 minutes. Otherwise use this guide:

By organisation type

• UK public sector / government supplier / CNI operator → NCSC CAF
• EU bank, insurer, investment firm, or payment institution → DORA (mandatory from January 2025)
• EU essential or important entity in scope of the NIS2 Directive → NIS2 Directive (energy, transport, health, digital infrastructure, and more)
• Any UK or international organisation seeking ISMS certification → ISO 27001
• SME, charity, or supplier wanting a demonstrable UK baseline cert → Cyber Essentials
• Organisation wanting a prioritised, evidence-based technical control baseline → CIS Controls v8.1 — tiered by Implementation Group (IG1/IG2/IG3) to match your size and risk
• AI developer, deployer, or public-sector AI user → AI Governance
• US-aligned organisation, or any wanting a globally recognised risk-management framework → NIST CSF 2.0 — includes Implementation Tiers and a target Tier
• Want a broad maturity baseline before picking a single certification → Cyber Resilience Maturity Assessment — recommends your next framework based on the strongest readiness signal
• B2B SaaS or service provider preparing for a customer's SOC 2 due diligence → SOC 2 Readiness Assessment — a pre-audit readiness self-assessment, not a substitute for the report itself
• Any UK organisation processing personal data — controller, processor, or both → UK GDPR / Data Protection Assessment — self-serve, included in the Assessment Bundle
• Private equity investor or M&A team assessing a target → PE Due Diligence (on its own, or as an add-on to the Bundle)
• SOC team or MSSP assessing operational maturity → SOC Maturity (on its own, or as an add-on to the Bundle)
• SOC that wants the full SOC-CMM model, with scores comparable to the SOC-CMM tool's → SOC-CMM (same access as SOC Maturity)
• Defense Industrial Base contractor preparing a CMMC Level 2 self-assessment or certification → CMMC Level 2 Readiness (on its own, or as an add-on to the Bundle)
• Cloud Service Provider pursuing a FedRAMP Moderate Authorization to Operate → FedRAMP Rev5 Moderate Readiness (on its own, or as an add-on to the Bundle)
• US covered entity or business associate handling electronic protected health information → HIPAA Security Rule Assessment (on its own, or as an add-on to the Bundle)
• UK Ministry of Defence supplier preparing for Defence Cyber Certification → DCC Readiness Assessment (on its own, or as an add-on to the Bundle)

Framework relationships

Frameworks are not mutually exclusive. A strong Cyber Essentials result significantly overlaps with the ISO 27001 technical controls (Annex A), which in turn covers much of the DORA ICT risk requirements. Achieving CAF Achieved/Partially Achieved across all principles provides strong evidence for NIS2 Article compliance. The Compliance Readiness Assessment cross-maps all four simultaneously.

🔑Trial & Access

7-day free trial

All new accounts automatically receive a 7-day trial of the Assessment Bundle, giving access to all twelve core assessments, each with its full report: your score, your gaps, what to fix first and the roadmap to your target (Compliance Readiness is always free). Trial restrictions:

• PDF, PowerPoint and JSON export are disabled on trial — you can run assessments and view the whole report, but cannot download it.
• Sharing (generating shareable result links) is also disabled on trial.
• Phronesis AI analysis is capped at one run per assessment type during the trial. Phronesis chat and per-question guidance share an allowance of 20 questions for the whole trial.
• Finalising needs a subscription, so a trial assessment can't become your Completed record. Its card on My Hub reads Trial result — subscribe to finalise, with a View plans link. A bespoke framework added to your account (Custom Framework Access) can be finalised like any subscription.
• When the trial ends, Phronesis (analysis, chat and per-question guidance) stops on the assessments the trial covered until you subscribe. You'll see a message saying your free trial has ended, with a link to the plans. Your answers are kept, and Compliance Readiness stays free. The same message, worded "not included in your plan", appears if you open an assessment your subscription doesn't cover.

Subscription options

• Assessment Bundle — Full access to all 12 core assessments (3 Phronesis AI analysis runs per month, shared across all your assessments, raised on request), PDF/JSON export, and sharing. See Pricing.
• Risk Operations — The Assessment Bundle and the Third Party Risk Hub (up to 200 suppliers) on one subscription, for one person or a team of up to 11, at £1,988 a year less than buying both. The specialist assessments aren't included, but you can add any of them. If you already have the Bundle or the Third Party Risk Hub, contact us to switch and we'll credit what's left of your current year. See Pricing.
• CE One-Shot — Single Cyber Essentials analysis with 30-day read-only access. Useful for one-off assessments.
• Specialist assessments (PE Due Diligence, SOC Maturity with SOC-CMM, CMMC Level 2 with FedRAMP Moderate, HIPAA Security Rule, DCC Readiness) — Each can be bought on its own (£1,499 a year; £1,799 for CMMC and FedRAMP together), or added to the Assessment Bundle for less (£850 a year; £1,000 for CMMC and FedRAMP). New subscribers save 17% in year one. On its own you get the assessment with Phronesis analysis (Standard and Deep), the Evidence Vault, Audit Pack, Remediation Tracker and Risk Register for it, and a daily Phronesis chat allowance; the core frameworks and the Policy Generator come with the Bundle. Repeatable analysis, metered by a shared monthly allowance (default 3 runs/month, raised on request). If you buy one on its own and later get the Bundle, it renews at the add-on price. If your Bundle ends, an add-on ends with the year you've paid for, unless you choose Keep it on its own on the Billing page. See Pricing.
• Demo access — Sales-demo accounts (demo_access claim) get unlimited access to every assessment in the platform including PE Due Diligence, SOC Maturity, CMMC Level 2, FedRAMP Moderate, and HIPAA Security Rule, with no trial restrictions, no export gate, and no monthly analysis limit.

Buying is covered by our Terms of Service: plans are for business use, renew yearly at the standard price until you cancel, and when you cancel you keep access to the end of the year you've paid for. Prices exclude VAT.

Buying online and managing billing

Where a plan can be bought online, Buy now on the pricing page opens our checkout page. It shows the plan, what it includes and your price before VAT: the first-year price if you're new to that plan, the standard price if you've had it before. For a team plan you name the team and choose up to 10 additional seats; you're the owner and first seat, and you invite the others after paying. Continue to payment opens the payment form on the same page, where you enter your billing address, VAT number and card and accept the Terms of Service. Card details go straight to Stripe, our payment provider; we never see them. Access starts as soon as the payment goes through. We email you a welcome with what you bought, where to start and, on a team plan, how to invite your team; Stripe emails your receipt and VAT invoice separately. A specialist assessment is priced for your account: as an add-on if you have the Assessment Bundle, on its own if you don't, and the checkout says which and what the other would cost. If the page says a plan can't be bought online for your account, it says why and where to go instead.

Once you've bought online, Manage billing on My Hub opens the Billing page. There you can see each plan's renewal date and price, cancel a renewal (you keep access to the end of the year paid for) or change your mind with Keep my subscription, update your card, change your billing name, address and VAT number, and download your invoices. On a team plan, the team's owner manages billing. Plans arranged with us are invoiced directly, so they don't appear there.

🔍Compliance Readiness Assessment Free

A 30-question cross-framework health check that simultaneously maps your posture against Cyber Essentials, ISO 27001, NCSC CAF, and DORA, with an indicative line for Defence Cyber Certification (DCC) Level 1. Designed as a starting point — takes 10–15 minutes and requires no login for analysis (anonymous session).

Domains covered

Governance & Risk, Access Control, Network & Boundary, Secure Configuration, Patch & Update Management, Incident Response, and Third-Party & Supply Chain. Each question maps to one or more of the four target frameworks, and most also to DCC Level 1 controls.

The DCC line is an indication, not a Level 1 result: this check has no physical or personnel security questions, and DCC asks for evidence on every control. It's never named as your closest framework. Suppliers to the MOD can follow its link to the full DCC Readiness Assessment.

Output

Phronesis produces a cross-framework readiness matrix showing which framework you're closest to achieving, a prioritised gap list, and a recommended roadmap sequencing your compliance journey.

🛡️Cyber Essentials CE

Aligned to the NCSC Cyber Essentials v3.3 scheme — the UK government-backed baseline certification covering five technical controls plus an optional supply chain module.

The six controls

1. Boundary Firewalls & Internet Gateways — Controlling inbound and outbound network traffic.
2. Secure Configuration — Removing unnecessary accounts, services, and default credentials.
3. Security Update Management — Patching operating systems, firmware, and third-party software within 14 days of critical releases.
4. User Access Control — Principle of least privilege, MFA for all internet-facing services and admin accounts.
5. Malware Protection — Anti-malware, application allow-listing, or sandboxing.
6. Scope — Defining and documenting the in-scope boundary for certification.

Scoping your organisation

When you start a new Cyber Essentials assessment, a short "Scope your organisation" questionnaire appears first. Scope is the first thing a certifying body checks and the most common reason an application is sent back, so it is captured up front rather than buried in the questions. It takes about 90 seconds and runs over three steps:

1. Who is being certified — legal entity name, assessment contact, and whether you are scoping the whole organisation or a sub-scope (a division, subsidiary, or single site). If you choose a sub-scope you'll be asked to describe the boundary and how it is separated.
2. What is inside the boundary — sites and countries, whether staff work from home on in-scope devices, a device count broken down by type (desktops, laptops, tablets, phones, servers, thin clients, virtual machines), the operating systems and versions in use, and your cloud services grouped by SaaS, PaaS, and IaaS.
3. Engagement intent — whether you are working towards Cyber Essentials or Cyber Essentials Plus, an optional target date, and whether third parties have access to in-scope systems.

You can skip it and start answering straight away — an amber bar stays at the top of the assessment with a Complete scope button. However, scope must be completed before an assessment can be finalised, because an unscoped result should never reach your Audit Pack or Compliance Passport.

The questionnaire only appears for a genuinely new assessment. Once answered, it will not interrupt a run that is in progress or already analysed. When you finalise a run and later start a fresh one — a re-certification, typically — you'll be asked to confirm scope again, which is exactly when scope changes tend to have crept in.

Phronesis reads the scope to check your answers against it, but never your organisation's legal name or your assessment contact: those stay in your report.

Once you run an analysis, the declared scope appears as its own Scope Declaration appendix page at the very end of the results report — legal entity, scope type and boundary, locations, remote working, device counts, operating systems, cloud services, and your CE vs CE Plus target. It is deliberately last, not first: a certification body such as IASME reviews the findings, then turns to the appendix to check what every answer actually refers to. It prints on its own page when you export to PDF, and is also included in the Audit Pack download alongside your question-by-question Assessment Record — so an assessor working from the pack gets the same declared boundary as one reading the on-screen report.

What the report shows

The report tells you whether you're ready to submit for your target: Cyber Essentials, or Cyber Essentials Plus if you chose it when scoping. You can change the target in the results and the report updates straight away, without running the analysis again.

• Readiness: Ready, Nearly ready or Not ready, worked out from your answers by fixed rules, so the same answers always give the same verdict. Any requirement not met makes it Not ready. Answers you weren't sure of, details the assessor needs that you haven't given, answers that need checking, or an incomplete scope declaration make it Nearly ready.
• Requirements met: the share of the requirements that apply to you that are met, for the whole assessment and for each control. An answer that only needs checking counts half. The verdict isn't read off this figure: one requirement not met still means Not ready.
• Before You Submit: every requirement not met, then every answer to confirm, then every answer to check, each with your answer, what the assessor checks and how to fix it. Some answers that don't fit together are flagged to check: for example, no cloud services when your scope declaration lists some, or the whole organisation in scope when you declared a sub-scope.
• Unsupported software: software in your scope's technology stack that is past its end of support counts as a requirement not met, whatever the answers say.
• Cyber Essentials Plus tests: with Cyber Essentials Plus as your target, the six tests an assessor runs (an external vulnerability scan, a patching check on sampled devices, malware tests by email and through a browser, multi-factor authentication on cloud services, and account separation), each marked likely to pass, at risk or likely to fail from your answers, with what to have ready. If you've connected Microsoft 365, its readiness figures appear here too.
• Good practice: firewall reviews, a software inventory, backups and an incident plan are worth having but aren't Cyber Essentials requirements, so they're listed separately and never change the verdict.
• What the assessor checks: shown under every question, in this platform's own words.

All of this comes with every analysis, including Self-Score. Phronesis adds the written analysis: a summary, a practical note for each item to fix, confirm or check, strengths and next steps, and on Deep Analysis a board-ready summary and a breakdown of each control with something to fix. The printed report opens with a cover showing the verdict and an "At a glance" box, and repeats its footer on every page. The PowerPoint and JSON exports include the verdict, each item with what to do, and the Cyber Essentials Plus tests.

Conditional questions

Some questions only appear based on your earlier answers (e.g. if you confirm cloud services are in scope, cloud-specific questions become visible). Answers to hidden questions are automatically cleared to avoid stale scoring.

Supply chain module

The optional supply-chain section is switched on for you based on your scoping answer: if you said third parties or sub-contractors have access to your in-scope systems, it appears automatically. That is only a starting point — the Supply Chain button in the assessment header turns it on or off at any time, and once you have used that button your choice takes precedence. If you have already added vendors, the section is never hidden automatically.

An optional 7th section lets you assess each vendor individually across 8 weighted questions. Vendor risk is scored 0–100 and adjusted by access level (system, network, data, physical, cloud, limited). Vendors scoring below 40 are flagged as high risk.

Cross-framework hints from CAF, ISO 27001, CIS Controls, NIST CSF 2.0, NIS2, and DCC Readiness

If you've already finalised a CAF, ISO 27001, CIS Controls, NIST CSF 2.0, NIS2, or DCC Readiness assessment, related Cyber Essentials questions show a small note underneath them summarising what you answered on the related item there — e.g. "NCSC CAF B4.b — Secure Configuration: 'Is the config hardened?': Achieved." None of these frameworks share an official control catalog with each other, so this is Security Compliance Hub's own analysis relating similar requirements across frameworks, never an official or certified equivalence — and it is always purely informational. It tells you what you answered elsewhere; it never fills in or suggests a Cyber Essentials answer for you.

🏛️NCSC Cyber Assessment Framework CAF

The NCSC CAF is the assurance framework for Operators of Essential Services (OES) and relevant digital service providers under NIS Regulations. The assessment follows CAF v4.0: all 14 principles across four objectives, and every one of its 41 contributing outcomes, asked as 85 questions.

Scoring

Each question has four answers: Achieved, Partially Achieved, Not Achieved and N/A.

The CAF itself judges contributing outcomes, not individual questions, so your report gives each of the 41 outcomes one status from its answers: Achieved when every answered question is Achieved, Not Achieved when every one is Not Achieved, and Partially Achieved in between. N/A answers are left out. Nine outcomes have no Partially Achieved level in NCSC's guidance (A1.a, A1.b, A1.c, A2.c, A3.a, D1.b, D1.c, D2.a and D2.b), so for those anything short of Achieved counts as Not Achieved.

NCSC sets no overall CAF rating, so the report doesn't make one up. It leads with how many outcomes are at your target, for example "33 of 41 outcomes at target", and what's left to close: "8 to close: 3 not yet achieved, 5 partly achieved." The count is red while any outcome below its target is Not Achieved, amber while the rest are only partly achieved or some aren't answered yet, and green once every outcome meets its target. Each objective and principle shows its own count the same way. The average of your answers (Achieved 100, Partially Achieved 50, Not Achieved 0, N/A left out) is shown too, as context only: it isn't a CAF result.

Your target profile

The CAF doesn't set a target of its own. Whoever oversees you does, in a CAF profile that gives each outcome a target: Achieved, Partially Achieved or no expectation. GovAssure's Government Baseline and Enhanced profiles, the NHS CAF-aligned DSPT and a sector regulator's own Baseline or Enhanced profile are all examples. The platform doesn't hold official profile tables, so you enter yours.

Click Set target profile on the bar above the questions. Say who set it (GovAssure, the NHS CAF-aligned DSPT, your Competent Authority, or another scheme or contract), whether it's Baseline or Enhanced, and the name of the body, then set a target for each outcome. Every outcome starts at Achieved, so you only change the ones your profile sets lower. If you haven't entered a profile, the report holds every outcome to Achieved. You can change it at any time and the report redraws without a new analysis. Clear All clears your answers but keeps the profile.

Your results then show:

• Outcomes at target: the count the report leads with, what's left to close and the profile you're measured against.
• Reaching your target: each objective's progress and, for every outcome below its target, the answers holding it back and what good looks like, NCSC's own indicators for the level you're aiming at.
• Roadmap to the target: the outcomes to close, in phases. Phronesis writes it from your gaps; if it can't, a simple order is used instead (Not Achieved outcomes first, then Partially Achieved) and the report says so.

The printed report, the PowerPoint and the JSON export include the target, the gaps and the roadmap, and lead with the same count as the results page, as does a shared link. The printed report opens with a one-page cover and has the footer on every page.

Indicators of Good Practice

Every outcome (e.g. A1.a — Board Direction) carries a Show Indicators of Good Practice button. Click it and the official NCSC CAF v4.0 wording for what Achieved, Partially Achieved, and Not Achieved actually look like appears beneath the questions for that outcome — so you can score against NCSC's own criteria without leaving the page or cross-referencing the CAF PDF. A small number of outcomes have no official Partially Achieved wording at all (NCSC treats them as a binary Achieved/Not Achieved judgement); the panel says so rather than showing an empty list. This is a reference only — selecting an indicator doesn't set your score for you, since NCSC's own guidance treats these as points for expert judgement across the whole set, not a checklist to tick.

If you run a Deep Analysis (the more thorough of the two analysis depths, available from the Analyse button) and have left a supporting evidence note against a question, Phronesis also cross-checks your declared score and evidence against the official indicator wording for that outcome and flags it under Indicator Contradictions if they genuinely don't line up — for example, evidence describing password-only access for standard users on an outcome scored Achieved for MFA coverage. It only surfaces genuine, material mismatches, not missing detail. Standard-depth analysis is unaffected — this check only runs on Deep Analysis, and only for outcomes where you left evidence.

Deep Analysis on CAF also produces a CAF Practitioner's Supporting Analysis card: your evidence notes, synthesised into bullet points grouped by principle, giving Phronesis a chance to note roadmap items, budget constraints, or planned work as partial mitigations rather than just reading the raw score.

NIS2 cross-mapping

NIS2 has its own dedicated assessment (see the NIS2 Directive Compliance guide). Once it's finalised, Across your frameworks shows where a NIS2 question that isn't in place is linked to a gap in CAF, Cyber Essentials, ISO 27001, CIS Controls or NIST CSF 2.0, so one fix counts in both.

NHS DSPT mode

If you set your sector to Health & Social Care, an NHS DSPT Mode bar appears. Enabling it adds Objective E — Using & Sharing Information Appropriately: the 8 NHS Information Governance outcomes (privacy & transparency, data subject rights, consent, the national data opt-out, information sharing for direct and secondary care, records management, and clinical coding) that the NHS CAF-aligned Data Security and Protection Toolkit adds to the CAF. The 2026-27 toolkit (version 9) is built on CAF v4.0, so it has 49 outcomes: CAF v4.0's 41, which the platform asks, plus these 8. The DSPT readiness figure weighs them the same way.

Tell the tool your organisation type (NHS Trust; ICB, CSU or Arm's Length Body; GP practice; supplier; or other) and it tailors the experience: ICBs, CSUs and ALBs don't perform clinical coding, so that question is hidden and scored N/A automatically, and the independent-audit expectation is set correctly per type (Trusts, ICBs, CSUs and ALBs must have an independent audit of each DSPT submission; designated Operators of Essential Services and suppliers in NHS England's large IT supplier category face a mandatory DSPT audit too; GP practices and others follow a self-assessment route).

Your results gain a DSPT Readiness card showing your CAF score, your Objective E score, and a combined DSPT readiness percentage with a plain-English status — On track for Standards Met (≥70 %), Approaching Standards (50–69 %), or Not yet meeting Standards (<50 %). For 2026-27, Standards Met expects every Objective E outcome at Achieved, and NHS England sends each organisation its full profile. Any outcome rated "Not Achieved" is flagged as a DSPT-blocking risk, and a second radar chart maps all eight Objective E outcomes beside your 14 CAF principles. Phronesis analysis, per-question guidance, and the chat panel all become DSPT-aware, referencing NHS outcome codes (E1.a–E4.b), UK GDPR articles, and the Caldicott Principles. DSPT mode is opt-in and doesn't affect standard CAF assessments.

Quantum Readiness (optional, not scored)

The CAF has no outcome for post-quantum cryptography, so CAF adds it as an optional extra rather than a scored question. Click Add Quantum Readiness near the top of the page to show six questions: whether you know where public-key encryption is used, which of your data must stay confidential beyond 2030, whether your suppliers have post-quantum plans, whether you have an approved migration plan, whether you can change algorithms and certificates easily, and who owns the risk.

These answers never change your CAF score, your radar, your sector benchmark, the Compliance Dashboard or your Audit Pack, and they don't count towards finishing the assessment. Your results show a separate Quantum Readiness card with its own percentage and a suggested next step. Turning the section off hides it but keeps your answers.

In a Deep Analysis, a Cryptography Cross-check card appears if you scored B3.b (data in transit) or B3.c (stored data) as Achieved but haven't recorded a cryptographic inventory. NCSC's Achieved indicators for those outcomes expect justified confidence in how your data is protected, which is hard to show without knowing where vulnerable encryption is used. The card doesn't change your score; it's a point to be ready to evidence.

Essential Function / System Scope (for Operators of Essential Services)

Cyber Essentials scopes to your whole organisation; a CAF assessment for a designated Operator of Essential Services (OES) under the NIS Regulations 2018 is different — it scopes to the specific system that delivers your essential function. A train operator's essential function, for example, might be delivered by its rail traffic management system, not its HR or payroll systems.

For the five sectors covered by the NIS Regulations — Energy, Transport, Health & Social Care, Water, and Digital Infrastructure — an Essential Function / System Scope bar appears beneath the sector selector. Declaring your scope records your essential function, the system(s) it covers, your scope boundary, and (for Transport) your sub-sector, which determines your Competent Authority: Ofgem for Energy; DfT (supported by ORR) for Rail, the CAA for Aviation, the MCA for Maritime, and DfT again for Road; DHSC/NHS England for Health; the DWI for Water; and the ICO for Digital Infrastructure.

The declaration also asks which profile you're held to: Baseline or Enhanced. Your Competent Authority issues the profile and decides which applies to your essential function based on its criticality; some regulators are moving higher-criticality OES toward Enhanced over time (Ofgem, for example, has set an end-2027 deadline for its higher-tier energy OES). There's no official third tier. A short explainer appears the moment you open the scope declaration, before you pick anything. The profile's per-outcome targets go under Set target profile (see Your target profile above), and your results compare the run with them, for example "36 of 40 assessed outcomes meet them, 4 to close". Until you enter the targets, the report says so rather than guessing. It's never a certification or a stand-in for your Competent Authority's own determination.

This is entirely optional and never hides or affects the scoring of any CAF question — it exists purely to give your report and Phronesis guidance the right regulatory context.

Cross-framework hints from Cyber Essentials, ISO 27001, CIS Controls, NIST CSF 2.0, NIS2, and DCC Readiness

Once you've finalised a Cyber Essentials, ISO 27001, CIS Controls, NIST CSF 2.0, NIS2, or DCC Readiness assessment, related CAF outcomes show a small note underneath the first question in that outcome group summarising what you answered on the related item elsewhere, along with the date it was finalised. As with the equivalent hints on Cyber Essentials, ISO 27001, CIS Controls, NIST CSF 2.0, and NIS2, this is Security Compliance Hub's own judgement about related requirements — not a recognised industry equivalence — and it never suggests an answer for the CAF question itself.

Several CAF scopes

If parts of your organisation need their own CAF assessment — a rail operator's train control systems and its passenger systems, for example — use + Add another scope on the CAF card in My Hub (or on a client's CAF card in the MSP Portal) and give the scope a name. Each scope is tracked separately: its own progress, results, finalised record, Audit Pack, evidence files and remediation items. Rename or delete a scope with the pencil and bin icons on its card; deleting a scope removes everything recorded against it. You can have up to 20 scopes per framework.

Once you have a second scope, you can name your first, main run too ("National network", say) with the pencil on its card. The name shows on the card and on the Risk management page, where your risks can say which scope they belong to.

Your main CAF run is still the one used for sector benchmarking, the Framework Coverage radar, Cross-Framework Risk Signals, the Compliance Passport and the Policy Generator. Across your frameworks compares the main run too, unless you choose a CAF scope there. Cross-framework hints use every finalised scope: a related Cyber Essentials, ISO 27001, CIS Controls, NIST CSF 2.0 or NIS2 question shows a separate note for each finalised CAF scope, naming it — for example (Rail Systems scope, finalised 2026-08-06) — so answers about different systems are never mixed together. You see the same notes whichever of your scopes you're working in.

⚡DORA DORA

The Digital Operational Resilience Act (EU 2022/2554) applies to EU-regulated financial entities from January 2025. The assessment maps to Articles 5–45 across five pillars.

The five pillars

1. ICT Risk Management (Arts. 5–16) — Governance framework, risk identification, protection (including cryptographic controls and post-quantum readiness), change management, detection, response, recovery and internal audit of the framework.
2. ICT-Related Incident Management (Arts. 17–23) — Classification, reporting, post-incident review.
3. Digital Operational Resilience Testing (Arts. 24–27) — Including Threat-Led Penetration Testing (TLPT), for entities their competent authority identifies.
4. ICT Third-Party Risk (Arts. 28–30) — The register of information, due diligence, contractual requirements (including suppliers' post-quantum roadmaps), concentration risk and exit plans. The oversight of critical ICT providers (Arts. 31–44) applies to those providers, not to you.
5. Information Sharing (Art. 45) — Taking part in threat intelligence sharing is voluntary; if you do, the arrangement has rules and your competent authority must be told.

Since October 2026 two questions ask about change management (Article 9(4)(e)) and internal audit of the framework (Article 6(6)); if you'd already answered everything, answer them before finalising.

Entity type selector

Choose your entity type (credit institution, investment firm, insurance, payment or e-money institution, crypto-asset service provider, CSD or CCP, fund manager, ICT third-party provider, or another financial entity) in the bar above the questions. Every entity answers every question; your choice sets a note in the report on how DORA applies to you, such as the simplified framework some small firms use, the relief for microenterprises, or when threat-led penetration testing is required. The note is a readiness indicator, not a legal determination.

How your report reads

DORA sets no overall score or pass mark, so your report leads with how many of its requirements that apply to you are met, for example 26 of 42 applicable requirements met, then what's left to close. Each question is either a requirement, a measure DORA's own text asks of the financial entities it covers (45 in all), or good practice, how financial entities commonly show a measure works, or a voluntary step DORA encourages (10 in all). Your target is every requirement met or every measure in place, good practice too; if you don't choose one, the report aims for the next one up. The count is red while any measure your target takes isn't achieved, amber while the rest are only partly achieved or not yet answered, and green when every one is met. Not applicable is accepted only where DORA spares you a measure (a microenterprise, an entity not identified for threat-led penetration testing, no ICT provider supporting a critical or important function, or no information-sharing arrangement); anywhere else the report lists it as an answer to check and leaves it out of the count until you answer it. Each pillar shows its own count, and the average of your answers is shown for context only. The count, the lists and the roadmap come from your answers by fixed rules, so the same answers always give the same report; Phronesis writes the explanation.

• Fix first: eleven requirements that come first whatever your count says, such as classifying incidents against DORA's criteria, reporting major incidents on time, detection, strong authentication and backups, each with the reason.
• Meeting every requirement: every measure your target takes still to close, fix-first ones first, then what isn't achieved before what's partly achieved, each after anything it needs first, with what good looks like and the evidence to keep. Good practice not yet achieved is listed beside it.
• Roadmap: those measures in up to four steps. Phronesis's roadmap is used when it places each measure exactly once; otherwise the page writes its own and says so.

Every question has a collapsed What good looks like note with the Article it comes from. The printed report's cover leads with your count, and the PowerPoint, JSON export and shared links include it. When Phronesis gives no action items, the measures to close become your Remediation Tracker items.

Answers from NIS2 and ISO 27001

If you've already finalised a NIS2 or ISO 27001 assessment, related DORA questions show a small note underneath them summarising what you answered there, with the date it was finalised: incident management, reporting, continuity, backups, access control, patching, suppliers and more. Where DORA asks for more, the note says so: under reporting major incidents, for example, it gives DORA's own deadlines (an initial notification within 4 hours of classifying an incident as major, and no later than 24 hours after becoming aware of it). It works the other way too: a finalised DORA run shows under the related NIS2 and ISO 27001 questions, naming the DORA Article each answer comes from. Threat-led penetration testing, the yearly report on your ICT arrangements, exit strategies and information sharing have no counterpart in either, so those questions show no note. Like every cross-framework note, it's our own analysis, never an official equivalence, and it never fills in an answer. A finalised DORA run also joins Across your frameworks, which shows the gaps it shares with NIS2 and ISO 27001.

📋ISO 27001:2022 ISO

An ISMS assessment aligned to the 2022 revision of ISO/IEC 27001, including its 2024 amendment on climate change, covering the management system clauses (4–10) and the Annex A control catalogue. The report tells you how ready you are for your next certification audit.

Sections

30 questions cover the clauses: Clause 4 (Context), Clause 5 (Leadership), Clause 6 (Planning), Clause 7 (Support), Clause 8 (Operation), Clause 9 (Performance Evaluation) and Clause 10 (Improvement). 46 cover Annex A, whose 93 controls the 2022 revision grouped into 4 themes (Organisational, People, Physical, Technological). Some questions cover several related controls, so between them they cover all 93.

The clause questions have no "Not applicable" answer: every certified ISMS must meet clauses 4 to 10. If you answered one "Not applicable" before September 2026, it now shows unanswered, with a note at the top of the page asking you to answer it again.

In October 2026 six Annex A questions were added for controls the assessment didn't ask about: security in projects (A.5.8), return of assets (A.5.11), documented operating procedures (A.5.37), working in secure areas (A.7.6), secure disposal or reuse of equipment (A.7.14) and audit testing on live systems (A.8.34). If you had answered every other question, a note at the top of the page lists the new ones, and you'll need to answer them before you run a Standard or Deep Analysis or finalise.

Climate change (Amendment 1:2024)

In February 2024 ISO amended clause 4.1 to require every organisation to decide whether climate change is a relevant issue for its ISMS, and added a note to clause 4.2 that interested parties can have requirements related to climate change. The clause 4.1 question asks about it, with examples in its help, such as flooding, heat or storms disrupting your sites, data centres, power or suppliers. You don't have to find that climate change is relevant: the auditor looks for the decision and how you reached it, usually recorded with your other internal and external issues. Certification bodies check it as part of clause 4 at your next audit, with no separate transition. If you answered the clause 4.1 question before October 2026, check your answer still holds.

Your next audit

Choose the audit you're preparing for in the bar above the questions, and add its date if you know it:

• Stage 1: the auditor reviews your ISMS documentation, scope, risk assessment and Statement of Applicability, checks that internal audit and management review are at least planned, and decides whether you're ready for Stage 2.
• Stage 2: the certification audit, which checks that your ISMS is in place and working.
• Surveillance: the regular audit once you're certified, which checks that it is still working.

Until you choose, the report shows your readiness for Stage 2. You can change the audit or its date in the results and the report updates straight away, without running the analysis again.

What the report shows

• Readiness: Ready, Nearly ready or Not ready for that audit, and why, worked out from your answers.
• Documents the auditor will ask for: the 14 documents and records ISO 27001 requires, such as your ISMS scope, risk treatment plan, Statement of Applicability and internal audit results, each marked in place, partly in place or missing.
• Likely findings: every answer that isn't fully in place, graded the way a certification body would probably see it. A clause requirement that isn't in place is a likely major nonconformity, and one partly in place a likely minor. An Annex A control that isn't in place is a likely minor nonconformity, one partly in place an observation, and one marked not applicable an exclusion you'll need to justify. At Stage 2 and surveillance audits, internal audit and management review that are only partly done count as likely majors, because both must be complete.
• What an auditor looks for: shown under every question, and with each likely finding.
• Roadmap to your audit: phases that close the likely findings, most serious first, with a date for each phase when you've set an audit date.
• Statement of Applicability starter: a CSV listing all 93 Annex A controls, each with the question that covers it and your answer. It's a starting point for your own Statement of Applicability, not the finished document.

All of this comes with every analysis, including Self-Score. Deep Analysis adds a board-ready summary and a root-cause breakdown for each section with a likely nonconformity. The printed report opens with an "At a glance" summary of your readiness, and the PowerPoint and JSON exports include the documents, findings and roadmap.

Cross-framework hints from Cyber Essentials, CAF, CIS Controls, NIST CSF 2.0, NIS2, and ISO 42001

If you've already finalised a Cyber Essentials, CAF, CIS Controls, NIST CSF 2.0, NIS2, ISO 42001, DORA, SOC 2 Readiness or UK GDPR assessment, related ISO 27001 controls show a small note underneath them summarising what you answered on the related item elsewhere, with a "Cross-framework references below are Security Compliance Hub's own analysis... not an official or certified equivalence" disclaimer above the first one shown. A control with related items in more than one other framework shows separate notes rather than one combined verdict — nothing here is ever averaged or merged into a suggested ISO answer.

Several ISO 27001 scopes

If your organisation has more than one ISMS, each with its own certification scope — a UK head office and an overseas subsidiary, for example — use + Add another scope on the ISO 27001 card in My Hub (or on a client's ISO 27001 card in the MSP Portal) and give the scope a name. Each scope is tracked separately: its own answers, next audit and audit date, results, finalised record, Audit Pack, evidence files and remediation items. Its printed report, PowerPoint and JSON export say which scope they cover, and its Statement of Applicability starter is named after it. Rename or delete a scope with the pencil and bin icons on its card; deleting a scope removes everything recorded against it. You can have up to 20 scopes per framework.

Once you have a second scope, you can name your first, main run too ("Head office ISMS", say) with the pencil on its card. The name shows on the card and on the Risk management page, where your risks can say which scope they belong to. Clear the name to show the framework's name alone.

Your main ISO 27001 run is still the one used for sector benchmarking, the Framework Coverage radar, Cross-Framework Risk Signals, the Compliance Passport and the Policy Generator. Across your frameworks compares the main run too, unless you choose an ISO 27001 scope there. Cross-framework hints use every finalised scope: a related Cyber Essentials, CAF, CIS Controls, NIST CSF 2.0 or NIS2 question shows a separate note for each finalised ISO 27001 scope, naming it, so answers about different ISMSs are never mixed together.

🧭ISO/IEC 42001 AIMS

Certification readiness for an AI management system (AIMS) against ISO/IEC 42001:2023: one question for each requirement of clauses 4 to 10, and one for each of the 38 Annex A controls. The report tells you how ready you are for your next certification audit, as the ISO 27001 assessment does for an ISMS.

Sections

30 questions cover the clauses, in four sections: Context and leadership (4 and 5), Planning (6), Support and operation (7 and 8), and Performance evaluation and improvement (9 and 10). Internal audit has two questions, the programme (9.2.2) and audits carried out (9.2.1), because a planned programme is enough for Stage 1 but Stage 2 needs at least one audit done. 38 questions cover Annex A, one per control, in five sections: Policies and organisation (A.2 and A.3), Resources and impact assessment (A.4 and A.5), AI system life cycle (A.6), Data for AI systems (A.7), and Information, use and third parties (A.8 to A.10).

The clause questions have no "Not applicable" answer: every certified AI management system meets clauses 4 to 10. On an Annex A control, "Not applicable" is an exclusion you justify in your Statement of Applicability.

Your AI role

Clause 4.1 asks what your organisation does with the AI systems in its AIMS. After the welcome, the page asks you to choose every role that applies: you develop or train AI, you provide AI to others, you use AI others provide, or you supply data, components or integration for others' AI. Change it at any time from the Your AI role bar above the questions; it's saved with the assessment, so each named scope keeps its own.

• What an auditor looks for is tailored on a few controls where your role changes the evidence. For an AI system you use rather than build, verification and validation (A.6.2.4) is the supplier's test evidence and your own acceptance testing, for example.
• Controls often excluded for your role are marked, under the question, in your findings and in the Statement of Applicability starter: design and development for an organisation that neither develops nor provides AI, data for development for one that neither develops AI nor supplies data, and customers for one that provides nothing to customers.
• Your role never hides a question or changes a grade. Every Annex A control stays in your Statement of Applicability, and excluding one is still your own "Not applicable" answer, with a justification.

Your next audit

Choose the audit you're preparing for in the bar above the questions, and add its date if you know it: Stage 1 (the auditor reviews your AIMS documentation and checks that internal audit and management review are at least planned), Stage 2 (the certification audit, which checks the AIMS is in place and working) or a surveillance audit once you're certified. Until you choose, the report shows your readiness for Stage 2. You can change the audit or its date in the results and the report updates straight away, without running the analysis again.

What the report shows

• Readiness: Ready, Nearly ready or Not ready for that audit, and why, worked out from your answers.
• Documents the auditor will ask for: 15 documents and records, such as your AIMS scope, AI policy, Statement of Applicability, impact assessments and internal audit results, each marked in place, partly in place or missing. The first eight are reviewed at Stage 1; the Stage 2 audit samples the rest.
• Likely findings: every answer that isn't fully in place, graded the way a certification body would probably see it. A clause requirement not in place is a likely major nonconformity, and one partly in place a likely minor. An Annex A control not in place is a likely minor, one partly in place an observation, and one marked not applicable an exclusion to justify. At Stage 2 and surveillance audits, internal audits and management review that are only partly done count as likely majors, because both must be complete. At Stage 1, internal audits not yet carried out are a likely minor: they're due before Stage 2.
• What an auditor looks for and the evidence to keep: under every question, and with each likely finding.
• Roadmap to your audit: phases that close the likely findings, most serious first, each dated no later than your audit when you've set its date.
• Statement of Applicability starter: a CSV of all 38 Annex A controls, each with the question that covers it, your answer and whether it's often excluded for your role. It's a starting point for your own Statement of Applicability, not the finished document.

All of this comes with every analysis, including Self-Score. Deep Analysis adds a board-ready summary and a root-cause breakdown for each section with a likely nonconformity. The printed report opens with an "At a glance" summary of your readiness and your AI role, and the PowerPoint and JSON exports include the documents, findings and roadmap.

Cross-framework hints from ISO 27001 and AI Governance

If you've already finalised an ISO 27001 or AI Governance assessment, related ISO 42001 questions show a small note underneath them summarising what you answered there, with the date it was finalised. From ISO 27001 that's what an integrated management system shares: competence, documented information, internal audit, management review, improvement and corrective action, and the risk process, where the note adds that for ISO 42001 the same process has to cover AI risks too. A few controls overlap as well, such as suppliers, event logs and incidents. From AI Governance, it's the clauses and controls each AI Governance question cites as its good practice. A note never fills in an answer: an ISMS isn't your AIMS, and what the EU AI Act asks differs from what an AIMS auditor asks for.

If your finalised AI Governance assessment says whether you build AI, use AI others build, or both, the Your AI role step and bar show the roles that suggests, with Use these roles. Nothing changes until you choose it and press Continue, so check it against the AI systems in this AIMS first. Going the other way, your finalised ISO 42001 answers show up on the related AI Governance and ISO 27001 questions.

Risk management for your AIMS

The Risk management page keeps what an auditor asks to see beside this assessment: the AI risks in your register, scored by your method and owned from your RACI (which can start from ISO 42001's rows), ISO 42001's own Statement of Applicability with the controls often excluded for your AI role suggested for you to decide, your AI systems in Business assets, and an impact assessment for each AI system. Notes under this assessment's questions say what those records support, and your ISO 42001 Audit Pack carries them. You can start there before you run this assessment.

Several AI management systems

If your organisation has more than one AIMS, each with its own certification scope, use + Add another scope on the ISO 42001 card in My Hub (or on a client's card in the MSP Portal). Each scope keeps its own answers, AI role, next audit, results, finalised record, Audit Pack, evidence files and remediation items, and its exports and Statement of Applicability starter are named after it.

🤖AI Governance AI

An AI governance readiness assessment across seven domains, against the EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 in July 2026), UK GDPR and the EU GDPR, ISO/IEC 42001:2023, the NIST AI Risk Management Framework and the UK's AI Cyber Security Code of Practice.

Your AI

Before the questions, six questions about your AI decide which of the 56 apply to you and which are legal requirements: whether the EU AI Act reaches you; whether you build AI, use AI others build, or both; whether any of it is in an area the Act treats as high-risk; whether any of it talks to people, generates content or reads emotions; whether you provide general-purpose AI models (asked only if you build AI); and whether your AI processes personal data. A question you skip, or answer Not sure, counts as applying until you rule it out. Questions that don't apply are hidden and left out of your report and progress. Change your answers at any time from the Your AI bar above the questions; they're saved with the assessment, so each MSP client and named scope keeps its own. A run saved before October 2026 keeps its organisation type (a builder is taken as building and using AI) and asks the rest.

The seven domains

1. AI Strategy & Governance, including prohibited practices and AI literacy
2. Risk Management, including classifying each system under the EU AI Act and serious incident reporting
3. Data Governance, including the lawful basis, impact assessments and retention where your AI uses personal data
4. Transparency & Fairness, including telling people they're dealing with AI, marking AI-generated content and contesting automated decisions
5. AI Security & Robustness
6. Lifecycle & Accountability, including the quality management system and conformity assessment for high-risk AI you provide
7. AI Asset Inventory, Supply Chain & Security Posture — finding every AI system in use (including shadow AI), classifying it, keeping an AI bill of materials, checking what suppliers disclose about their models, verifying model integrity, and monitoring AI security posture. Grounded in NIST AI RMF GOVERN 1.6, ISO/IEC 42001 Annex A.4 and A.10.3, EU AI Act Annex IV and Article 25(4), and the UK Code of Practice for the Cyber Security of AI (Principles 5–7).

Since October 2026 seven questions ask about ruling out prohibited practices (Article 5), documenting a conclusion that a system isn't high-risk (Article 6(3)), telling people and workers about high-risk AI (Article 26(7) and (11)), the general-purpose AI model duties (Article 53), the quality management system (Article 17), conformity assessment, declaration, CE marking and registration (Articles 43 and 47 to 49), and using high-risk AI as instructed (Article 26); if you'd already answered everything, answer the ones that apply to you before finalising.

When the EU AI Act applies

As amended in July 2026: prohibited practices and AI literacy since 2 February 2025, and AI that generates non-consensual intimate images or child sexual abuse material banned from 2 December 2026; general-purpose AI models since 2 August 2025; transparency duties since 2 August 2026, and marking AI-generated output from 2 December 2026 for generative AI already on the market before then; and the high-risk obligations from 2 December 2027 (2 August 2028 for AI built into products already regulated in the EU). Each requirement in your report says when it applies.

How your report reads

No law or standard here sets an overall score or pass mark, so your report leads with how many of the measures that apply to you are met, for example 16 of 33 applicable requirements met, then what's left to close. Each question that applies is a requirement, a measure the law asks of you on your answers about your AI, or good practice, how organisations show their AI is well governed. Your target is every requirement met or every measure in place, good practice too; if you don't choose one, the report aims for the next one up. The count is red while any measure your target takes isn't achieved, amber while the rest are only partly achieved or not yet answered, and green when every one is met. Not applicable is accepted only where a question says when; anywhere else the report lists it as an answer to check and leaves it out of the count until you answer it. Each domain shows its own count, and the average of your answers is shown for context only. The count, the lists and the roadmap come from your answers by fixed rules, so the same answers always give the same report; Phronesis writes the explanation. It's a readiness indicator, not a legal determination.

• Fix first: duties already in force with the heaviest consequences, such as ruling out prohibited practices, the general-purpose AI model duties, AI literacy, classifying each system, transparency, and the lawful basis, impact assessments and automated decisions where your AI uses personal data, each with the reason.
• Meeting every requirement: every measure your target takes still to close: the fix-first ones first, then the requirements in force now, then those that apply from 2 December 2027, then good practice, each after anything it needs first, with what good looks like and the evidence to keep. Good practice not yet achieved is listed beside it.
• Roadmap: those measures in up to four steps. Phronesis's roadmap is used when it places each measure exactly once; otherwise the page writes its own and says so.

Every question has a collapsed What good looks like note saying whether it's a requirement for you, with its citation and when it applies. The printed report's cover leads with your count and your answers about your AI, and the PowerPoint, JSON export and shared links include them. When Phronesis gives no action items, the measures to close become your Remediation Tracker items.

Cross-framework hints from ISO 42001

If you've already finalised an ISO 42001 assessment, the AI Governance questions that cite an ISO/IEC 42001 clause or control as good practice show a small note underneath them summarising what you answered there, with the date it was finalised. A note never fills in an answer. Your finalised AI Governance answers, and what you said about building or using AI, show up on the ISO 42001 assessment in the same way.

🎯Cyber Resilience Maturity Assessment CRMA

A broad-based cyber maturity assessment aligned to the IASME Governance maturity model. Designed as a paid alternative to the free Compliance Readiness check — deeper coverage (73 questions across 14 themes), maturity-tier scoring, and an automatic recommendation of which certification framework you are closest to achieving.

Organisation size

A modal on first use asks whether your organisation is micro/small (under 50 staff), medium (50–249), or large/enterprise (250+). Micro/small organisations see 48 questions — 25 enterprise-only questions (board reporting, dedicated SOC, formal pen-testing programmes, a post-quantum migration plan, etc.) are hidden and auto-scored N/A. An inline toggle lets you change this at any time.

The 14 themes

1. Governance
2. Risk Management
3. Asset Management
4. Identity & Access Management
5. Data Protection
6. Network Security
7. Endpoint Security
8. Vulnerability Management
9. Incident Response
10. Business Continuity & Disaster Recovery
11. Supply Chain
12. Awareness & Training
13. Secure Development
14. Compliance

Maturity scoring

Each answer scores against the IASME maturity scale: Verified = 100, Partially Verified = 50, Not Verified = 0, N/A = excluded from averages. Theme scores roll up to an overall maturity tier:

• Advanced — 75 % or above
• Established — 50–74 %
• Developing — 25–49 %
• Foundation — under 25 %

Your target tier

Choose the tier you're aiming for in the bar above the questions: Developing, Established or Advanced. Until you choose, the report aims for the next tier above where you are now. Every theme has to reach the target, not just your overall score, because the overall score is an average and one weak theme can hide behind several strong ones. You can change the target in the results and the report updates straight away, without running the analysis again.

What the report shows

• Where you are: your overall score and tier, what that tier means, and every theme against your target on the radar and the theme bars.
• Fix first: single answers that matter whatever your scores, such as MFA not in place, backups never tested, no ransomware recovery plan, unsupported systems or vulnerabilities with no fix deadlines. Each says why it matters, what good looks like, the evidence to keep, and anything that has to be in place before it.
• Reaching your target: every theme below your target tier and the fewest controls that bring it up, each with what good looks like and the evidence to keep. The breach and regulatory history questions count in their theme's score but are never suggested as something to put in place.
• Roadmap to your target: up to four phases that close every gap, with the fix-first items and their prerequisites first.
• Framework readiness: your theme scores mapped to six frameworks (Cyber Essentials, NCSC CAF, DORA, ISO 27001, AI Governance and SOC 2 Readiness), with the one to start next marked Recommended and a link to begin it. AI Governance readiness is capped at 65% because CRMA doesn't cover AI-specific areas.
• Priority improvement areas, areas needing attention and strengths, an analysis of your evidence notes, findings from the external attack surface scan when you've run one, and Risk Scenarios.

The tier, Fix first, the gaps to your target and the roadmap are worked out from your answers, so they come with every analysis, including Self-Score. Deep Analysis adds a board-ready summary, a root-cause breakdown for each theme below your target, and up to seven critical gaps (more when there are more fix-first items). The printed report opens with an "At a glance" summary of where you are, your target and what it takes to get there, and the PowerPoint and JSON exports include Fix first, the gaps to your target and the roadmap. The organisation name you type above the questions is never sent to Phronesis.

Supporting evidence

Every question has an optional evidence text field. Evidence text is included in the Phronesis payload and synthesised into a practitionerAnalysis[] section in the JSON response — useful for audit-ready documentation and for justifying maturity scores during certification preparation.

MSP / multi-tenant support

The CRMA can be run on behalf of a client from the MSP / vCISO Portal — assessment state is scoped per client (the localStorage key becomes crma_assessment_v1__msp_<clientId>) and scores are persisted to the MSP client record rather than the operator's personal account.

🇺🇸NIST CSF 2.0 NIST

An assessment against the NIST Cybersecurity Framework 2.0 — the updated US federal baseline for private-sector cybersecurity programme design. Version 2.0 adds a new GOVERN function that covers governance, strategy, risk management, roles, and supply-chain security. Particularly relevant for UK organisations selling into US enterprise or government markets, or seeking to align with internationally recognised security baselines.

The six functions

1. GOVERN (GV) — Organisational context, risk strategy, roles & responsibilities, policy, oversight, and supply-chain risk (new in v2.0)
2. IDENTIFY (ID) — Asset management, risk assessment, and improvement planning
3. PROTECT (PR) — Identity & access, awareness & training, data security, platform security, and resilience of the technology infrastructure
4. DETECT (DE) — Continuous monitoring and adverse event analysis
5. RESPOND (RS) — Incident management, analysis, communications, and mitigation
6. RECOVER (RC) — Recovery planning and communications

Scoring

Each answer uses a four-point scale: Implemented = 100, Partially Implemented = 50, Not Implemented = 0, N/A = left out of the averages. Each Function's score is the average of its answered questions, and the overall score is the average of the six Functions. Each question's help text names the CSF 2.0 subcategories it covers.

Implementation Tiers

CSF 2.0 describes four Implementation Tiers, Partial, Risk Informed, Repeatable and Adaptive, for how rigorous your cybersecurity risk governance and management are. NIST sets no scoring method, so the Tiers in your results are Security Compliance Hub's own reading of your answers, not a NIST determination.

• A Function reaches Risk Informed at 35 %, Repeatable at 60 % and Adaptive at 85 %, as long as the practices that Tier calls for are in place.
• Repeatable needs risk management approved as policy, roles and responsibilities assigned, staff trained for their roles, and security requirements in supplier contracts.
• Adaptive needs you to learn from incidents, recoveries, independent assessments, threat intelligence and supplier monitoring.
• Your organisation's Tier is that of its weakest Function: an average would let a strong Function hide a weak one.

Your target Tier

Choose Tier 2, 3 or 4 in the Target Implementation Tier bar above the questions, or in the results. Every Function has to reach it. If you don't choose one, your target is the next Tier above your current one. Change it in the results and the report redraws straight away, without a new analysis.

Fix first

Some single answers leave you open to the most common attacks whatever your scores say: no MFA on remote and administrator access, backups without a tested restore that ransomware can't reach, no incident or recovery plan, no one responsible for cybersecurity, unpatched software, untracked vulnerabilities, no endpoint protection, no security logs, or unencrypted sensitive data. These are listed first, as critical or high, with why each matters.

Reaching your target, and the roadmap

For each Function below your target, the report lists the practices to put in place, fix-first items and the practices your target Tier requires first, then the fewest others that bring the score up to the threshold. Each practice comes with what good looks like, the evidence to keep and its CSF 2.0 subcategories. The Roadmap puts them into phases, fix-first items first, each practice after anything it depends on. Phronesis writes the roadmap; if it can't, the report works one out from your answers and says so.

Checked against your tools

If you've connected Microsoft 365, Okta, CrowdStrike Falcon or Google Workspace, your report has a Checked against your tools section before the roadmap. It compares what your tools show with your answers on the practices they can speak to: multifactor authentication, hardened configurations, patching, vulnerability management and scanning, anti-malware and EDR, continuous monitoring and a SIEM, and, as figures only, your hardware inventory, privileged access, encryption, security logs and alert triage. An Implemented answer that a reading from the last 30 days puts lower counts as partially implemented, which lowers its Function's score and can lower your Implementation Tier, unless the question's evidence note says how it's in place in a way your tools can't see. Your answers themselves are never changed.

Output

Results also include a 6-axis radar with a ring at your target, each Function's score and Tier, priority gaps, areas needing attention, strengths, an analysis of your evidence notes, and with Deep Analysis an executive summary and a root-cause breakdown of each Function below your target. Save as PDF prints a cover page, the footer on every page and an appendix of your evidence notes. The PowerPoint and JSON exports include your Tiers, the fix-first list, the gaps to your target and the roadmap. With no action items from Phronesis, the practices to reach your target go into your Remediation Tracker.

Cross-framework hints from Cyber Essentials, CAF, ISO 27001, CIS Controls, and NIS2

If you've already finalised a Cyber Essentials, CAF, ISO 27001, CIS Controls, or NIS2 assessment, related NIST CSF 2.0 Subcategory questions show a small note underneath them summarising what you answered on the related item elsewhere, along with the date it was finalised. As with the equivalent hints on those five frameworks, this is Security Compliance Hub's own judgement about related requirements — not a recognised industry equivalence, and not a transcription of NIST's or CIS's own published informative-reference mappings — and it never suggests an answer for the NIST CSF question itself. A question with related items in more than one other framework shows separate notes rather than one combined verdict.

NIST CSF 2.0 is also linked to SOC 2 Readiness: a finalised SOC 2 Readiness run shows under the related NIST CSF questions, naming the AICPA criterion each answer comes from, and a finalised NIST CSF run shows on the SOC 2 Readiness assessment.

Suggested answers from a finalised HIPAA assessment

Separately from the cross-framework hints above, if you've finalised a HIPAA Security Rule assessment, related NIST CSF questions show a small note suggesting an answer — this one is grounded in NIST's own official published crosswalk between the HIPAA Security Rule and the Cybersecurity Framework, so unlike the hints above it carries a genuine suggested value you can accept or override. Still never auto-filled. The reverse also holds: a finalised NIST CSF run suggests answers back on the HIPAA assessment.

💼PE Cyber Due Diligence Restricted

A cyber risk assessment framework for private equity investors evaluating target companies, aligned to the IASME Governance maturity model. 14 themes, 70 questions, with enterprise-only questions filtered for micro/small targets.

Scoring

IASME tier scoring: Verified = 100, Partially Verified = 50, Not Verified = 0, N/A = excluded. Each theme is the average of its answered questions, and the overall score the average of the themes. The tiers are Tier 1 Initial (below 40%), Tier 2 Developing (40%), Tier 3 Defined (60%) and Tier 4 Managed (80%), and the Deal Risk Rating follows the tier: Red at Tier 1, Amber at Tier 2, Green at Tier 3 or 4. Results include the IASME Tier, the RAG Deal Risk Rating, a deal recommendation, a 100-day remediation plan and an estimated remediation cost band.

Two questions record what has already happened rather than a control: the breach history question (T9_3) and the regulatory action question (T14_3). Both have plain answers, where No is the good answer, and neither is ever put forward as something to put in place.

Red flags

Some single answers matter to a deal whatever the scores, so the results start with the red flags they raise: a disclosed breach or undisclosed incident, a regulatory fine or notice, MFA not evidenced on remote and administrator access, backups and tested restores not evidenced, no ransomware recovery procedure, no incident response plan, no one accountable for security, unsupported systems not managed, vulnerabilities not fixed on time, no endpoint protection, no encryption of sensitive data, and no ICO registration. Each is critical or high, and says why it matters and what to ask the target for. Red flags come from the answers, not from Phronesis, so they are the same on every run. Phronesis lists the red flags first among its critical risks (Deep Analysis lists every one), deals with each in its deal protections, and never recommends Proceed while a critical one is open.

Target tier after completion

Choose the tier the target should reach after completion with Target tier after completion above the questions (Tier 2, 3 or 4). Your results then include a Reaching Tier N section: where each theme stands against the target and, for each theme below it, its red flags and then the fewest other controls to put in place and evidence to get there, each with what good looks like. A control that depends on another comes after it (board reporting after a named owner, for example), so the list is also a sensible order of work.

The target applies to every theme, not just the overall score: the overall is an average, so strong themes can hide a weak one. Without a target, the report uses the next tier above the overall score. You can change the target in the results too; the gaps redraw straight away, and a note tells you when the Phronesis narrative was written for a different target. Phronesis aims its 100-day plan at the target, red flags first. When Phronesis doesn't return its own action items, the controls to reach the target are saved to your Remediation Tracker.

Deal protections

Phronesis suggests deal protections based on the findings, in four groups: conditions to meet before completion, undertakings for the first 100 days after it, warranties and indemnities to seek, and insurance points (warranty and indemnity insurance, and the target's cyber insurance). Each red flag is covered by at least one. They are points to raise with your legal and insurance advisers, not legal advice or contract wording.

Information to request from the target

For every answer that isn't fully evidenced, the results list the document or evidence to ask the target's management for, grouped by theme with red flags first. Download CSV gives you the list as a spreadsheet for your data room request, with the reference, theme, question, current answer and what to provide.

Reports and exports

Export PDF prints a report with a cover page (score, tier, deal risk and recommendation, red flags and the target) and the confidentiality band and footer on every page. The PowerPoint export has slides for the red flags, critical risks, deal protections, the 100-day plan, the gaps to your target and the information requests, and the JSON export includes all of them. If you ran the external attack surface and breach check and it found something your answers don't match, the results list it under External Scan Findings to Check. Phronesis isn't sent the target company's name: its request carries the scores, the red flags and gaps worked out from your answers, your evidence notes as you wrote them, the target's size, its industry (SIC) code if you picked the company from Companies House, and the scanned domain if you ran the external scan.

What Deep Analysis adds

Deep Analysis adds a board-ready executive summary, up to seven critical risks rather than three, fuller deal protections, a Theme-by-Theme Analysis (root cause, deal impact, remediation steps and quick wins) for every theme below your target and, where you've added evidence notes, a Practitioner's Supporting Analysis for the deal team. The red flags, the gaps to your target, deal protections and the information requests come with Standard Analysis too.

Repeatable analysis

Analysis runs are repeatable — re-run the assessment as new information comes to light during due diligence, subject to a shared monthly analysis allowance (the same mechanism used across the platform's other assessments), scoped and agreed with our team as part of your engagement.

📡SOC Maturity & AI Readiness Restricted

A SOC capability and AI readiness assessment across 7 domains and 70 questions. Enterprise-only questions are hidden for Small/Mid-size SOC and MSSP configurations.

Domains

1. Governance & Strategy
2. People & Capability
3. Process & Playbooks
4. Technology & Integration
5. Detection & Response Services
6. AI SOC Readiness
7. Target Operating Model

Each domain is scored from its answers (Fully Implemented 100, Partially 50, Not Implemented 0, N/A left out) and placed on a six-level maturity ladder: Level 0 Non-existent (below 20%), Level 1 Initial / Ad-hoc (20%), Level 2 Developing (40%), Level 3 Defined (55%), Level 4 Managed (70%) and Level 5 Optimising (85%). The overall score is the average of the seven domains. Your AI readiness tier comes from Domain 6's score: Not AI Ready, AI Aware (25%), AI Emerging (50%), AI Augmented (70%) or AI Native (85%).

SOC type

Select Enterprise, Small/Mid-size, or MSSP on the welcome modal. Enterprise-only questions (board reporting, SIEM, SOC-specific tooling, etc.) are hidden for non-enterprise types. The inline toggle lets you switch type at any time — hidden question answers are auto-cleared.

Target maturity

Choose the level you're aiming for with Target maturity above the questions (Level 1 to Level 5). Your results then include a Reaching Level N section: where each domain stands against the target, and for each domain below it, the capabilities to put fully in place to get there, the fewest first, each with what good looks like when it's fully implemented. A capability that depends on another comes after it (automated response after AI governance, for example), so the list is also a sensible order of work.

The target applies to every domain, not just the overall score: the overall is an average, so a SOC can reach 55% overall with AI readiness still at Level 1. Without a target, the report uses the next level above your overall score. You can change the target in the results too; the gaps redraw straight away, and a note tells you when the Phronesis narrative was written for a different target. The radar's dashed ring and the marker on each domain bar sit at the target's starting score.

The capabilities to reach the target are saved to your Remediation Tracker when Phronesis doesn't return its own action items, with what good looks like in each item's detail.

Practitioner evidence

Every question has an optional evidence text field. Evidence text is included in the Phronesis payload and contributes to a Practitioner's Supporting Analysis card in the results — useful for creating audit-ready documentation.

What Deep Analysis adds

Deep Analysis adds a board-ready executive summary framed around your target, a Domain-by-Domain Analysis (root cause, risk exposure, remediation steps and quick wins) for every domain below the target, and seven critical gaps rather than three. The gaps to your target, the 90-day roadmap, the AI readiness and operating-model sections, and the practitioner analysis come with Standard Analysis too.

🛰️SOC-CMM Assessment Restricted

The complete SOC-CMM model (version 2.4.2, the advanced edition) as its own assessment: 667 questions across 5 domains and 27 aspects. It sits alongside the shorter Cyber3D SOC Maturity assessment. Open it from the SOC Type window on the SOC Maturity page (Full SOC-CMM assessment), from the link on the SOC type bar, or straight from My Hub or the MSP Portal.

SOC-CMM is the work of Rob van Os (soc-cmm.com) and is published under the CC BY-SA 4.0 licence; SOC-CMM® is his trademark. The questions, the guidance for each level and the scoring are his; the platform adds the report, the targets and the roadmap.

Domains and aspects

1. Business (5 aspects): business drivers, customers and stakeholders, charter, governance, privacy and policy
2. People (5): employees, roles and hierarchy, people management, knowledge management, training and education
3. Process (7): SOC management, operations and facilities, reporting and communication, use case management, detection engineering and validation, automation engineering, log management
4. Technology (4): log monitoring, network monitoring, endpoint monitoring and SecOps automation
5. Services (6): security monitoring, security incident management, forensic analysis, cyber threat intelligence, threat hunting and vulnerability management

Of the 667 questions, 350 measure maturity and 317 measure capability. Capability questions appear only in Technology and Services, where they ask whether the tool or service can do a particular thing.

Importance and scope

Every maturity question has an importance: None, Low, Normal (the default), High or Critical. It weights the question in its aspect's score (0, ½, 1, 2 and 4 times), exactly as the SOC-CMM tool does, so set it to reflect what matters to your SOC. A question set to None drops out of the score and the count of questions to answer. A few questions have a fixed weight in SOC-CMM and can't be changed.

The ten Technology and Services aspects can each be taken out of scope with the switches at the top of the questions, for a service your SOC doesn't run. An aspect out of scope hides its questions, leaves its domain's average and isn't counted towards completion.

How it's scored

Answers run from No (or Never, or Incomplete) up to Fully (or Always), with Not required on the questions SOC-CMM allows it. Each aspect gets a maturity score from 0 to 5, and in Technology and Services a capability score from 0 to 3, from its answers and importances. Each domain's score is the average of its aspects, and the overall score the average of the domains. The rounding follows the SOC-CMM tool's own, so the same answers give the same scores, to two decimal places, as the SOC-CMM workbook. As in the SOC-CMM tool, a question left unanswered scores below No until it's answered, so finish the questions before reading much into the scores.

A domain at 2.88 has reached Level 2, Managed: the level is the whole number the score has reached. The levels are 0 Non-existent, 1 Initial, 2 Managed, 3 Defined, 4 Quantitatively managed and 5 Optimising, and the capability levels 0 Incomplete, 1 Performed, 2 Managed and 3 Defined. On My Hub, in benchmarks and in the MSP Portal, the maturity shows as a share of 5, so 2.88 shows as 58%.

Targets

Choose a target maturity level (1 to 5) and a target capability level (1 to 3) above the questions. Without a choice, the report uses the next level above your current score. The target applies to every domain, not just the overall score. Your results then show which domains reach it and, for each domain that doesn't, the fewest questions to raise to get there, each with what good looks like at the target from SOC-CMM's own guidance. You can change the target in the results; the lists redraw straight away, and a note tells you when the Phronesis narrative was written for a different target.

Questions you've marked Critical and answered at the lowest two levels are listed first under Fix first, whatever the target.

What the report contains

• The overall maturity and capability, the level reached, and how many domains reach your target.
• A radar of the five domains with the target ring, and a bar for each domain.
• Reaching Level N: each domain against the target and the questions to raise, with what good looks like.
• Every Aspect: the score and level of all 27 aspects, with those out of scope marked.
• A roadmap that places every question to raise in a phase, in order, and the Phronesis narrative: summary, critical gaps and strengths.

The actions are saved to your Remediation Tracker. Evidence notes and files can be added to each question, and the assessment can be shared, exported to PowerPoint and JSON, and finalised into the Assessment Archive.

What Deep Analysis adds

Deep Analysis adds a board-ready executive summary framed around your target a Domain-by-Domain Analysis (root cause, risk exposure, remediation steps and quick wins) for each domain below it, and, when you've written evidence notes, a Practitioner's Supporting Analysis drawn from them. The scores, levels, targets and the questions to raise never depend on the depth or on Phronesis: they come from your answers alone.

Not a SOC-CMM assessment by an assessor

This is a self-assessment with the SOC-CMM model. It doesn't certify your SOC, and the report says so. An assessment led by a SOC-CMM practitioner can use these answers as its starting point.

🎖️CMMC Level 2 Readiness Restricted

A readiness assessment against all 110 security requirements in NIST SP 800-171 Revision 2, the practice set required for CMMC (Cybersecurity Maturity Model Certification) Level 2 — the tier the US Department of Defense requires for contractors handling Controlled Unclassified Information (CUI). Built for Defense Industrial Base (DIB) organisations preparing the Level 2 self-assessment their contracts can require, or a C3PAO third-party certification assessment.

Where CMMC stands. Phase 2 of the rollout, which would have required Level 2 certification by a C3PAO in contracts that handle CUI, has been suspended since 13 July 2026 while the Department of War (the Department of Defense) reviews the programme. Contracts can still require a Level 1 or Level 2 self-assessment, and C3PAO assessments remain available to organisations that want certification. So the report aims for a self-assessment unless you choose a C3PAO target.

Requirement families

The 110 practices are organised into the 14 families NIST SP 800-171 defines:

1. Access Control (22 practices)
2. Awareness and Training (3 practices)
3. Audit and Accountability (9 practices)
4. Configuration Management (9 practices)
5. Identification and Authentication (11 practices)
6. Incident Response (3 practices)
7. Maintenance (6 practices)
8. Media Protection (9 practices)
9. Personnel Security (2 practices)
10. Physical Protection (6 practices)
11. Risk Assessment (3 practices)
12. Security Assessment (4 practices)
13. System and Communications Protection (16 practices)
14. System and Information Integrity (7 practices)

SPRS scoring — not a percentage

Most assessments on this platform score as a percentage. CMMC does not: your answers give an SPRS score as the CMMC rule (32 CFR 170.24) works it out, the number the Supplier Performance Risk System holds for a contractor. Scoring starts at 110 points and subtracts 1, 3 or 5 points for every requirement not met, by how much risk that gap represents. A perfect score is 110; an assessment with significant gaps can go negative. A question not answered counts as not met until it is.

Some requirements work differently from a simple met / not met:

• Multi-factor authentication (3.5.3) and FIPS-validated encryption (3.13.11) lose 3 points rather than 5 when partly in place: MFA for privileged and remote access only, or encryption that isn't FIPS-validated.
• Not applicable counts as met on the 20 requirements that can genuinely not apply, such as remote access, wireless, mobile devices, remote maintenance, transported media, alternative work sites, public-facing systems, collaborative devices and VoIP, when you don't use them. You'll need to explain why in your System Security Plan. On any other requirement, Not applicable is scored as not met and listed under Answers to Check.
• The System Security Plan (3.12.4) has no point value, but without one an assessment cannot proceed, whatever the score.

The status your answers qualify for

The result is the CMMC status your answers would qualify for under 32 CFR 170.21:

• Final Level 2 ready: every requirement met.
• Conditional Level 2 ready: an SPRS score of 88 or more, the System Security Plan in place, every question answered, and everything not met allowed on a POA&M (a plan of action and milestones), to be closed within 180 days. Only 1-point requirements can go on a POA&M, plus 3.13.11 when encryption is in place but not FIPS-validated; 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and 3.12.4 never can.
• Not yet ready: anything else. A score of 104 can still be Not yet ready when a 3- or 5-point requirement isn't met, because no POA&M can hold it.

It comes from your answers by these rules, whether or not Phronesis writes the analysis. It is a readiness self-assessment: only your own affirmed self-assessment, entered in SPRS, or a C3PAO assessment gives you a CMMC status.

Your target status, what to meet first and a roadmap

Choose the status you're aiming for in the Status you're aiming for bar above the questions: Conditional or Final Level 2, through a C3PAO or a self-assessment. If you don't choose, the report shows the next status up through a self-assessment, which is what contracts can require while Phase 2 is suspended. A C3PAO target shows a note saying so. You can also change it in the results, which redraw at once without a new analysis.

Reaching your target lists what must be met before the assessment, in order (the System Security Plan first, then what no POA&M can hold, then the fewest others that bring the score to 88), and what can go on a POA&M, with your score now and once those are met. Each requirement shows its points, what good looks like and the evidence to keep, and every question has a What an assessor looks for note. Answers to Check lists Not applicable answers an assessor won't accept, those to justify in your System Security Plan, and questions not yet answered. The Roadmap puts it all into phases, the POA&M last.

The printed report's cover and the PowerPoint lead with the SPRS score and status, and each family shows the points it loses. The JSON export includes the score, the status, your target, what must be met, the POA&M, the answers to check and the roadmap.

Checked against your tools

If you've connected Microsoft 365, Okta, CrowdStrike Falcon or Google Workspace, your report has a Checked against your tools section before the roadmap. It compares what your tools show with your answers on the requirements they can speak to: multifactor authentication, security configuration, malicious code protection and its updates, vulnerability scanning and remediation, flaw remediation, failed sign-in lockout and password reuse, and, as figures only, encryption on mobile devices, audit logging and correlation, password complexity and mobile device connections. CMMC counts a requirement as met only when all of it is in place, and each tool sees only part of your system, so your tools never confirm a Met answer; they can only show that a requirement isn't fully in place. A Met answer that a reading from the last 30 days puts lower counts as partially met, which CMMC scores as not met: the requirement loses its SPRS points (3 of 5 for multifactor authentication and FIPS-validated encryption) unless that question's evidence note says how it's in place in a way your tools can't see. See Security Tool Integrations.

Plain-English guidance, official wording on demand

Each question shows a short, plain-English explanation of what it's actually asking by default. The original NIST wording — the formal "Determine if..." assessment-objective text C3PAOs work from — hasn't gone anywhere: it's one click away behind a "Show official NIST wording" toggle under each question, and it's still what Phronesis grounds its analysis and per-question guidance in.

Suggested answers from a completed FedRAMP assessment

If you have already finalised a FedRAMP Moderate assessment, CMMC automatically shows the equivalent small suggested-answer note under each shared practice, summarising what you answered on FedRAMP and its date — the reverse direction of the FedRAMP-side feature described below. Same trust model: it's a suggestion only, never fills in the CMMC answer for you, and the note only appears once your FedRAMP run has been finalised (not just analysed). This assessment is fully standalone — you do not need to have completed FedRAMP first.

🏛️FedRAMP Rev5 Moderate Readiness Restricted

A readiness assessment against all 323 security controls in the NIST SP 800-53 Revision 5 Moderate baseline — the control set a cloud service offering must satisfy for a Moderate-impact FedRAMP (Federal Risk and Authorization Management Program) Authorization to Operate (ATO), whether pursued via the Joint Authorization Board (JAB) or an individual federal agency sponsor. Built for Cloud Service Providers (CSPs) preparing for a Third-Party Assessment Organization (3PAO) assessment.

This assessment is fully standalone — you do not need to have completed the CMMC Level 2 assessment first, even though the two share 123 controls in common. If you have already finalised a CMMC run, FedRAMP now shows a suggested-answer note on each shared control — see below.

Control families

The 323 controls are organised into the 18 families NIST SP 800-53 Rev 5 defines for the Moderate baseline:

1. Access Control (43 controls)
2. Awareness and Training (6 controls)
3. Audit and Accountability (16 controls)
4. Assessment, Authorization, and Monitoring (14 controls)
5. Configuration Management (27 controls)
6. Contingency Planning (23 controls)
7. Identification and Authentication (27 controls)
8. Incident Response (17 controls)
9. Maintenance (10 controls)
10. Media Protection (7 controls)
11. Physical and Environmental Protection (19 controls)
12. Planning (7 controls)
13. Personnel Security (10 controls)
14. Risk Assessment (11 controls)
15. System and Services Acquisition (21 controls)
16. System and Communications Protection (29 controls)
17. System and Information Integrity (24 controls)
18. Supply Chain Risk Management (12 controls)

How your report reads

FedRAMP sets no score and no pass mark: an independent assessor tests every control in the baseline. So your report leads with how many of your target's controls are in place, for example 294 of 318 applicable controls in place, then what's left to close. Verified counts as in place; Partially Verified and Not Verified are to close; a control that a provider you build on implements is inherited, and answered Verified. Your target is the fix-first controls in place or every control in place; if you don't choose one, the report aims for the fix-first controls, then for every control once they are. The count is red while any control your target takes isn't verified, amber while the rest are only partly verified or not yet answered, and green when every one is in place. Not applicable is accepted with a reason an assessor can check, except on a fix-first control, where the report lists it as an answer to check and leaves it out of the count until you answer it. Each family shows its own count, and the average of your answers is shown for context only. The count, the lists and the roadmap come from your answers by fixed rules, so the same answers always give the same report; Phronesis writes the explanation. The report uses FedRAMP's 2026 terms: a service is certified rather than authorized, and the Moderate baseline is Class C.

• Fix first: fourteen controls that come first whatever your count says, behind conditions FedRAMP has long set before it certifies a service (multi-factor and PIV sign-in, validated encryption in transit and at rest, vulnerability scanning and patching, DNSSEC and incident reporting), each with the reason.
• Putting every control in place (or the fix-first controls): every control your target takes still to close, fix-first ones first, then what isn't verified before what's partly verified, each after the base control it adds to, with what good looks like and the evidence to keep. With the fix-first target, the other controls not yet in place are listed beside it.
• Roadmap: those controls in up to four steps. Phronesis's roadmap is used when it places each control exactly once; otherwise the page writes its own and says so.

Every question has a collapsed What good looks like note. The printed report's cover leads with your count, the evidence notes at the end name each question by its control (for example "AC-2(1) Automated account management"), and the PowerPoint, JSON export and shared links include the count. A Phronesis analysis adds an assessment outlook: what an independent assessment would focus on and a realistic time to close what your target takes. When Phronesis gives no action items, the controls to close become your Remediation Tracker items. This is a readiness self-assessment: nothing in its result is, or speeds up, a FedRAMP certification decision.

Checked against your tools

If you've connected Microsoft 365, Okta, CrowdStrike Falcon or Google Workspace, your report has a Checked against your tools section before the roadmap. It compares what your tools show with your answers on the controls they can speak to: multi-factor authentication for standard accounts, configuration settings, flaw remediation, malicious code protection, system monitoring, vulnerability scanning, failed sign-in lockout and password reuse, and, as figures only, automated configuration management, the component inventory, mobile devices and their encryption, audit records, correlation and privileged accounts. FedRAMP counts a control as in place only when all of it is verified, and each tool sees only part of your system, so your tools never confirm a Verified answer; they can only show that a control isn't fully in place. A Verified answer that a reading from the last 30 days puts lower counts as partially verified, so the control is one to close, unless that question's evidence note says how it's in place in a way your tools can't see. See Security Tool Integrations.

Plain-English guidance, official wording on demand

Each question shows a short, plain-English explanation of what it's actually asking by default. The original NIST wording — the formal "Determine if..." assessment-objective text a 3PAO assessor works from — hasn't gone anywhere: it's one click away behind a "Show official NIST wording" toggle under each question, and it's still what Phronesis grounds its analysis and per-question guidance in.

Suggested answers from a completed CMMC assessment

If you have already finalised a CMMC Level 2 assessment, FedRAMP automatically shows a small suggested-answer note under each control the two frameworks share (CMMC's SP 800-171 practices map onto SP 800-53 via a published NIST crosswalk), summarising what you answered on CMMC and its date. This is a suggestion only — it never fills in the FedRAMP answer for you, and you should still confirm each control reflects the system actually in scope for FedRAMP (a CMMC assessment scopes your organisation's CUI environment, which may differ from the cloud service offering being assessed for FedRAMP). The note only appears once your CMMC run has been finalised (not just analysed) — an in-progress or analysed-but-unfinalised CMMC run won't be picked up yet.

⚕️HIPAA Security Rule Assessment Restricted

A readiness assessment against the HIPAA Security Rule (45 CFR Part 160 and Part 164 Subpart C) — the Administrative, Physical, and Technical Safeguards that US covered entities and business associates must implement to protect electronic protected health information (ePHI). Built for organisations preparing for their own required Security Risk Analysis, an OCR audit, or a business associate due-diligence review. Scope is deliberately the Security Rule only — the HIPAA Privacy Rule and Breach Notification Rule are not covered.

Required vs. Addressable — not a simple met/not-met

HIPAA's own regulation splits every implementation specification into two kinds, and this assessment scores them differently:

• Required specifications must be implemented as stated — there is no alternative pathway. These questions offer three answers: Met, Not Met, Not Applicable.
• Addressable specifications are not optional, but they're not rigid either: the organisation must assess whether the specification is reasonable and appropriate for its own environment, and either implement it or implement an equivalent alternative measure that achieves the same protective intent. Doing so satisfies the standard — it is not a lesser or partial compliance state. These questions offer a fourth option, "Addressed via alternative measure," scored identically to a full "Met."

Phronesis is told which kind each question is, so it never suggests declining an Addressable specification without a documented risk-based rationale, and never treats a Required specification as if it had an alternative pathway it doesn't.

What's covered

47 questions across three sections, mirroring the Security Rule's own structure: Administrative Safeguards (§164.308 — 28 questions, covering security management, workforce security, information access management, security awareness and training, contingency planning, and business associate agreements) — this section also folds in the related Organizational Requirements (§164.314) and Policies, Procedures & Documentation requirements (§164.316); Physical Safeguards (§164.310 — 10 questions, covering facility access controls, workstation use and security, and device and media controls); and Technical Safeguards (§164.312 — 9 questions, covering access control, audit controls, integrity, person or entity authentication, and transmission security).

Full platform integration

Same treatment as every other paid assessment: Evidence Vault (attach supporting files to any question), Audit Pack export, Remediation Tracker, PDF/JSON/PowerPoint export, shareable read-only links, sector benchmarking, Ask Phronesis chat, and MSP Portal support for practitioners managing multiple client organisations.

Cross-references your NIST CSF 2.0 answers

If you have already finalised a NIST CSF 2.0 assessment, HIPAA automatically shows a small suggested-answer note under each question the two frameworks share (grounded in NIST's own official published crosswalk between the HIPAA Security Rule and the Cybersecurity Framework), summarising what you answered on NIST CSF and its date — and the same happens in reverse on the NIST CSF assessment once a HIPAA run is finalised. This is a suggestion only — it never fills in the answer for you. The note only appears once the source run has been finalised (not just analysed); an in-progress or analysed-but-unfinalised run won't be picked up yet.

How it's rated

The Security Rule sets no score, so the report gives a readiness position from your answers: Ready, Partially Ready or Not Ready. Ready needs 80 % or more overall, every question answered and every Required specification met, so one Required specification not met keeps the result below Ready, however high the score. Below 50 % is Not Ready. The position comes from your answers by these rules, whether or not Phronesis writes the analysis, and it never says "compliant".

Not Applicable is accepted only on the three specifications that can't arise in some organisations: protecting a clearinghouse's ePHI within a larger organisation, business associate contracts (when no business associate handles ePHI for you) and group health plan documents. Anywhere else the report lists it as an answer to check, and the result stays below Ready until you answer Met or Not Met.

Your target, what it takes and a roadmap

Choose a target above the questions or in the results: Ready, or every specification addressed (every Required one met, and every Addressable one met or addressed with an alternative measure). If you don't choose, the report aims for the next one up. It lists what reaching it takes: the Required specifications not met first, since the Rule allows no alternative for them, then for Ready the fewest Addressable ones that bring your score to 80 %, each with what good looks like and the evidence to keep. A roadmap puts them in order, and changing the target redraws the report straight away, with no new analysis. Under every question, a collapsed What good looks like note says what to have in place and the evidence to keep.

A readiness self-assessment, not a compliance determination

Nothing in this assessment's result constitutes a HIPAA compliance determination, a certification, or a substitute for the organisation's own legally-required Security Risk Analysis (45 CFR 164.308(a)(1)(ii)(A)). It's a structured way to prepare for one, track gaps, and generate an evidence-backed record.

🪖DCC Readiness Assessment Restricted

A readiness assessment for IASME's Defence Cyber Certification scheme (Def Stan 05-138 issue 4), which Ministry of Defence suppliers need at the level their contract's cyber risk profile sets. It covers the scheme's 149 controls across the Governance, Protect, Detect and Respond objectives, plus the scoping statement and the Cyber Essentials prerequisite. Security Compliance Hub is not affiliated with or endorsed by IASME or the MOD, and the questions are written in our own words.

Free Level 0 check

Anyone can take the free DCC Level 0 check, with no account: the seven Level 0 questions, scored in your browser the same way as the full assessment. Nothing is sent anywhere, and your answers stay in that browser. When you first open the full DCC Readiness Assessment in the same browser, it offers to bring those answers in.

Choose a target level

When you start, pick the level you're working towards: Level 0, Level 1, Level 2, or Levels 2 and 3 together. You only see the questions that level asks (from 7 at Level 0 to 348 for Levels 2 and 3), and you can change the level at any time without losing answers. If a control genuinely doesn't apply to your DCC scope, you can mark it not applicable with a reason; the scope and Cyber Essentials requirements can't be marked this way.

How a level is scored

Each control scores full, part or no marks from its questions, and answers are read strictly: a control only counts as met when every requirement behind it is. Levels 0 and 3 need every control fully met. Levels 1 and 2 need at least 80% of each objective's control points, with no control scoring nothing. Every level also needs a complete scope statement and Cyber Essentials, and Cyber Essentials Plus from Level 2.

How your report reads

Your report leads with the highest level your answers meet, for example Partially ready: Level 1 met, Level 2 not yet, then level by level with why, and each objective against the level's 80% mark. Section percentages are shown for context only; the scope statement and Cyber Essentials are pass or fail, never a percentage. Change your target level in the level picker, the bar above the questions or the results, and the report redraws straight away, with no new analysis. The level, the lists and the roadmap come from your answers by DCC's scoring rules, so the same answers always give the same report; Phronesis writes the explanation.

• Fix first: any pass-or-fail requirement not confirmed, and at Levels 1 and 2 any control where nothing is met, since each fails the level on its own, whatever the other controls score.
• Reaching your target: what it takes, fix-first items first, then the fewest partly met controls that bring each objective to its mark, each after anything it needs in place first. Levels 0 and 3 need every control fully met. Each control shows what good looks like and every question short of the baseline with the answer that meets it. Partly met controls the mark doesn't need are listed apart, because an assessor can still move any control down a point.
• Roadmap to your target: those controls in up to four steps. Phronesis's roadmap is used when it places each control exactly once; otherwise the page writes its own and says so.

Each control's heading summarises what good looks like, and under every question a collapsed What meets the baseline note gives the strict answer. A control you mark not applicable is listed with your reason, for the assessor to decide. The printed report's cover leads with your level and an "At a glance" box, the evidence notes name each question by its IASME ID, and the PowerPoint, JSON export and shared links carry the same result. The organisation name you type under the title is saved with your run and fills in the printed report and exports; it is never sent to Phronesis. When Phronesis gives no action items, the controls to close become your Remediation Tracker items.

Cyber Essentials, checked first

The Cyber Essentials section shows your latest finalised Cyber Essentials readiness run on the platform, with its scope, and warns when it looks like it won't cover your DCC scope or is over a year old. This is your platform readiness run, not your certificate.

Full platform integration

Evidence Vault, Audit Pack export, Remediation Tracker, PDF/JSON/PowerPoint export, shareable read-only links, Ask Phronesis chat and help chips, and MSP Portal support. There is no sector benchmark, because a score depends on the level you chose.

Hints from your Cyber Essentials and CAF answers

If you've already finalised a Cyber Essentials or CAF assessment, related DCC controls show a small note under the control's heading summarising what you answered there. It's our own analysis relating similar requirements, not an official equivalence, and it never fills in an answer for you. DCC usually asks for more than Cyber Essentials does, so a "Yes" there is a starting point, not a pass here.

A readiness self-assessment, not a certification

The result tells you how ready you look on your own answers. Only an IASME-licensed certification body can certify your organisation against DCC.

🎯CIS Controls v8.1 CIS

A readiness assessment against all 18 Controls and 153 Safeguards of the CIS Critical Security Controls v8.1 — one of the most widely adopted, prioritised sets of best practices for defending against the most common cyber attacks. Included in the standard Assessment Bundle subscription and the 7-day free trial, alongside Cyber Essentials, CAF, DORA, ISO 27001, AI Governance, and CRMA — no separate purchase or access request needed.

Version 8.1 and our wording

The questions follow version 8.1 of the CIS Controls, published in June 2024. It kept all 18 Controls, all 153 Safeguards and the three Implementation Groups, added a Govern security function and a Documentation asset type to line up with NIST CSF 2.0, and clarified some Safeguard descriptions. Each question shows CIS's number and title for the Safeguard; the description under it is our own summary of what the Safeguard asks, not CIS's text. CIS's full text is at cisecurity.org/controls.

Choose your Implementation Group

Before you start, you'll be asked which Implementation Group (IG) best matches your organisation's size and risk profile. This is CIS's own scoping mechanism, not a maturity ladder — a smaller organisation genuinely complete at IG1 is not "behind" a larger one assessed at IG3:

• IG1 — 56 Safeguards covering essential cyber hygiene. Recommended as a baseline for every organisation, regardless of size or resourcing.
• IG2 — 130 Safeguards, cumulative (IG1 plus 74 more). For organisations with greater IT complexity, multiple departments, and some exposure to targeted attacks.
• IG3 — all 153 Safeguards. For organisations facing sophisticated adversaries, where the impact of a successful attack is high.

Only the Safeguards in your chosen group are shown, counted and sent for analysis — answering every Safeguard in your group counts as a 100% complete assessment, not a partial one. You can change your Implementation Group at any time from the bar above the questions or in your results. Changing it never changes an answer: answers to Safeguards a lower group hides are kept, and count again when you move back up. A Control with no Safeguards in your group reads Outside IG1 (or IG2), in grey, never as a failure.

How your report reads

CIS sets no overall score or pass mark, so your report leads with how many of your group's Safeguards are implemented, for example 92 of 119 applicable IG2 Safeguards implemented, then what's left to close. The count is red while any Safeguard in your group isn't implemented, amber while the rest are only partly implemented or not yet answered, and green when every one is. A Safeguard you haven't answered isn't counted as implemented or as one to close; it's listed as not answered, and keeps the count from going green. Each Control shows its own count, and the average of your answers is shown for context only. The count, the lists and the roadmap come from your answers by fixed rules, so the same answers always give the same report; Phronesis writes the explanation.

• Fix first: answers that leave you open to the most common attacks whatever your count says, such as no MFA on internet-facing services, remote access or admin accounts, or no automated backups. All twelve are IG1 Safeguards, so they apply whichever group you choose.
• Reaching your group: every Safeguard in your group still to close, fix-first items first, then IG1 before IG2 before IG3, each after anything it needs first, with what good looks like and the evidence to keep.
• Roadmap: those Safeguards in up to four steps. Phronesis's roadmap is used when it places each Safeguard exactly once; otherwise the page writes its own and says so.

Every question has a collapsed What good looks like note. The printed report's cover leads with your count, and the PowerPoint, JSON export and shared links include it. When Phronesis gives no action items, the Safeguards to close become your Remediation Tracker items.

Checked against your tools

If you've connected Microsoft 365, Okta, CrowdStrike Falcon or Google Workspace, your report has a Checked against your tools section before the roadmap. It compares what your tools show with your answers on the Safeguards in your Implementation Group they can speak to, such as multi-factor authentication, device compliance, anti-malware coverage and patching of critical vulnerabilities. An implemented answer that a reading from the last 30 days puts lower counts as partially implemented in your count and roadmap, unless that Safeguard's evidence note says how it's in place in a way your tools can't see. See Security Tool Integrations.

Controls covered

The 18 Controls span asset and software inventory, data protection, secure configuration, account and access management, vulnerability management, audit logging, malware defence, data recovery, network infrastructure and monitoring, security awareness training, service provider management, application software security, incident response, and penetration testing.

Full platform integration

Same treatment as every other Assessment Bundle framework: Evidence Vault (attach supporting files to any Safeguard), Audit Pack export, Remediation Tracker, PDF/JSON/PowerPoint export, shareable read-only links, sector benchmarking, Ask Phronesis chat, and MSP Portal support for practitioners managing multiple client organisations.

Cross-framework hints from Cyber Essentials, CAF, ISO 27001, NIST CSF 2.0, and NIS2

If you've already finalised a Cyber Essentials, CAF, ISO 27001, NIST CSF 2.0, or NIS2 assessment, related CIS Safeguards show a small note underneath them summarising what you answered on the related item elsewhere, along with the date it was finalised. As with the equivalent hints on those other frameworks, this is Security Compliance Hub's own judgement about related requirements — not a recognised industry equivalence — and it never suggests an answer for the CIS question itself. A Safeguard with related items in more than one other framework shows separate notes rather than one combined verdict.

🇪🇺NIS2 Directive NIS2

A readiness assessment against the EU NIS2 Directive (2022/2555) — the risk-management measures, incident reporting obligations, governance accountability, and registration requirements it places on operators of essential and important services across the EU. Included in the standard Assessment Bundle subscription and the 7-day free trial, alongside Cyber Essentials, CAF, DORA, ISO 27001, AI Governance, CRMA, and CIS Controls — no separate purchase or access request needed.

A readiness indicator, not a legal determination

Before you start, you're asked which sector best describes your organisation and roughly how large it is. This is purely informational — nothing about your answers here hides, skips, or auto-completes any question, unlike CIS's Implementation Group picker or CRMA/PE Due Diligence/SOC Maturity's organisation-size filters. Whether NIS2 actually applies to your organisation, and whether you're classed as an "Essential" or "Important" entity, depends on facts (headcount, turnover, sector, and how your national government has transposed the Directive) this platform cannot verify — the results page and the Phronesis AI narrative both frame this as a readiness indicator only, never a legal determination of NIS2 applicability or compliance.

The note on your sector and size also names the rules that come with it: for credit institutions and financial market infrastructures, DORA applies in place of NIS2's risk-management and incident-reporting rules, and for digital infrastructure and digital providers, Implementing Regulation (EU) 2024/2690 sets out the measures in detail. A Phronesis analysis adds a regulatory note: the NIS2 points that matter most for your sector and size. It appears in the results and the PowerPoint, after the note on your sector and size.

How your report reads

NIS2 sets no overall score or pass mark, so your report leads with how many of the Directive's requirements you meet, for example 27 of 43 requirements met, then what's left to close. Each question is either a requirement, a measure the Directive's own text asks of every essential and important entity (43 in all), or good practice, how organisations commonly show a measure works (17 in all). Your target is every requirement met or every measure in place, good practice too; if you don't choose one, the report aims for the next one up. The count is red while any measure your target takes isn't achieved, amber while the rest are only partly achieved or not yet answered, and green when every one is met. Not applicable is accepted on four questions only, where the measure can't arise for you (registration, for example, when your organisation is outside NIS2); anywhere else the report lists it as an answer to check and leaves it out of the count until you answer it. Each section shows its own count, and the average of your answers is shown for context only. The count, the lists and the roadmap come from your answers by fixed rules, so the same answers always give the same report; Phronesis writes the explanation.

• Fix first: twelve requirements that come first whatever your count says, such as criteria for a significant incident, the 24-hour early warning, multi-factor authentication and backups out of an attacker's reach, each with the reason.
• Meeting every requirement: every measure your target takes still to close, fix-first ones first, then what isn't achieved before what's partly achieved, each after anything it needs first, with what good looks like and the evidence to keep. Good practice not yet achieved is listed beside it.
• Roadmap: those measures in up to four steps. Phronesis's roadmap is used when it places each measure exactly once; otherwise the page writes its own and says so.

Every question has a collapsed What good looks like note with the Article it comes from. The printed report's cover leads with your count, and the PowerPoint, JSON export and shared links include it. When Phronesis gives no action items, the measures to close become your Remediation Tracker items.

Checked against your tools

If you've connected Microsoft 365, Okta, CrowdStrike Falcon or Google Workspace, your report has a Checked against your tools section before the roadmap. It compares what your tools show with your answers on the measures they can speak to: multi-factor authentication for staff, detecting incidents, vulnerability scanning and patching, and, as figures only, your asset inventory, encryption and privileged access. An achieved answer that a reading from the last 30 days puts lower counts as partially achieved in your count and roadmap, unless that question's evidence note says how it's in place in a way your tools can't see. See Security Tool Integrations.

What's covered

60 questions across 14 themes, built around the Directive's own structure: Governance (Article 20 management-body accountability and training) and Risk Analysis & Security Policies lead the assessment; Incident Handling covers your internal detection, triage, and response capability, while a separate Reporting Obligations section walks through the Article 23 notification timeline itself — the 24-hour early warning, the 72-hour follow-up notification, on-demand status updates, and the 1-month final report, plus customer notification and voluntary reporting of sub-threshold incidents. The remaining themes cover Business Continuity & Crisis Management, Supply Chain Security, Secure Acquisition & Development, Vulnerability Management, Cryptography (including post-quantum readiness), HR Security & Training, Access Control, Asset Management, MFA & Secured Communications, and Registration & Regulatory Engagement (Articles 3(4) and 27). Since October 2026 a Governance question asks how you check that your measures work (Article 21(2)(f)), the one Article 21(2) measure that had no question of its own; if you'd already answered everything, answer it before finalising.

Full platform integration

Same treatment as every other Assessment Bundle framework: Evidence Vault (attach supporting files to any question), Audit Pack export, Remediation Tracker, PDF/JSON/PowerPoint export, shareable read-only links, sector benchmarking, Ask Phronesis chat, and MSP Portal support for practitioners managing multiple client organisations.

Cross-framework hints reaching Cyber Essentials, CAF, ISO 27001, CIS Controls, and NIST CSF 2.0

Once you've finalised a NIS2 assessment, related questions on any of the other five frameworks show a small note summarising what you answered here, along with the date it was finalised — the reverse direction works too, so a finalised CE/CAF/ISO/CIS/NIST CSF run shows hints on your NIS2 questions. As with every other cross-framework hint in the product, this is Security Compliance Hub's own judgement about related requirements — never a recognised industry equivalence, and never a suggested answer for the target question.

NIS2 is also linked to DORA: a finalised DORA run shows under the related NIS2 questions, naming the DORA Article each answer comes from, and a finalised NIS2 run shows on the DORA assessment.

📜SOC 2 Readiness SOC 2

A self-assessment against the AICPA Trust Services Criteria (2017, as revised 2022) — the criteria a licensed CPA firm audits against when issuing a SOC 2 report. Included in the standard Assessment Bundle subscription and the 7-day free trial, alongside Cyber Essentials, CAF, DORA, ISO 27001, AI Governance, CRMA, NIST CSF 2.0, CIS Controls, NIS2, and UK GDPR — no separate purchase or access request needed.

Design vs. operating evidence — why there's no single percentage

A real SOC 2 report distinguishes two things a single percentage would blur together: whether a control is designed (a policy or control exists, documented and approved) and whether it is operating (there's evidence it's actually followed consistently — what a Type II auditor tests over an observation period, typically 6–12 months). A meaningful subset of this assessment's questions are asked both ways, and the answers are worded to match: "In place and documented" for a design question, "Evidenced consistently, with records kept" for an operating one. Your results show two scores, a design score and an operating evidence score, and the one of four Readiness Stages they set: Not Yet Ready (design score below 70%), Design-Ready (design score 70% or more — a Type I candidate), Operating Evidence Building (design 70% and operating evidence 60% or more — ready to start a Type II observation period), and Audit-Ready (85% or more on both). See Type I / Type II in the glossary for what the distinction means in a real engagement.

The stage is the same on the results page, the printed report's cover, the PowerPoint and My Hub, whether or not Phronesis writes the analysis. The cover, the radar and the category scores show only the categories you elected.

Choose the report you're aiming for

Pick it in the bar above the questions, or in your results: a Type I report, starting a Type II observation period, or a Type II audit. Until you choose, the report aims for the next stage above where you are now. You can change it in the results and the report updates straight away, without running the analysis again.

What the report shows

• Where you are: your stage, your design and operating evidence scores against the ones your target needs, a verdict ("Not yet ready to start a Type II observation period: operating evidence 33%, 60% needed"), and every category in scope.
• What an Auditor Would Raise: every answer graded as an auditor testing for your target would be likely to see it. A design control that isn't in place, or is only partly in place or undocumented, is a likely exception, and so is a control with no evidence it runs. One that runs but isn't consistently evidenced is a possible exception for a Type II, because the auditor samples across the observation period. Anything marked not applicable needs explaining in your system description. There's no pass or fail: a SOC 2 report is issued with whatever exceptions exist.
• Getting ready for your target: the fewest controls that bring your scores to the ones your target needs, the controls auditors most often test first, each with what an auditor looks for and the evidence to keep.
• Roadmap: up to four phases that close the controls your target needs and every other likely exception, design work first and a control's design before its operating evidence.
• Critical gaps, areas needing attention, next steps and strengths, an analysis of your evidence notes, and findings from the external attack surface scan when you've run one.

The stage, what an auditor would raise, the gaps to your target and the roadmap are worked out from your answers, so they come with every analysis, including Self-Score. Deep Analysis adds a board-ready summary, a breakdown of each category with a likely exception, and up to ten critical gaps. Every question also has a What an auditor looks for note you can open, and its help text names the criterion it evidences. The printed report opens with an "At a glance" summary of your target, the verdict and what it takes, and the PowerPoint and JSON exports include what an auditor would raise, the gaps to your target and the roadmap. The organisation name you type above the questions is never sent to Phronesis.

What's covered

74 questions across 13 sections. The Security (Common Criteria) category — CC1 Control Environment through CC9 Risk Mitigation, 47 questions — is mandatory, exactly as in a real SOC 2 engagement; no other assessment on this platform requires this section. A scoping step then lets you elect any of four additional Trust Service Categories to include: Availability (capacity, backup, disaster recovery), Confidentiality (classification, encryption, secure disposal), Processing Integrity (input/output validation, error handling), and Privacy (notice, consent, retention, data subject rights). Only elected categories' questions appear — this is purely a scoping choice, never a size-based filter the way CRMA's or CIS's own tiers are. Each assessment keeps its own choice: an MSP client's assessment asks for its own categories the first time you open it, and you can change them any time from the bar above the questions.

Full platform integration

Same treatment as every other Assessment Bundle framework: Evidence Vault (attach supporting files to any question), Audit Pack export, Remediation Tracker, PDF/JSON/PowerPoint export, shareable read-only links, sector benchmarking, Ask Phronesis chat, MSP Portal support, and the Attack Surface Scan widget.

Checked against your tools

Each SOC 2 question names the AICPA criterion it evidences (CC6.1, CC7.1 and so on). If you've connected Entra ID, Okta, CrowdStrike Falcon, or Google Workspace (My Hub → Workspace → Security Tool Integrations), your report has a Checked against your tools section on every depth: each answer your tools can read — access enforcement, removing leavers' access, MFA, malware protection, monitoring and alert handling, vulnerability remediation — with the live figure behind it and whether it agrees with your answer, and the answers where your tools show less than you said grouped by the figure they rest on. It's in the PDF, the PowerPoint deck and the JSON export too. This is always a point-in-time confirmation, not proof a control held consistently over the 6–12 month observation period a real Type II audit tests — treat an agreeing answer as strong supporting evidence, not the audit itself.

Answers from ISO 27001, NIST CSF 2.0 and UK GDPR

If you've already finalised an ISO 27001, NIST CSF 2.0 or UK GDPR assessment, related SOC 2 questions show a small note underneath them summarising what you answered there, with the date it was finalised: risk assessment, access and MFA, leavers, access reviews, monitoring, incidents, change, suppliers, backups and recovery, and, from UK GDPR, your Privacy questions: the privacy notice, consent, collecting only what you need, retention, access and deletion requests, sharing and complaints. Under a question asking for operating evidence, the note adds that a Type II audit samples evidence from across its period, usually 3 to 12 months, so an answer elsewhere shows the control exists, not that it ran all period. It works the other way too: a finalised SOC 2 Readiness run shows under the related ISO 27001, NIST CSF and UK GDPR questions, naming the criterion each answer comes from (CC6.1, for example). Processing Integrity and uptime against a commitment have no counterpart in any of them, so those questions show no note. Like every cross-framework note, it's our own analysis, never an official equivalence, and it never fills in an answer. A finalised SOC 2 Readiness run also joins Across your frameworks, which shows the gaps it shares with ISO 27001, NIST CSF 2.0 and UK GDPR.

Where else this shows up

Complete both Cyber Essentials and ISO 27001 and My Hub shows a private, dismissible note suggesting you may be well-positioned for SOC 2 readiness — a hint only you can see, never published anywhere. The Cyber Resilience Maturity Assessment's framework-readiness cards also include an SOC 2 Readiness estimate (mapped from your CRMA theme scores) alongside its existing CE/CAF/DORA/ISO 27001/AI Governance targets. My Hub no longer estimates a SOC 2 score from your Cyber Essentials and ISO 27001 results (October 2026): SOC 2 Readiness shows its own result once you've run it, like any other framework.

⚖️UK GDPR / Data Protection Assessment GDPR

A readiness self-assessment against UK GDPR (retained EU GDPR as amended), the Data Protection Act 2018, and PECR (electronic marketing and cookies), as amended by the Data (Use and Access) Act 2025. Included in the standard Assessment Bundle subscription and the 7-day free trial, alongside every other core assessment — no separate purchase or access request needed.

Five quick scoping questions first

Before the 65 questions, a short front-door triage asks: are you a controller, processor, or both; do you handle special category or criminal offence data; do you make international transfers outside the UK/EEA; do you meet an Art 37 DPO-mandatory trigger (public authority, large-scale monitoring, or large-scale special-category processing as a core activity); and do you process children's data. These answers determine which of the 9 conditionally-relevant questions actually apply — you're never asked about Standard Contractual Clauses if you never transfer data abroad, for example. Answers are saved and can be changed at any time from the scoping bar above the questionnaire, and sync across your devices.

Gate + maturity scoring — why there's no single percentage

Unlike most assessments on this platform, results here don't reduce to one percentage. 34 of the 65 questions are gates — hard legal requirements such as having a documented lawful basis for every processing activity, or a breach-response plan that addresses the 72-hour ICO notification deadline. Gates render a simple Met / Not Met / N/A choice and are never averaged into a score; a legal requirement either exists or it doesn't. The remaining 31 questions are maturity questions — how consistently a good practice is actually embedded, such as how regularly staff are retrained or how often lawful bases are reviewed — scored on the usual Achieved / Partially Achieved / Not Achieved / N/A scale, and these do build a genuine maturity score.

The two combine into a single headline: your GDPR Readiness Stage. If any applicable gate is unmet or hasn't been assessed yet, you're held at Not Yet Compliant regardless of how high your maturity score is — a business with excellent documentation habits but no recorded lawful basis for its core processing is not "80% of the way there," it has a live legal exposure. Once every applicable gate is met, your maturity score places you at Foundational, Established, or Mature. Your results page shows the stage, the maturity score, and a Legal Requirements section listing the requirements you still need to meet, any that are only advisory, and those met or not applicable, so you can see exactly which one (if any) is holding your stage back. Each one to meet says what good looks like and the evidence to keep.

The stage is the same on the results page, the printed report's cover, the PowerPoint and My Hub, whether or not Phronesis writes the analysis. On the cover, a section with a legal requirement not met says so, in red, whatever its maturity score.

Choose the stage you're aiming for

Pick Foundational, Established or Mature in the Target stage bar above the questions, or in your results. If you don't choose, the report aims one stage above where you are, or, while a legal requirement is open, at the stage your maturity score already reaches, because meeting the law comes first.

Reaching your target lists the legal requirements to meet first, then the fewest good practices that lift your maturity score to the target, each with what good looks like. If you aren't sure whether you need a Data Protection Officer, deciding that is on the list too. Roadmap to your target puts them into phases, legal requirements first. Change the target and the report redraws straight away, without a new analysis. Every question also has a What good looks like note you can open.

The printed cover shows your stage, the legal requirements still open, your target and what it takes. The PowerPoint and JSON exports include the legal requirements, the gaps to your target and the roadmap.

What's covered

65 questions across 12 themes: Governance & Accountability (DPO, policy, training, board reporting), Lawful Basis, Consent & Special Categories (Art 6/7/9/10/8), Transparency & Privacy Notices (Art 13/14), Records of Processing Activities (Art 30 RoPA), Data Subject Rights (Art 15–21, Art 22A–22D automated decisions, and complaints), Privacy by Design & Default (Art 25), DPIA & High-Risk Processing (Art 35/36), Security of Processing (a deliberately brief Art 32 summary — if you've completed Cyber Essentials, CAF, or ISO 27001, that already evidences this in depth), Breach Response & Notification (Art 33/34), International Transfers (Art 44–49), Vendor & Processor Management (Art 28/29), and Direct Marketing & Cookies (PECR).

Up to date with the Data (Use and Access) Act 2025

Most of the Act's changes to UK data protection law took effect on 5 February 2026, and the assessment follows them. Two legal requirements are new: letting people complain to you about how you use their data, with a form they can fill in electronically, an acknowledgement within 30 days and a reply without undue delay (in force since 19 June 2026); and, where you make significant decisions about people by purely automated means, telling them, and letting them make representations, ask for a person to step in and contest the decision. The questions and their guidance also cover recognised legitimate interests, the new lawful basis; the Art 12A time limits for requests; the test for international transfers (protection not materially lower than in the UK); the cookies that no longer need consent; and the soft opt-in for charities.

What Deep Analysis adds

Run a Deep Analysis and, if you have at least one legal requirement that isn't yet Met, your results include a Regulatory Exposure Brief: one entry per unmet gate explaining, in plain terms, the pattern of regulatory risk that category of gap tends to attract — for example, how consistently the ICO enforces breach-notification timeliness specifically. It's written to be a useful, honest picture of enforcement tendencies, never a specific fine figure, a named case, or a prediction about what would happen to your organisation — this stays a readiness self-assessment, not legal advice.

If you've left supporting evidence notes against any questions, Deep Analysis also produces a Practitioner's Supporting Analysis card — your notes synthesised into bullet points by section, so a documented remediation plan or work already underway is reflected as genuine partial progress rather than the gap being described as if nothing is happening. Standard Analysis and Self-Score are unaffected — both cards only ever appear on a Deep Analysis run, and only when there's something real for them to say.

What's deliberately not included

This assessment doesn't include Risk Scenarios, Connected Tools Evidence, or Attack Surface Scan — a generic breach/malware/ransomware threat taxonomy, MFA/device-compliance telemetry, and an external domain vulnerability scan don't map onto legal and organisational gaps like a missing lawful basis or an unassessed DPIA the way they do onto a technical control framework. There's also no Audit Pack export for this assessment — an exportable evidence bundle would start to look like an external compliance claim, which cuts against a tool whose whole point is describing a legal exposure gap honestly. Your results, Evidence Vault attachments, and Remediation Tracker items are still saved as your permanent Assessment Record — only the externally-facing export surface is switched off.

Full platform integration

Same treatment as every other Assessment Bundle framework otherwise: Evidence Vault (attach supporting files to any question), Remediation Tracker, PDF/JSON/PowerPoint export, shareable read-only links, sector benchmarking, Ask Phronesis chat, and MSP Portal support.

Answers from ISO 27001 and SOC 2 Readiness

If you've already finalised an ISO 27001 or SOC 2 Readiness assessment, related UK GDPR questions show a small note underneath them summarising what you answered there, with the date it was finalised: security of processing, encryption, testing your measures, restoring data, breach response, training, records of processing, DPIAs and processors, and, from SOC 2's privacy criteria, your privacy notice, consent, minimisation, individuals' rights and complaints. Where UK GDPR asks for more than ISO 27001, the note says so: under the DPIA questions, that a DPIA weighs the risk to the people whose data you process, not to your organisation; under breach notification, that a notifiable breach goes to the ICO within 72 hours of your becoming aware of it, and when to tell the people affected; under processor contracts, the terms Art 28(3) requires. It works the other way too: a finalised UK GDPR run shows under the related ISO 27001 and SOC 2 Readiness questions, naming the Article each answer comes from. International transfers, marketing and cookies, and the DPO have no counterpart in either, so those questions show no note. Like every cross-framework note, it's our own analysis, never an official equivalence, and it never fills in an answer. A finalised UK GDPR run also joins Across your frameworks, which shows the gaps it shares with ISO 27001 and SOC 2 Readiness.

📊My Hub

The central hub for your compliance posture. Sign in and navigate to My Hub to see all completed assessments, in-progress drafts, peer benchmarks, and your Compliance Passport.

Framework coverage radar

A 6-axis SVG radar showing your latest scores across all frameworks you have access to. Hidden when fewer than 3 frameworks are visible or none are completed. Axes are coloured per framework; a dashed red outline marks the 70 % compliance threshold.

Peer benchmark ribbon

Compares your scores against anonymised sector peers. Set your industry sector in the Dashboard Settings panel to unlock benchmarking. Chips are colour-coded: Top quartile (teal), Above median (green), 25–50th percentile (amber), Below 25th (red). Benchmarks build as more organisations in your sector contribute data (minimum 10 organisations per segment).

Compliance Passport

A printable one-page compliance summary. Click the Compliance Passport button in the Framework Coverage section. The passport includes your organisation name, sector, issue date, a framework scores table with RAG ratings and sector positions, and a plain-English summary. Print or Save as PDF from your browser.

Most frameworks are rated by score: 70% or above is in good standing, 40–69% needs work and below 40% has critical gaps. ISO 42001 shows its report's verdict instead, for example Nearly ready for Stage 2, because the report judges how ready you are for your next audit and has no pass mark.

Across your frameworks (shared gaps)

Where one piece of work counts in several of your frameworks. Open it with Shared gaps in the Framework Coverage section, or from the lead-in below the radar, which shows your top three shared gaps once two linked frameworks are finalised. It works from your finalised assessments and the platform's crosswalks, by rules, with no AI. It replaced the Unified Compliance Dashboard in October 2026.

• Your frameworks: every framework you can use, with the verdict its own report gives, the score and the date it was finalised, or whether it's awaiting finalisation, in progress or not started.
• Fix once, counts in several: a shared gap is a question not fully in place that the crosswalk links to one not in place in another of your frameworks, so fixing the work behind it moves both. Each shows the linked questions, your answers, and whether each link is close or partial (or NIST's own mapping, for CMMC and FedRAMP). They're ranked by how many frameworks the fix counts in. A question appears in one shared gap at most, and links are never chained through a third framework. Cyber Essentials' "Unknown" counts as not in place.
• Already in place in…: when a closely linked question is in place in another framework, that work may be the starting point.
• Add to tracker: files one item in the Remediation Tracker, under the framework you choose, naming the questions it also closes ("Also counts in"). A later analysis never removes it, and the same shared gap can't be added twice while its item is open.
• Comparing named scopes: where a framework has named scopes, choose one to compare instead of the main run, such as the CAF scope for one essential function beside the ISO 27001 scope covering the same systems. The choice stays in the page's address.
• Done in one, not yet in another: a question in place in one framework, closely linked to one that isn't in another. Its evidence or policy may already exist.
• How your frameworks connect: how many links the crosswalks have between each pair of your frameworks, and how many are close. CRMA and the specialist assessments other than HIPAA, CMMC and FedRAMP aren't linked yet.
• Print for the board, or export the shared gaps as CSV or the whole page as JSON.

The crosswalks are the platform's own judgement of which questions address a similar concern, never an official equivalence, and a link never changes an answer.

To explain the crosswalks to a colleague, a board or a client, send the Crosswalk Mapping datasheet (three pages, PDF) from the Datasheets page: which frameworks are linked and by how many links, the notes under each question, and Across your frameworks.

Completed assessments & the full record

Each finalised assessment shows as a card with its score, RAG rating, and top critical issues. Click View completed assessment → to open the read-only results page. If that run has a retained answer record (any assessment finalised since this feature shipped — see Audit Pack), the page also shows an Assessment Record panel: every question, grouped by section, with your actual answer, any evidence note, and any attached files — so you can check exactly what was answered behind a section score, not just the score itself. Older runs, or ones whose 3-year record has since expired, show the page exactly as before with a short note in place of the panel. An analysed run that hasn't been finalised yet shows a plain "View Results →" link instead — finalise it first (the amber banner's Finalise button) to unlock the full record.

Remediation summary

Shows per-framework completion progress for your Phronesis-generated action items. Each framework's "Continue →" link opens its tracker page, where you work through the items. When all items across all frameworks are complete, a green completion panel replaces the chips.

Security Tool Integrations

The Security Tool Integrations section on My Hub (and on each client detail view in the MSP Portal) shows connected security tools whose live data is checked against your answers in your reports. Currently available: Microsoft Entra ID (MFA coverage, Conditional Access, device compliance, Secure Score), Okta Identity Engine (MFA enrolment + policy, password policy, group membership, lifecycle), CrowdStrike Falcon (sensor coverage, prevention policies, Spotlight vulnerabilities, detections, incidents), and Google Workspace (2-Step Verification coverage, account lifecycle, Chromebook + mobile MDM). Further integrations on the roadmap: Qualys, Tenable, Splunk, SentinelOne.

On Cyber Essentials, CAF, DORA, ISO 27001, SOC 2 Readiness, CIS Controls, NIS2, CMMC Level 2, NIST CSF 2.0 and FedRAMP Moderate, the report has a Checked against your tools section, on every depth including Self-Score: each answer your tools can read, the figure behind it and whether it agrees. Where your answer says more than your tools show, the figure is shown once with every answer it affects, and a Review this answer link takes you back to the question. Readings over 30 days old are marked. Nothing appears beside the questions while you answer them. On CIS Controls only the Safeguards in your Implementation Group are checked. The checks are worked out by fixed rules, not by Phronesis, and they're in the PDF, PowerPoint and JSON exports; a share link shows only the counts.

A contradicted answer counts lower. If you answered that something is fully in place and a reading from the last 30 days shows less, the report counts that answer as partly in place in your verdict, scores and roadmap (on CIS Controls, as partially implemented; on CMMC, as partially met, which loses its SPRS points; on FedRAMP, as partially verified, so the control is one to close; on Cyber Essentials, as to check before you submit). It never counts lower than partly, and your answer itself isn't changed. If the control is in place in a way your tools can't see, such as a second device management tool or another monitoring service, say how in that question's evidence note and run the report again: an answer with a note is kept as you gave it, and the section shows your note beside it. The printed cover's Your tools line says when a note explains a disagreement, and shows it in red only when one doesn't.

On the other assessments, a Deep Analysis with at least one tool connected includes a Connected Tools Evidence card: a short set of bullet points comparing live figures from your connected tools (MFA enforcement rate, device coverage, endpoint protection, and similar) against what you answered, calling out where they agree or contradict each other. With no tools connected yet, this card instead shows a short prompt inviting you to connect one. Standard Analysis and Self-Score are unaffected.

Your Assessments grid

The Status tab's Your Assessments grid shows every framework you have access to in one place, regardless of state: completed and in-progress-and-analysed cards (score, RAG rating, top critical issues), in-progress drafts (progress bar, last-saved time), and — for anything you haven't started yet — a Start assessment → card linking straight to the questionnaire. This includes any bespoke framework granted via the custom_frameworks claim (e.g. a sector-specific or confidential compliance programme granted to your organisation alone) — contact your administrator to request access to a specific framework.

🧠Phronesis AI

Phronesis is the AI analysis layer built into every assessment. It runs via a secure server-side Cloud Function that adds authentication, rate limiting, and prompt engineering — your data is never sent directly to any external AI service from the browser.

Three modes

• Analysis — Full assessment report: scores, critical gaps, strengths, next steps, timeline, and action items. Triggered by the main "Analyse with Phronesis" button. Capped at 1 run per assessment type on free trial. Standard and Deep Analysis require every question to be answered first — this protects your analysis allowance from being spent on a partial result. Use Self-Score (free, instant, no AI narrative) for a quick read at any point, complete or not. Deep Analysis, the more thorough of the two depths, comes with every paid plan: the Assessment Bundle, each specialist plan, MSP/vCISO tenancies and bespoke frameworks. A free trial and the CE One-Shot include Standard Analysis. A Deep run counts as one analysis run, the same as a Standard one.
• Guidance — Per-question help explaining what the question is really asking, what good evidence looks like, and common pitfalls. Available during the assessment. It doesn't use an analysis run; each question counts towards your chat allowance instead (below).
• Chat — Ask Phronesis anything while you work or after analysis: what a question is really asking, what evidence an assessor expects, how to close a gap, or how frameworks compare. Chat knows how far through the assessment you are, which answers you've marked as gaps, and which question you're on, so you can simply ask "what does this one need?". Free-trial accounts include 20 chat questions; Assessment Bundle and specialist-plan subscribers get 100 a day, and from 80 the chat panel shows how many are left today. If you regularly need more, the Talk to us link there opens the contact form so we can discuss a higher allowance. The allowance resets at midnight UTC. Individual messages are limited to 2,000 characters.

Help tips

When you mark an answer as a gap (such as Partially Achieved, Not Achieved, Not Met, Not Verified or "I'm not sure"), or you've stayed on an unanswered question for about 25 seconds, a small tip appears beneath that question offering to ask Phronesis about it. Clicking Ask Phronesis opens the chat and asks about that exact question for you. Nothing is sent until you click, so a tip never uses your chat allowance on its own. Click ✕ to hide a tip for that question, or Turn off tips to stop them in this browser.

Rate limits

Signed-in users: 20 Phronesis requests a minute. Without signing in (Compliance Readiness only): one analysis a day, and no chat or guidance. These limits are enforced on the server.

Attack Surface Scan

An optional External Attack Surface & Breach Check widget appears near the top of the questions on Cyber Essentials, NCSC CAF, DORA, ISO 27001, Cyber Resilience Maturity, PE Due Diligence, NIST CSF 2.0, CMMC Level 2, FedRAMP Moderate, CIS Controls v8.1, NIS2 Directive, HIPAA Security Rule, SOC 2 Readiness, and DCC Readiness assessments (not on AI Governance, ISO 42001, SOC Maturity, SOC-CMM, UK GDPR, or Compliance Readiness). Enter your organisation's domain, confirm you're authorised to run external checks against it, and it queries free, no-API-key sources — Shodan InternetDB for open ports, known CVEs, and discovered subdomains, and Have I Been Pwned / Enzoic for disclosed data breaches — showing the combined result as a single severity-ranked card. Free and unlimited; results are saved with your assessment and reappear when you return.

If you run Standard or Deep Analysis after scanning, the same findings are handed to Phronesis, which is asked to flag only genuine, material mismatches against your declared answers (for example, a control claiming restricted remote access alongside a high-risk port left exposed) — routine findings your answers already acknowledge are not flagged. The scan also appears as a read-only card in your results report, right alongside the rest of the analysis. Self-Score never sends anything to the server, so a scan run before choosing Self-Score is shown to you only, never to Phronesis.

📎Evidence Vault

Attach supporting evidence files to individual assessment questions. The Evidence Vault is available on CE, CAF, DORA, ISO 27001, AI Governance, PE Due Diligence, NIST CSF 2.0, CMMC Level 2, FedRAMP Moderate, CIS Controls v8.1, NIS2 Directive, and HIPAA Security Rule assessments. Requires Assessment Bundle, CE One-Shot, PE DD access, SOC access, or CMMC/FedRAMP/HIPAA access.

How to upload

A paperclip icon appears on each question. Click it to select a file — the upload uses a signed GCS resumable URL, so large files transfer directly to Google Cloud Storage without going through Cloud Functions. Once confirmed, a chip appears below the question showing the file name.

Storage quota

500 MB per account across all assessments. The Dashboard shows your current usage in the Evidence Vault section. Files are stored per-user and per-question; deleting a chip removes the file from storage and reclaims the quota.

Supported formats

PDF, Word (.docx), plain text, JSON and images (PNG, JPEG, GIF, WebP), up to 10 MB each. Common evidence types: PDF policy documents, Word procedure documents, screenshots, network diagrams, and penetration testing reports. To attach a spreadsheet, save it as PDF first.

How uploads are checked

Each file you upload, including files for an MSP client, is checked automatically once it's saved. Its fingerprint (a SHA-256 hash) is checked against VirusTotal's record of known malware; the file itself is never sent to VirusTotal. Files up to 512 KB are also checked for personal data such as card numbers, National Insurance and passport numbers, email addresses, phone numbers and bank account numbers. A file that fails either check is deleted and its space returned to your quota. If a check can't run, for example because the file is too large for the personal-data check, the file stays available.

Importing from SharePoint

If your organisation's Microsoft 365 / Entra integration is connected, a SharePoint button appears beside the paperclip on each question. Click it to open the SharePoint file browser, navigate your connected libraries, and attach a file directly from SharePoint — no download required. The file is copied to the Evidence Vault and counts against your 500 MB quota in the same way as a local upload. Supported file types mirror the standard Vault list (PDF, Word, Excel, PowerPoint, images, text, CSV, JSON). See Integrations for how to connect Microsoft 365.

✅Remediation Tracker

After a Phronesis analysis, its action items are saved to the Remediation Tracker automatically. You work through them on the tracker page. The assessment pages themselves don't show the tracker, but once the actions are saved your results say how many are in your action plan, with a View your action plan → link to it. The "Continue →" links on My Hub and in the MSP Portal open it too, and both show each framework's progress.

View your action plan

The link appears after the findings in your results, only once the analysis's actions have been saved, so it always opens this analysis's actions. It opens in a new tab, so your results stay open: you can't get them back without running the analysis again. On a client's assessment in the MSP Portal it opens that client's plan, and on a named scope, that scope's.

It doesn't appear after a Self-Score run, which saves no actions, or on an account whose plan doesn't include the Remediation Tracker for that assessment (see Which plans include it below).

Supported assessments

Every assessment except the free Compliance Readiness check saves its action items to the tracker: Cyber Essentials, NCSC CAF, DORA, ISO 27001, AI Governance, PE Due Diligence, SOC Maturity, Cyber Resilience Maturity (CRMA), NIST CSF 2.0, CMMC Level 2, FedRAMP Moderate, CIS Controls v8.1, NIS2 Directive, HIPAA Security Rule, SOC 2 Readiness, UK GDPR, DCC Readiness and SOC-CMM.

Action item properties

• Urgency — Critical, High, or Medium. Items are sorted by urgency.
• Effort estimate — Time estimate provided by Phronesis (Quick win / 1 day / 1 week / 1 month+).
• Owner — Free-text assignee field (e.g. "IT Lead", a colleague's name).
• Due date — Optional target completion date.
• Status — Tick to complete; progress bar shows X of N done.

The tracker page

The My Hub "Continue →" links open remediation.html?type=<framework>, the tracker for that framework. It's where you tick, edit, assign and delete actions, without opening the assessment itself. It opens with your actions showing; if every action is complete it says so, and if there are none yet it says that each analysis saves its actions there.

For MSP practitioners, each framework row in the MSP Portal's remediation widget has a "Continue →" link that opens the tracker scoped to that client and framework directly. A "View full tracker →" link at the bottom of the widget opens all frameworks for the client in one view. When opened in MSP context, the page shows a teal 🏢 MSP Client: <name> chip so you can confirm you are viewing a client's actions, not your own.

Share a read-only link

From the standalone tracker page, click Share read-only link to generate a public URL (no login required) showing the latest analysis's action items, with urgency, effort, due dates, owner, and status. Options:

• Expiry — 7, 30, or 90 days, or no expiry.
• Anonymise owners — replaces all assignee names with "[assigned]" before snapshotting. Recommended when sharing with external parties (auditors, board).

The shared viewer (shared-remediation.html?token=…) is a static read-only page with a "Print / Save as PDF" button. Tick, edit, and delete controls are not available to viewers.

Re-running an analysis

Re-running an analysis keeps your ticks, owners and due dates. An action the new analysis suggests again, even in slightly different words, keeps its progress and takes the new urgency and detail. Your own edits to an action's title or detail are kept.

An action the new analysis no longer suggests is removed if nobody had worked on it. If it was ticked, assigned, given a due date, edited or linked to a risk in your Risk Register, it moves to a collapsed Not in the latest analysis section at the foot of the tracker, where you can still tick, edit or delete it. If a later analysis suggests it again, it moves back. The progress bar, the urgency filters and the "all done" banner count only the latest analysis's actions, and so do the summaries on My Hub and in the MSP Portal.

Each named scope and each MSP client has its own tracker, so analysing one never changes another. If you collapse the tracker, it stays collapsed next time for that assessment type. When all items are ticked, a green "all done" banner appears, on the tracker page and on My Hub.

Team and MSP scoping

For Team Tenant subscribers, action items are shared across all team members automatically — any teammate can tick, edit, or assign items. Members with the Viewer role can see items but not change or share them. For MSP users, each client's action items are isolated under their client namespace.

🗂️Risk Register

The Risk Register, in My Hub's Risk & Remediation tab, is a standing list of risks your organisation tracks — each with a likelihood and impact you set yourself, an owner, a disposition, and a status. It sits above the Remediation Tracker's tasks and Cross-Framework Risk Signals' diagnostics as the persistent record of "here's what we're watching and how we're handling it."

Adding a risk

• Manually — click "+ Add risk" and describe a risk no assessment or scan can see (a vendor dependency, a physical-security gap, a staffing single point of failure).
• From a Risk Signal — click "+ Add to Risk Register" on any Cross-Framework Risk Signals row to promote a diagnostic finding into a tracked risk, pre-scored from its severity band.
• From a remediation action — click "+ Add to Risk Register" on any Remediation Tracker card to turn that action into a standing risk, pre-scored from its urgency and automatically linked back to the source action.

MSPs and vCISOs get both buttons for each client: on the Risk Scenarios rows of the client's Risk & Remediation tab in the MSP Portal, and on the client's Remediation Tracker cards. The risk goes into that client's register, never your own, and the client's Risk register card updates straight away. Viewers don't see the buttons.

Likelihood, impact, and the heat map

Every risk is scored likelihood × impact on the same 5×5 matrix your risk professionals will recognise — likelihood from Rare to Almost certain, impact from Minor to Critical — and banded Low / Moderate / High / Critical. Once you approve your own risk method, the levels take your names and the bands start where your method says. The heat map at the top of the panel shows every tracked risk plotted on that grid; a cell with only closed risks turns grey, showing at a glance where risk has actually come down.

Disposition and status

Each risk carries a disposition (Treat, Transfer, Accept, or Avoid) and cycles through a status (Open → Monitoring → Closed) via a click on its status pill. The panel also counts the reviews that are due, and Open risk management → takes you to the full register: residual scores, treatment plans, reviews, acceptance and each risk's history.

Linking remediation actions

Open the "+ Add risk" or edit modal and use the Linked remediation actions checklist to attach up to 10 existing Remediation Tracker items to a risk — useful when several tasks are all part of treating the same underlying risk. Linking doesn't create anything new or copy any data; the risk simply carries a live reference to those tracker items, shown as a 🔗 count on its row.

🧭Risk management

The Risk management page is where you run your risks day to day, the way ISO 27001 (clauses 5.3, 6.1.2, 6.1.3, 8.2 and 8.3), ISO/IEC 42001 for an AI management system (5.3, 6.1.2 to 6.1.4 and 8.2 to 8.4) and the CAF (A1.b and A2.a) expect. Open it from the Risk Register on My Hub (Open risk management →). An MSP or vCISO opens a client's from the client's Risk & Remediation tab in the MSP Portal; each client has its own risks, method, RACI, Statements of Applicability, business assets and AI impact assessments. It has seven tabs.

Register

The heat map (switch between inherent, before treatment, and residual, after it) and the list of risks, each with its owner, both scores, how its treatment is going and when it's next reviewed. Select a risk to see what it affects, the threat and vulnerability, its treatment plan (the controls chosen, the Remediation Tracker actions that carry it out, a target date), whether its residual risk has been accepted, and its history. Add a risk and Edit take every field.

Accepting a residual risk: once a risk has a residual score, its owner can accept it if the score is at or below your acceptance level. Above that level, only the role your method names (the board-level owner, unless you change it) can accept it. The name, role and date are kept in the risk's history, and an acceptance can be withdrawn.

Reviews

What's overdue, what's due in the next 30 days, and what comes later. Choose a risk to record a review: confirm or change its scores, mark its treatment complete, set its status and say what changed. The form shows when the next review would fall before you save. How often a risk is reviewed depends on its band: the inherent score's band while its treatment is open, the residual score's once treatment is complete. You can also set the next review date yourself. Closing a risk needs a note saying why. A saved review can't be changed or deleted.

Method

How you assess risk: your names for the five likelihood and five impact levels and what each means (impact can be described on up to five dimensions, such as money, operations and people), where the Moderate, High and Critical bands start, your acceptance level and who accepts above it, and how often each band is reviewed. Until you approve a method, the defaults apply. Start version N opens a draft that shows exactly what approving it would change in your register (which risks change band, which review dates move). Approving it takes the approver's typed name and today's date. Scores never change; each risk takes its band from the new method. With named ISO 27001, ISO 42001 or CAF scopes, a scope can have a method of its own (see Scopes below).

Accountability

Your RACI: who is Responsible, Accountable, Consulted and Informed for each process or group of controls. Start from ISO 27001's clauses and Annex A themes, ISO 42001's clauses and its Annex A controls on AI development, data and third parties (with an AIMS lead, a board-level owner, an AI system owner and a data protection officer as the starting roles), the CAF's 14 principles (with the NHS DSPT's four extra principles if you need them), or blank rows. Select a cell to change it, and Change under a role to rename it, say who holds it, or remove it. Every row needs exactly one Accountable and at least one Responsible before the RACI can be approved. Risk owners and the role that accepts risks above your acceptance level are picked from these roles, so a role that still owns risks can't be removed. With named ISO 27001, ISO 42001 or CAF scopes, a scope can have a RACI of its own, with its own people (see Scopes below). An AI management system's own RACI starts from ISO 42001's rows with your organisation's roles.

Statement of Applicability

ISO 27001's 93 Annex A controls, described in our own words: whether each applies, why (a reason such as a legal requirement, or your own words), how far it's implemented (implemented, partly, planned or not started), and the risks in your register it treats (any risk whose treatment plan names it, written like A.8.13). If you have named ISO 27001 scopes, each has its own; pick the scope at the top of the tab. You fill it in here, and it can be completed and approved without an assessment.

Once you've finalised an ISO 27001 assessment for that scope, Pre-fill from the assessment takes the latest one and fills in the controls nobody has set: Implemented, Partially and Not implemented become implemented, partly and not started, and Not applicable becomes excluded, with the reason still for you to write. It never changes a control someone set, and nothing here changes your assessment. Each row says where its value came from, and flags where it differs from the assessment. Give them all one reason sets one reason on every included control without one, for you to change where it doesn't fit. Every control must be decided and justified, and every included one have a status, before it can be approved by a typed name.

ISO 42001's Statement of Applicability. An AI management system needs its own (ISO/IEC 42001 6.1.3 d). Choose ISO 42001 at the top of the tab for its 38 Annex A controls, A.2.2 to A.10.4, kept apart from ISO 27001's: one for the AIMS, or one for each named ISO 42001 scope. It works as ISO 27001's does, and pre-fills from your latest finalised ISO 42001 assessment. If that assessment declared your AI role, the tab lists the controls often excluded for that role, each with why: for example, the design and development controls (A.6.1.2 to A.6.2.3) for an organisation that only uses AI others provide. Exclude marks one as not applicable, with the reason written in your own words as its justification for you to edit; Keep includes it; Exclude all does every one listed. Nothing is excluded until you choose. Controls A.4.2 to A.4.6 show your AI systems from Business assets as evidence, and A.5.2 to A.5.5 your AI impact assessments.

A few control numbers, such as A.5.2 and A.8.3, exist in both standards. In a risk's treatment plan, a bare A.5.2 counts for both; write 27001 A.5.2 or 42001 A.5.2 to mean one.

Business assets

Your register of information and the assets that hold it, kept in groups with owners, as ISO 27001 (A.5.9 and A.5.10) and the CAF (A3.a) ask. It isn't an IT asset database: a group is "Staff laptops, about 120" or "Customer data", never one laptop. Device-by-device detail stays in your IT tools (Intune, your RMM, a licence spreadsheet), and each group of software, cloud services, devices or network kit says where, under Detailed inventory held in, or that it isn't kept anywhere else. There's no serial number, hostname, IP address or licence key, and the register holds up to 300 groups, retired ones included.

Each group has a type (information; software and applications; cloud and online services; devices; network and infrastructure; premises; other; AI systems), an owner (a role from your RACI, or a name), where it's held, an approximate count, its classification (how sensitive the most sensitive information in it is), its criticality (the worst losing, corrupting, being without or disclosing it would do, on your method's impact scale), the policy its use is governed by, its supplier, and the scopes it supports. Filter by type, owner, classification, scope or review. Select a group to see the risks that name it and its history.

• Suggest groups offers groups from what the Hub already holds: your technology stack, the device counts of a connected Microsoft 365 (Intune) or CrowdStrike Falcon, and a few common groups of information (customer data, employee records and so on). Nothing is added until you tick it. A group you add keeps its own count; if the tool's count later moves by more than a quarter, the tab says so for you to review.
• Import from a spreadsheet takes an information asset register you already keep, saved as CSV (up to 1 MB). Download the template for the columns: Name, Type, Description, Owner, Where it's held, Detailed inventory held in, Approximate count, Classification, Use governed by, Criticality, Supplier and Scopes. Common alternative headings work too ("Asset", "Asset owner", "Location"). Any other column is listed as not imported and never leaves your browser. A preview shows the groups to add and the rows left out, with why, before anything is saved. It only adds groups: a name already in the register is left out. A file of individual devices or licences (a serial number, hostname, IP or MAC address or licence key column) is refused.
• Classification and reviews sets your classification levels (two to six, least to most sensitive; the defaults are Public, Internal, Confidential and Restricted, the levels the Policy Generator's Data Classification & Handling Policy uses) and how often each group is reviewed (12 months unless you change it). Renaming a level keeps its groups.
• Record a review confirms a group is current; changes to its owner, classification, criticality, scopes, supplier or where its inventory is kept are kept in its history. Retire a group you no longer use: it stays on record with its links. A group a risk names can't be deleted.

AI systems (for ISO 42001, A.4.2 to A.4.6) are a type of their own, one group per AI system, with what it's for and the resources it uses: its models, data, tools, computing and the people who build, run or oversee it. They import from a spreadsheet too (the template has their six columns), are listed in a table of their own in the printed inventory, and are what an AI impact assessment is about. An AI system an impact assessment names can't be deleted.

When you add or edit a risk, tick the Asset groups it affects (up to 10); the Register tab can then be filtered by asset group. On the Statement of Applicability, controls A.5.9 and A.5.10 show the register as evidence ("Your asset register: 34 groups in use, all owned, reviewed within 12 months"), without changing their status.

Supplier risks

With the Third Party Risk Hub as well (Risk Operations, or an MSP plan with the Third Party Risk add-on), a risk can name up to 10 of your suppliers. Tick them under Suppliers it involves when you add or edit a risk; the search box narrows a long list, and each supplier shows its access and its questionnaire and Risk Purview levels. A supplier risk is an ordinary risk: scored by your method, owned from your RACI, treated, reviewed and accepted like any other. Without the hub, name a supplier in What it affects, as before.

• Add a risk from a supplier. Add to risk register on a supplier in the hub, or Add to the register under Supplier risks to consider, opens the risk dialog filled in from the supplier's record: a title naming its main issue, what it affects, the threat and weakness in plain words, and starting scores. Impact comes from the most critical asset group that names the supplier, otherwise from its access (system or root access 5; network, data, cloud or SaaS access 4; physical 3; limited 2). Likelihood comes from the worse of its questionnaire and Risk Purview levels (high 4, medium 3, low 2, or 3 when neither is known). They're a starting point: change anything before you add it. Nothing is saved until you do. If open risks already name the supplier, the dialog says which.
• Supplier risks to consider, on the Register tab, lists suppliers no open risk names that need a look, worst first, each with why: a breach exposing sensitive data or a high contradiction found by Risk Purview; a high questionnaire or Risk Purview level with system, network, data or cloud access; system, network or data access and never assessed, an overdue questionnaire or an overdue reassessment; or system or data access with no incident contact. Nothing is added by itself. Dismiss hides a supplier until it gets worse.
• When a supplier gets worse after a risk's last review (a level up, a score 10 or more lower, a new critical or high finding, or its reassessment falling due), the risk shows Supplier changed and what moved, for example "Risk Purview risk low → medium; New: RDP open to the internet", and is due for review from that day. Its scores don't change by themselves: the review records your judgement, and the suppliers as they are then.
• In the risk dialog, the ticked suppliers' own open fixes from the hub are listed read-only beside the treatment, so a treatment can say "until the supplier closes its exposed RDP".
• The Supplier filter on the Register tab shows one supplier's risks, or every risk naming a supplier. A supplier card's risk count in the hub opens the register filtered the same way.
• Business assets name their supplier. In a group's dialog, choose its Supplier from the hub, or type the name of one that isn't in it. The group then shows the supplier's access and questionnaire and Risk Purview levels, so does the printed inventory, and a risk added from that supplier starts its impact from the group's criticality. A spreadsheet import names suppliers in words only. Without the hub, a group keeps the supplier it was linked to; untick the link to type another.

Read-only team members see the suppliers on each risk and what changed, but can't link, raise or dismiss. An MSP client's risks name only that client's suppliers.

AI impact assessments

For an AI management system (ISO/IEC 42001 6.1.4, 8.4 and A.5.2 to A.5.5): one impact assessment for each AI system, saying what the system is for and how it's meant to be used, the misuse that can reasonably be foreseen, who it affects (individuals, groups of people, society), its benefits, the harms it could do, each scored for likelihood and severity on your risk method's scales, the measures in place and planned (linked to risks in your register and actions in the Remediation Tracker), and the impact that remains and whether it's acceptable. New impact assessment starts one; each is about one of your AI systems in Business assets, and the tab lists AI systems that have none yet. An AIMS scope's assessments are tagged with it.

• Approve takes a typed name once the purpose, who it affects, at least one harm with every harm scored, and the impact that remains are filled in. Editing an approved assessment makes it a draft again until it's approved again; its history keeps every change.
• Kept current (8.4): an approved assessment is due again at your method's review interval for the band of its worst harm, or on a date you set. Record a significant change when the system changes (a new model, new data, a new use): it's due for review that day, until it's approved again.
• It isn't a DPIA or a fundamental rights impact assessment: name the one that covers the same system, and keep it where it is. The AI Governance assessment's questions on those stay where they are.

Up to 200 a client or organisation. Print them, or download a CSV with a row for each harm.

Notes on your ISO 27001, ISO 42001 and CAF assessments

Your risk management records also show up on the ISO 27001, ISO 42001 and CAF assessments, as a note under each question they speak to. The notes cover your RACI, your method, your register (owners, plans, acceptances and reviews), your business assets and, for ISO 27001, your Statement of Applicability. A note says what the record shows and which answer it supports, for example "Your risk method, version 3, approved by Elaine Morris on 2 September 2026 … supports Implemented". It never fills the answer in. If your answer differs from what a record supports, the note says so. A named ISO 27001 scope's notes come from its own Statement of Applicability. With the Third Party Risk Hub, your suppliers add notes too. On ISO 27001's supplier relationships question (A.5.19 to A.5.22), the note gives how many suppliers with system, network or data access were assessed in the last 12 months, whether each open risk naming a supplier has an owner and a treatment, and whether your Third-Party & Supplier Security Policy is saved in the Policy Generator; it supports Implemented only when all three hold. On the CAF, the notes give the open risks that name suppliers (A2.a), the suppliers assessed in the last 12 months and scanned by Risk Purview in the last 30 days (A4.a), and what suppliers say their contracts include, such as incident notification, with the incident contacts they've given (A4.a). These support Partially Achieved at most, and say why: the hub can't show an assessment came before the contract, or see the contracts themselves. A risk whose supplier got worse counts as due in the notes on your reviews. The business asset notes can't support Achieved on the CAF's inventory questions on their own: the register shows a gap (a group with no owner or no detailed inventory), but only the tool that holds the list can show it's complete and current.

On the ISO 42001 assessment, the notes come from the AIMS's own records: the RACI on roles (5.3 and A.3.2), the method on 6.1.2, the register and treatment plans on 6.1.3 and 8.2 to 8.3, ISO 42001's own Statement of Applicability on 6.1.3 d and each Annex A question, your AI systems on resources (A.4.2 to A.4.6), the suppliers your AI systems name on A.10.3, and your AI impact assessments on 6.1.4, 8.4 and A.5.2 to A.5.5. Those support Implemented only when every AI system in use has an approved impact assessment that's current. The supplier note supports Partially implemented at most, since the Third Party Risk Hub assesses a supplier's security, not its approach to responsible AI.

Scopes

If ISO 27001, ISO 42001 or the CAF has more than one scope (see Several ISO 27001 scopes, Several AI management systems and Several CAF scopes), each risk can say which scopes it belongs to: tick them under Scopes when you add or edit it. Tick none for a risk to the whole organisation, such as ransomware: it shows in every scope, labelled Organisation-wide. Each risk in the list shows its scopes.

The Scope filter on the Register and Reviews tabs shows one scope's own risks together with the organisation-wide ones, or only the organisation-wide risks. The summary, heat map, reviews due and the printed register and treatment plan follow it, and the printed documents say which scope they cover. Each scope's Statement of Applicability, its notes on the ISO 27001, ISO 42001 and CAF questions and its Audit Pack use the same risks, so an auditor for one ISMS or AIMS doesn't see another's. A risk can belong to an ISMS scope and an AIMS scope at once.

A scope's own method and RACI. Every scope uses the organisation's method and RACI until you give it its own. Choose the scope under Whose method on the Method tab, or Whose RACI on the Accountability tab, and select Give it its own method (or RACI). It starts as a copy of the organisation's, which goes on applying until you approve the copy, as you approve the organisation's. The method and the RACI are separate: a scope can have its own RACI and keep the organisation's method, or the other way round. Use the organisation's method again (or RACI) takes it back; its own versions stay on record.

A scope's own method and RACI apply to the risks and asset groups tagged with that scope alone. Organisation-wide risks, and risks in more than one scope, follow the organisation's, and a scope's register labels them Organisation's method. Each risk's bands, review date and acceptance follow the method it follows, and its owner is picked from the RACI it follows: tick a scope on a risk or a group and its owner's roles and scales change to match. When a change of scopes hands a risk to another method, its bands are worked out again (its scores don't change) and its history says so. A role that owns records, or that a method names to accept risks, can't be removed from the RACI they follow, and a method can't be approved naming an acceptance role that a RACI it applies with hasn't got. A scope's notes, printed method and RACI and Audit Pack use its own, and its Audit Pack adds the organisation's method when its register holds risks that follow it.

A risk added while the filter shows a scope starts in that scope. A risk pushed from the Remediation Tracker starts in the scope of the assessment its action came from. Changing a risk's scopes is kept in its history. If a scope is deleted, its risks lose it, with a note in their history, and a risk left with none becomes organisation-wide; it isn't deleted. Its own method and RACI are deleted with it: its risks take their bands from the organisation's method, and an owner whose role the organisation's RACI hasn't got is kept as a name, with a note in the history.

Documents

Eight documents print from their tabs (Save as PDF) and download as CSV: the risk assessment process and criteria (Method), the risk register and the risk treatment plan (Register, under Documents), the RACI (Accountability), the Statement of Applicability, the inventory of information and associated assets (Business assets, under Documents; its CSV has the import template's columns, so it can be imported again), and, with the Third Party Risk Hub, suppliers and their risks (Register, under Documents): every supplier with its access, its latest questionnaire and Risk Purview results, whether it has given an incident contact, its own open fixes, and the open risks that name it, with their bands, owners, treatment and next review. Suppliers no risk names are listed too. For an AI management system, the AI system impact assessments print from their tab. The same documents go in your ISO 27001, ISO 42001 and CAF Audit Packs, so an auditor receives them with the assessment: each standard's pack carries its own Statement of Applicability, and only ISO 42001's the impact assessments.

To explain the page to a colleague, a board or a client before they have an account, send the Risk Management datasheet (five pages, PDF; the fourth is on supplier risks, the fifth on an AI management system) from the Datasheets page. To set it up, the same page has Risk management, step by step (seven pages, PDF): the eight steps in the order the work is done, each with what to do, which tab it's on and how you know you're done, and a box on doing it for an MSP or vCISO client.

☁️Collaborative Drafts

In-progress assessments are saved to the cloud automatically so you can pick up where you left off on a different device, and — for Team Tenant subscribers — share an in-progress assessment with teammates.

Cross-device sync

While you work through an assessment, your answers are saved locally first and synced to the cloud when you hide the tab, navigate away, or every 30 seconds (whichever comes first). When you open the same assessment on another device, a teal banner appears at the top of the page:

☁ Progress from another device found — 26% complete, saved 4 minutes ago. Load it? [Load progress] [Dismiss]

Choosing Load progress replaces your local state with the cloud version and reloads the page. Dismiss keeps your current local state untouched.

Team sharing (Team Tenants only)

If your account is part of a Team Tenant (owner + members), draft assessments are scoped to the tenant rather than to a single user. Anyone in the tenant can open the same in-progress CRMA, CAF, DORA, ISO 27001, AI Governance, or Compliance Readiness assessment and continue editing.

• CE, PE Due Diligence and SOC Maturity are always personal (user-scoped) regardless of tenant membership — these are typically single-author assessments.
• Trial users do not get tenant sharing. Upgrade to the Assessment Bundle (or join a tenant) to enable it.

MSP client assessments

An assessment you run for a client from the MSP Portal syncs to the cloud the same way, into that client's own draft — never into your own assessment of the same framework. The draft belongs to your practice, not to whoever is typing: you and every team member with access to that client share it (every framework, including Cyber Essentials, PE Due Diligence and SOC Maturity). Anyone with edit access can pick it up on another device, and finalise it once it's complete. Team members limited to other clients can't open it.

Client assessments analysed before September 2026 were saved only in the browser that answered them, so they can't be finalised until those answers reach the cloud. Open the assessment once on that device and press Sync Progress, then finalise as normal. The Finalise button tells you if this is needed.

"Last saved by" and live presence

On My Hub, each in-progress card shows the last person who edited it:

• Last saved by [Name] — appears under the progress bar when no-one currently has the assessment open.
• 🔒 Being edited by [Name] — amber chip that appears when a teammate has the assessment open right now (presence pings every 60 s; the chip clears within 2 minutes of them closing the tab).

Tenant owners, tenant admins, and platform admins also see a Take over button on locked cards — clicking it clears the active presence so they can open the assessment without conflict (useful if a teammate has left a tab open and won't be returning).

Conflict resolution

If two teammates save changes to the same assessment at the same time, the second save will trigger an amber banner:

⚠ [Teammate] saved newer changes 2 minutes ago. Load their version, or overwrite? [Load newer] [Overwrite]

Load newer pulls in their changes and discards yours; Overwrite retains yours and discards theirs. The dashboard's presence indicator is designed to prevent this by warning you before you start editing — the banner is a safety net for the rare case it happens anyway.

🔗Sharing Results

Generate a tokenised read-only link to share your assessment results with stakeholders, auditors, or clients — no account required to view the shared page.

Creating a share link

Click the Share button in the results panel of any assessment except SOC Maturity and Compliance Readiness (CE, CAF, DORA, ISO 27001, AI Governance, PE Due Diligence, CRMA, NIST CSF 2.0, CMMC Level 2, FedRAMP Moderate, CIS Controls v8.1, NIS2 Directive, HIPAA Security Rule, SOC-CMM). Set an optional title and pick expiry: 7, 30, or 90 days, or no expiry (30 days is pre-selected). Copy the generated link and share it.

What the recipient sees

The shared page (shared-result.html) shows score overview, section bars, critical issues, strengths, next steps, and the Phronesis summary. It includes a "Save as PDF" button. No login is required.

Expiry and revocation

Expired or revoked tokens return HTTP 410 to recipients. You cannot revoke a link from the UI directly — if needed, contact support. Sharing is not available during the free trial.

⬇️PDF, JSON & PPTX Export

PDF export

Available on all assessments. Click Save as PDF in the results panel. You'll be prompted to enter your organisation/company name; this is added to the report header. The browser's native print dialogue opens — choose "Save as PDF" as the destination.

The PDF includes scores, radar chart, critical gaps, remediation steps, and the Phronesis AI narrative. The nav bar and browser chrome are automatically hidden before printing. On most assessments the first page is a cover (score, rating, section ratings and radar) on its own, and a footer naming the report, your organisation and the date runs along the foot of every page after it. Where you've left evidence notes, an appendix at the end lists each note under its question's wording.

PowerPoint export (PPTX)

Available on all 19 paid assessments after a Phronesis analysis. Click 💾 Export PPTX in the results panel to download a branded slide deck generated entirely in the browser — no server round-trip required.

Each deck contains a cover slide, a summary slide (score badge, stat chips, and the AI summary), a radar chart (for frameworks with ≤8 sections), per-section score bars coloured green/amber/red, critical issues, strengths and next steps. A Deep Analysis deck adds the board-ready executive summary and the section-by-section breakdown. Some frameworks add slides of their own: SOC Maturity adds its maturity and AI readiness summary, the gaps to your target maturity level (an overview, then a slide for each domain below the target with what good looks like) and its 90-day roadmap. The deck is ready to drop into a board report or client presentation and can be edited in PowerPoint or Google Slides.

JSON export

Available on all assessments. The exported JSON contains your raw responses, calculated scores per section, and the full Phronesis analysis result — useful for feeding into GRC tools or for records retention.

📋Policy Coverage Checker

The Policy Coverage Checker analyses whether your existing security policies adequately cover the areas where your assessment shows a gap. On Cyber Essentials, ISO 27001, CAF and ISO 42001, that means any control, section or principle scoring below 70%. On GDPR, a score-based trigger would miss the point — GDPR excludes its legally mandatory "gate" questions (e.g. "is a lawful basis documented?") from the score entirely, so a section could have every gate unmet and still show a passing maturity score. GDPR instead triggers on sections with at least one mandatory legal requirement not yet met or not yet assessed. It appears inside the CE, ISO 27001, GDPR, CAF and ISO 42001 results panels after a Phronesis analysis completes, and uses a short structured questionnaire (no document upload required) to assess coverage without sensitive policy content ever leaving your organisation.

How it works

1. Run a Phronesis analysis on a CE, ISO 27001, GDPR, CAF or ISO 42001 assessment.
2. A Check Policy Coverage → button appears in the results panel for any control, section or principle scoring below 70% (CE, ISO 27001, CAF, ISO 42001) or with an unmet/unanswered mandatory legal requirement (GDPR).
3. A slide-in panel shows 2–3 targeted questions per weak control: does a relevant policy exist, how specifically does it address the control, and is there supporting evidence?
4. Answers are sent to Phronesis (structured data only — no document content), which returns a per-control coverage verdict and a prioritised action list.
5. Suggested policy templates are shown with a Generate → deep-link that opens the Policy Generator pre-scrolled to the relevant template. Only templates your assessment unlocks are suggested, so every link opens a card you can use; from the MSP Portal, the link keeps the client you're working on.

Coverage verdicts

• Covered — a specific, relevant policy exists and there is evidence of implementation
• Partially covered — a policy exists but it is generic, outdated, or lacks evidence of enforcement
• Not covered — no relevant policy exists or it is missing for this control area

📦Audit Pack

The Audit Pack generates a certifier-ready ZIP bundle containing your assessment data and evidence files. Designed for external auditors, certification bodies, and procurement partners who need a structured, verifiable evidence set rather than a PDF screenshot.

What's in the ZIP

• README.txt — pack metadata, generation timestamp, organisation name, and a summary of included files
• assessment-data.json — your full assessment snapshot: overall score, section scores, critical issues, strengths, next steps, and Phronesis summary
• assessment-record.json — the full question-by-question record as answered, when available (see below)
• assessment-report.html — a self-contained HTML report with inline styles, an Assessment Record section (plus a Scope Declaration section for Cyber Essentials), and SHA-256 integrity hashes of the JSON files for tamper detection
• evidence/{questionId}/{fileName} — all evidence files attached to the assessment, downloaded via 1-hour signed URLs at generation time
• risk-management/ (ISO 27001, ISO 42001 and CAF) — your risk management documents as they stand: the risk assessment process and criteria, the risk register, the risk treatment plan, the RACI and the inventory of information and associated assets, for ISO 27001 and ISO 42001 that standard's own Statement of Applicability of the pack's scope, for ISO 42001 the AI system impact assessments, and with the Third Party Risk Hub, suppliers and their risks. Each is included once you have the records it's built from.

Assessment Record

Every finalised run of the 19 paid assessments is snapshotted into a retained record at the moment it's finalised — every question, its text and answer options as they read at the time, your answer, any evidence note, and any attached files, grouped by section. The Audit Pack includes this full record (both as a human-readable table in assessment-report.html and as machine-readable assessment-record.json) so an auditor can check the section score against the individual answers that produced it, not just take the score on trust.

Scope Declaration (Cyber Essentials only)

A finalised Cyber Essentials Audit Pack also includes your completed Scope Declaration — legal entity, scope type and boundary, locations, remote working, device counts, operating systems, cloud services, and your CE vs CE Plus target — as its own section in assessment-report.html, positioned after the Assessment Record. It's the same declaration your on-screen results report shows as its closing appendix page, so a certification body working from the downloaded pack sees the identical boundary. This section only appears for Cyber Essentials; every other assessment type's Audit Pack is unaffected.

Generating an Audit Pack

1. Complete your assessment and run a Phronesis analysis so a score snapshot is saved to your account.
2. Upload evidence files via the paperclip buttons on individual questions (Evidence Vault must be enabled).
3. Click 📦 Audit Pack in the results export bar.
4. A progress modal appears while the pack is assembled. The ZIP downloads automatically when ready.

📈Sector Benchmarking

After each completed analysis, your overall and section scores are anonymously contributed to a sector benchmark dataset. Once 10+ organisations in your sector have contributed, you'll see a "How You Compare" block in the results.

How scores are collected

Scores are hashed (SHA-256 of your user ID) before storage — your identity is never linked to the benchmark data. You can opt out at any time in Dashboard Settings.

What the benchmark shows

• Your score vs. sector median and mean
• A percentile badge (Top quartile / 50–75th / 25–50th / Bottom quartile)
• A colour-coded distribution bar (p25 → median → p75)
• Dual bars for each section: your score vs. sector mean

Benchmarks are aggregated every 6 hours by a scheduled Cloud Function. Sector categories are standardised — see Dashboard Settings to ensure your sector is correctly set.

🔗Third Party Risk Hub

A supplier security questionnaire distribution and portfolio risk tracking system. Requires supply_chain_access custom claim. Supports up to 200 suppliers. Custom questions (up to 100 authored, 100 per send) are included for all subscribers. Sold on its own, or with the Assessment Bundle as Risk Operations; on a Risk Operations team, everyone works on the same supplier portfolio (see Pricing).

Core flow

1. Add a supplier to your portfolio and send them a secure questionnaire link (no account required for the supplier).
2. The supplier answers your questionnaire: the 26 standard questions across 8 domains, your own custom questions, or both. Optional per-question comments are included in your analysis.
3. Trigger a Risk Purview scan against the supplier's domain — external verification signals covering DNS health, TLS certificate validity, open ports, breach history, and company registration are gathered and analysed.
4. The platform detects contradictions between self-reported questionnaire answers and externally observed signals (e.g. "claimed MFA everywhere" vs exposed RDP on port 3389).
5. A weekly automated re-scan diffs against the previous result and raises alerts for new signals, severity escalations, or score drops.

Risk scoring

Questionnaire risk: weighted radio answers (Achieved / Partial / Not Achieved / N/A) to the questions asked, scored server-side. Risk Purview score: composite 0–100 across all probe signals. Both give a High, Medium or Low Risk level. A questionnaire level scored only on your own questions, none of the standard ones, is marked Own questions wherever it shows: the supplier card, its responses, the CSV export, the executive report and the risk register.

Risk Purview checks five standard questions' answers against what it finds (firewalls, encryption in transit, patching, Cyber Essentials and incident notification). If the supplier's latest questionnaire didn't ask them, the scan says it couldn't check the answers rather than reporting no contradictions.

Supplier risks in your risk register

With the risk register too (Risk Operations), each supplier card has a Risk register row: the supplier's open risks and the highest of them ("2 open risks · highest High"), which opens your register filtered to that supplier, and Add to risk register, which opens the Risk management page's risk dialog filled in from the supplier's record (see Supplier risks). The same link is in the Risk Purview window. Nothing is added until you save the risk there. With the hub alone, the row says the register comes with Risk Operations. Read-only team members see the count but not the button.

Incident contact process

Every supplier card shows a "🚨 Incident contact" row — a short, AI-summarised description of who to contact and how if that supplier experienced a security incident affecting you. Click Request Incident Contact Info on the card (its own expiry picker, separate from the questionnaire link) to send the supplier a short one-field form asking them to describe their incident-notification process. Once they respond, the card shows the summary with a "Show full text" link to the supplier's complete answer; the button relabels to Resend or Refresh depending on whether a request is pending or already answered. Coverage across the portfolio (how many suppliers have no process on file) is folded into the Phronesis Portfolio Analysis report, and both fields are included in the CSV export.

Incident Notice (broadcast to your supplier portfolio)

When a real incident affects part of your supply chain, the 🚨 Incident Notice toolbar button opens a 4-step broadcast wizard that sends a notification to a chosen set of suppliers at once and tracks their response. This is a distinct, higher-authority action from the "Incident contact" request above — that feature only asks a supplier how they would notify you; this feature is you notifying them, potentially at scale. It requires a separate permission your administrator grants specifically for this ("incident communications authority") on top of ordinary Third Party Risk Hub access — most day-to-day users of the portal won't see the button.

1. Compose — write a subject and message, optionally starting from a saved template, and give the incident a short reference label. Messages can include merge fields like the supplier's name, which are filled in individually for each recipient.
2. Select recipients — choose one of three ways to target the notice: individually (search and tick suppliers from your portfolio, with a running count of how many are selected — only suppliers with a contact email on file can be selected), by tag (every supplier carrying a chosen tag), or by risk tier (every completed supplier at a chosen High/Medium/Low risk level). Tag and risk-tier selections are resolved on the next step, since the exact list depends on your whole portfolio, not just what's currently loaded on screen.
3. Preview — see exactly what one recipient will receive, rendered with their own details filled in, plus a warning if any selected suppliers will be skipped (no contact email).
4. Confirm and send — type SEND to confirm before the broadcast goes out. This deliberate extra step exists because a broadcast, once sent, reaches real external contacts and cannot be recalled.

Sending is rate-limited to one broadcast per 30 minutes and 200 recipients per broadcast, and delivery happens in the background over the following few minutes rather than instantly, so that a large notification doesn't overwhelm outbound email capacity — a status indicator on the card shows delivery progress. Each recipient gets a link to a dedicated, no-login-required acknowledgement page where they can respond Acknowledged, No impact to us, or Need more information; your 📜 Broadcast History panel shows every past broadcast with a live count of how many recipients have responded and how. A small badge on a supplier's card flags when they've been sent a notice they haven't yet acknowledged.

White-label branding

Click the 🎨 Branding toolbar button to add your own logo and an accent colour to the three pages a supplier actually sees — the security questionnaire, the incident-contact request, and the incident-notice acknowledgement page — in place of the default Security Compliance Hub mark. Add a logo URL (must be an https:// link to an image, ideally wide with a transparent background) and/or a 6-digit hex accent colour; a live preview shows how the page header will look before you save. Branding applies across your whole portfolio, including any MSP clients you send questionnaires or notices on behalf of. Choose a colour dark enough that white button text stays readable — there's no automatic contrast check.

Questionnaire Library

Click the Custom Questions toolbar button to open the Questionnaire Library panel. The panel shows the 26 standard questions (grouped by domain, their wording fixed) alongside your authored custom questions. You can add, edit, and delete custom questions from the library, or import a batch via CSV (text,help,domain,weight columns — the importer validates each row before committing).

Your team's default. Each standard question has an In new questionnaires tick: the questions a new questionnaire starts with. Untick the ones your own question set already asks, or click Untick all to send only your own, then Save as the team default. It's shared by everyone on your portfolio, and an MSP keeps one per client. Read-only team members see it but can't change it. Until you save one, new questionnaires start with all 26.

Custom questions

All subscribers can author up to 100 bespoke questions (weighted 1–3, same 4-option scale) and send up to 100 per questionnaire, with the standard questions or instead of them. Custom questions genuinely affect the risk score — they're not informational-only. A standard-only benchmarkScore is computed separately so sector benchmarking remains comparable across organisations; only a questionnaire that asked all 26 standard questions has one.

Sending a questionnaire (3-step flow)

After filling in the supplier details and clicking Next →, a 3-step overlay guides you through the send:

1. Questions — choose what this supplier is asked. The standard questions are listed by domain, ticked as your team's default says: tick or untick each one, a whole domain, or all 26. Below them, tick any of your custom questions. A questionnaire needs at least one question.
2. Preview — read the full questionnaire (the standard and custom questions chosen) exactly as the supplier will see it, grouped by domain.
3. Expiry + Send — choose the link expiry (7 / 30 / 90 days / No expiry) and click Send. The supplier receives a one-time link; no account required.

Annual renewal reminders

Once a supplier completes a questionnaire, the platform tracks the response and emails you when re-assessment is approaching — 30 days out, 7 days out, on the day, and once if overdue. All due suppliers for a given account are bundled into a single daily digest so a batch send a year ago doesn't produce dozens of separate emails. Configure the destination mailbox (e.g. infosec@acme.com) and on/off toggle via the 🔔 Reminders button on the Supply Chain portfolio toolbar; if left blank, reminders go to your account email. Completed supplier cards show a "Renews in Nd" chip within 30 days and a "Renewal overdue" chip if past due.

Filtering, tags, and larger portfolios

The portfolio list is server-paginated in pages of 50 — the stats bar and every quick-filter chip count (All / High / Medium / Low / Awaiting / Overdue / Alerts) reflect your whole portfolio, not just the page currently on screen. Scroll to the bottom and click Load more suppliers to bring in the next page.

Add a free-text tag to any supplier — e.g. critical-vendor, pci — via the Edit tags link on its card (comma-separated, up to 10 tags per supplier). The Tags ▾ dropdown next to the filter chips then lets you narrow the whole portfolio to just that tag; picking a tag clears the active filter chip, since only one of the two applies at a time.

Typing in the search box switches into search mode, which looks across your entire portfolio (not just the currently loaded page) for a match on supplier name, contact email, or domain. Export CSV always exports the complete set matching your current filter/tag/search — not merely whichever page happens to be loaded — so a filtered export from a large portfolio is never silently truncated.

Executive portfolio report

The 📋 Exec Report toolbar button produces a board-level summary of your supplier portfolio: an executive summary, key risks, recommended actions and an overall rating written by Phronesis, the headline numbers, and a Supplier Breakdown table listing your suppliers from highest risk down. Save as PDF prints it. The report always covers your whole portfolio, with the same totals as the stats bar, whatever filter chip, tag or search is active and however many pages are loaded. Phronesis is given the numbers only, never supplier names. You can generate a new report once every 24 hours; until then the last one is shown to everyone on the portfolio. The table lists up to 500 suppliers; a larger portfolio shows the 500 highest-risk and says how many there are in all. A report generated before September 2026 has no table until it's regenerated.

🏢MSP / vCISO Portal

The MSP/vCISO Portal lets managed service providers and virtual CISOs run and manage compliance assessments across an entire client portfolio from a single account. Requires the msp_access custom claim — contact the MSP & vCISO Partner Hub to arrange access.

Phronesis analysis allowance

Each client in your portfolio gets 3 Phronesis AI analysis runs per calendar month (UTC), enough for a monthly analysis with room for a re-run. The allowance is shared by everyone on your team working on that client, and across all the frameworks you run for them. Analysis you run outside any client has its own allowance of 3. Allowances reset at midnight UTC on the 1st. Ask Phronesis guidance and chat don't count towards it. Each client card shows how many runs that client has left this month ("2 of 3 analysis runs left"), and the client's page shows it under the client's name with the date it resets. Your own allowance shows as Own analysis runs left in the stats row above your client list. If a client regularly needs more, contact support: we can raise that client's monthly allowance.

Portfolio view

The portal home shows all managed clients in a searchable grid with aggregate stats (total clients, assessed count, average score). Each client card links to a detail view showing per-framework assessment tiles, policy documents, and the Remediation Tracker for that client.

Above the grid, a chip bar lets you narrow the list to Unassessed, Stale (>90d), or Recent (<30d) clients — useful for spotting clients you haven't touched in a while or new clients you've added but never run an assessment against. Chips combine with the search box (AND logic), and the portfolio resets to "All" every time you reopen the portal.

Adding and removing clients

The portfolio owner adds clients with + Add Client. Team members can edit a client's details but can't add clients. Every client counts towards your account's client limit, and the portfolio header shows how many you've used (for example, 12 / 25).

To remove a client, contact support at support@securitycompliancehub.io. There's no delete button in the portal, because your client limit counts every client in your portfolio. When support removes a client, its assessments, evidence files, integrations and suppliers are deleted, and you get its place under your limit and its storage space back. You can rename a client at any time with the pencil icon on its card; each change to its name is recorded.

Portfolio Insights

The Insights tab (next to the Clients tab at the top of the portfolio) gives you a risk-ranked view across your entire client portfolio. It shows four summary stats — stale assessments (>90 days since last run), open critical and high remediation actions, integration coverage, and number of ranked clients — plus a Top Risk Clients list ranked by a composite score that combines low assessment scores, critical gaps, open high-urgency actions, and staleness. Clicking a row opens that client's detail view directly.

Insights are computed on demand and cached for 30 minutes. Use the Refresh button to bypass the cache and recompute immediately.

Posture & pipeline (beta)

The Posture & pipeline tab, marked Beta, shows every client's security basics on one screen: Identity (MFA coverage, separate admin accounts, Conditional Access), Endpoints (anti-malware or EDR coverage, Intune device compliance), Patching (critical updates within 14 days) and Incidents (open incidents). A reading comes from the client's connected tools first (Microsoft 365, Okta, CrowdStrike, Google Workspace) and otherwise from its answer in the latest finalised assessment of whichever framework asks the question. Microsoft Secure Score is listed but never scored.

Four bars at the top share your clients out by status for each basic: bad, warning, good and no data. Select a segment to see those clients. Below them are the clients needing attention, most in need first: any warning or bad reading, answers their own tools contradict, or an assessment over 90 days old. A good column is a tick (grey when the tool reading is over 30 days old). Select a client's name to see every reading with its source, and links to its Connected tools and Assessments.

Projects to price (the "N projects to price →" link) has one remediation project for each client needing attention. Each one shows the client's open Remediation Tracker actions grouped into a work package for each basic, a warning when a high-severity incident is open, and the Policy Generator templates its weak basics call for, marked New or Update. Export CSV downloads the selected project. The board is worked out by rules, with no Phronesis analysis, and cached for 30 minutes; Refresh recomputes it. A team member limited to some clients sees only those clients.

Pricing a project. Each project is priced in days at your rates: leading the remediation and a monthly board report for as many months as its actions run (to the last due date), and each new or updated policy. The portfolio owner sets the rates (day rate, days for each line, an optional margin on subcontracts, the VAT rate and the business name your documents are from); until then the page shows example rates. Untick a policy to leave it out of a quote.

Who delivers each work package. Choose the client's Internal team (not priced), or Pro Services: print a Request for quote for the package (its actions, what the client's tools count, the tracker's estimate and what "done" means on the board), then add the quotes that come back and choose one. A quote from your partner MSP is subcontracted by you: it goes in your fees, plus your margin if you set one, which no document shows. A quote from the client's own MSP or the market is contracted by the client directly: it's in the client's programme budget, not your fees. You can move any action to another package.

The statement of work and the pipeline. Issue statement of work numbers and prints it (Save as PDF): why the work is needed, the work packages and who delivers them, the policies, your fees with VAT (a statement's VAT rate can differ from your usual one), and the timeline and acceptance. Issuing sets the project to Proposed and keeps that price, even if your rates change later; mark it Won or Lost when you know. The Pipeline bar at the top adds up your fees by stage, before VAT; select a stage to see its projects. Read-only team members see all of it but change nothing.

The Posture & pipeline datasheet (two pages, PDF) explains the tab for a colleague or a partner, with screens showing a fictional MSP and its clients. Download it from the MSP & vCISO Partner Hub.

Per-client assessments

From a client's detail view, open any assessment framework tile to run or view results scoped to that client. Once finalised, the button reads View completed assessment → and calls GET /api/msp/get-snapshot, which returns the client's latest scores, strengths, next steps, and section-level control scores — the same shape as the standard results viewer — plus the full Assessment Record when that client's run has one (see My Hub above). From the same view you can re-run a Phronesis analysis on behalf of the client.

In-progress assessments appear whoever on your team started them, and on whichever device, because the Portal reads the client's progress from the cloud. Each card shows who saved it last, or who has it open right now, and a named scope gets its own card. A card marked Only in this browser is a run your browser holds that hasn't reached the cloud yet — usually one answered before client assessments saved to the cloud. Open it and save progress to share it with your team. Re-run starts a clean run, clearing that client's previous answers in your browser. Compliance Readiness, the free public checker, has no client tile — it isn't something you run for a client.

An analysed assessment shows Analysed — awaiting finalisation with a Finalise button until you confirm it. The client's answers sync to the cloud as you work, shared with your team (see Collaborative Drafts), so anyone with edit access can finalise it from any device. The ← client name link at the top of a client's assessment brings you back to that client here.

Across frameworks

Once two frameworks a crosswalk links are finalised for a client (CAF and ISO 27001, say), an Across frameworks tile appears in the client's completed-assessments section, with how many shared gaps there are. Open for this client → opens Across your frameworks with that client's own finalised runs: their frameworks and each report's verdict, the gaps their linked frameworks share, and a named scope to compare. Print it for the client's board, or export the shared gaps as CSV. Editors can add a shared gap to the client's Remediation Tracker; read-only team members see the page without the Add to tracker button.

Risk Scenarios

Once at least one framework assessment has been completed for a client, a Risk Scenarios section appears below the assessment tiles. It uses the client's saved section scores to surface the most relevant threat scenarios — ranked Critical → High → Moderate → Low — alongside defensive controls and an optional Phronesis narrative. When multiple frameworks are complete, framework selector pills let you switch the view between CRMA, CAF, DORA, ISO 27001, PE DD, and CE; the view defaults to CRMA (broadest coverage) or the lowest-scoring framework when CRMA is unavailable. No additional data fetch is required — scenarios compute from the section scores already loaded for the assessment tiles.

Third Party Risk Portfolio (MSP add-on)

MSP subscribers who hold the Third Party Risk add-on (msp_sc_access claim) can manage supplier security questionnaires scoped per client. The client detail view shows a Third Party Risk Portfolio tile with four stat cards (high-risk suppliers, unacked alerts, total suppliers, awaiting response). Opening the tile launches supply-chain.html?mspClient=<id>&mspClientName=<name> — every API call automatically scopes to the client's supplier sub-collection rather than the practitioner's personal portfolio. The weekly Risk Purview re-scan also routes alerts to each client's sc_alerts sub-collection automatically.

Evidence Vault scoping

When uploading evidence files on behalf of a client, the optional clientId parameter namespaces files under evidence/{uid}/clients/{clientId}/…. This keeps each client's audit documentation isolated within the MSP account's storage quota (500 MB shared across all clients).

Multi-tenant teams access

MSP subscribers can invite colleagues to share their client portfolio without purchasing an additional licence. The owner chooses two things for each invite, independently: what the member can do (Editor — full read/write, the same as the owner — or Viewer — read-only) and which clients they can see (the whole portfolio, or a specific list). The only owner-exclusive actions are adding clients, managing billing, sending further team invites, and changing another member's access. By default an invited member is an Editor who sees the whole portfolio; either setting can be narrowed at invite time or at any point afterwards — see "Editor/Viewer role and per-client access" below.

Inviting a team member

1. The portfolio owner clicks the Team button in the MSP Portal header, enters a colleague's email address, chooses Editor or Viewer, chooses All clients or Specific clients, and clicks Send invite.
2. The colleague receives a branded invite email — worded for their actual access level, so a Viewer invite says so up front rather than implying they can make changes.
3. They click the link, which opens msp-team-onboarding.html?token=…. The invite preview shows their access level (Practitioner, or read-only Viewer) before they sign in. They sign in with any provider (Google, Microsoft, or email/password). A new SCH account is created automatically if needed.
4. On sign-in, the token is atomically consumed. The msp_access custom claim is set on their account along with a tenantId (linking them to the owner's portfolio) and a tenantRole matching the role chosen at invite time. Their client access — full portfolio or the specific clients chosen at invite time — is recorded on their member record, not as a claim.
5. The team view in the portal updates immediately to show the new member, their role and access scope, and any pending invites.

To remove a team member, open the Team view and click Remove next to their name. Their access is revoked immediately — they will be signed out of the portal on their next page load.

Editor/Viewer role and per-client access

By default, an invited team member is an Editor who sees every client in your portfolio. Two independent settings can each be narrowed for a specific member, at invite time or afterwards: their role (Editor — can run assessments, save scores, and edit client details, though only the owner adds clients; or Viewer — can see everything within their scope but cannot make changes) and their client scope (all clients, or a specific list — useful for a subcontractor, a junior analyst, or someone brought on for a single engagement).

1. Open the Team view. Each member's row shows two badges: a teal Editor or amber Viewer role badge, and a teal All clients or amber N client(s) scope badge.
2. Click Edit access next to a member's name to open the access editor.
3. Choose Editor or Viewer, choose All clients or Specific clients (ticking the clients this member should see for the latter), then click Save access.
4. Client scope changes take effect on the member's next request — restricted clients disappear from their client list, and a deep-link to a client they no longer have access to shows a clear "you don't have access" message rather than an error. Portfolio-wide summary counts (e.g. in Portfolio Insights) reflect the whole book of business regardless of a member's own scope, but any list of named clients is filtered to what that member can see. Role changes take a little longer — since read-only enforcement is carried on the member's sign-in token, a role change takes effect the next time they sign in, or automatically within about an hour.

🔌Integrations — Bringing Tool Data into Assessments

SCH offers two complementary ways to enrich your assessments with real data from your existing security toolstack, replacing manual self-declaration with evidence pulled from live systems.

Option A — Live connection (Microsoft Entra ID)

Connect your Azure AD / Entra ID tenant once and SCH checks your Cyber Essentials, CAF, DORA, ISO 27001, SOC 2 Readiness, CIS Controls, NIS2, CMMC, NIST CSF and FedRAMP answers against live security signals in your reports' Checked against your tools section.

What data is pulled

• MFA coverage across user accounts
• Authentication method policy (FIDO2 passkeys, Microsoft Authenticator, SMS)
• Conditional Access policy state
• Risky user counts from Entra ID Protection
• Device compliance posture (Intune)
• Microsoft Defender alerts — including Sentinel-routed alerts when Microsoft Sentinel is linked to your Defender XDR workspace
• Security incidents (requires SecurityIncident.Read.All and a Sentinel licence)
• Microsoft Secure Score and Secure Score control breakdown
• Sign-in log availability
• Guest / external user count

How your tenant's figures appear in reports

• Checked against your tools — each answer the figures can speak to (e.g. "29 of 33 users (88%) are registered for multi-factor authentication; 4 aren't") and whether it agrees with what you said. A figure behind several answers, such as your Intune compliance rate, is shown once with every answer it affects.
• Couldn't be checked — when a data point needs a licence you may not hold (Entra P1/P2, Intune, or Defender plans).
• Cyber Essentials Plus (Cyber Essentials only) — when your target is CE Plus, the report's Cyber Essentials Plus section adds a per-control preview from your tenant of how the assessor's tests are likely to land.

How to connect

1. Go to My Hub → Workspace → Security Tool Integrations and click Connect on the Microsoft Entra ID card. You get a connection link, valid for an hour.
2. Open it yourself if you are a Global Administrator (or Privileged Role Administrator) of your Microsoft 365 organisation, or click Copy and send it to one.
3. The link opens a Security Compliance Hub page that shows the administrator who asked: your name, your email address and the organisation on your account. It also says what will be read and how long the link lasts. They click Continue to Microsoft, or Cancel request if they don't recognise you.
4. The administrator reviews the read-only permissions and clicks Accept, then signs in to the organisation with their own work account. The sign-in is how we know which organisation to read, and we read that one only, so you never type a Tenant ID.
5. When the page says access is approved, come back to the card and click Finish connecting. That runs the first sync, and your next Cyber Essentials, CAF, DORA, ISO 27001 or SOC 2 Readiness report is checked against it.

MSP Portal — connecting a client's M365 tenant

If you are an MSP practitioner running assessments on behalf of a client, you can connect that client's Microsoft 365 tenant separately from your own. When connected, that client's reports are checked against their tenant, and the section names their organisation, so it's never confused with your own.

Steps for MSP practitioners

1. Open the MSP Portal, click into the client and open its Integrations tab.
2. On the Microsoft 365 tile, click Get connection link. The link is valid for an hour.
3. Click Copy and send it to the client's Microsoft 365 Global Administrator by email, Teams message or ticket.
4. The link opens a page that shows the client's administrator who asked: your name, your email address, your organisation and the client's name as you entered it in the MSP Portal. They click Continue to Microsoft, or Cancel request if they don't expect it.
5. The client's administrator reviews the permissions, clicks Accept, then signs in to their organisation. The sign-in tells us which organisation the connection is for.
6. Back in the MSP Portal, the tile shows Access approved. Click Finish connecting to run the first sync.

That client's reports are now checked against live data from their tenant. The practitioner's own personal Entra integration is completely unaffected. If the client's tenant is later disconnected, the section says no tools are connected rather than ever falling back to personal data.

For your Azure Global Administrator

When you (or your client) open the connection link and click Continue to Microsoft, the Azure Global Administrator is asked to approve a set of application permissions for Security Compliance Hub, then to sign in. Here is what each permission enables:

• Reports.Read.All — MFA registration counts, authentication method usage, sign-in log availability. Requires: Azure AD Free / Entra ID Free.
• Policy.Read.All — Conditional Access policy list and state, authentication methods policy (which methods are enabled tenant-wide). Requires: Entra ID P1 for CA data; Free tier for auth policy.
• AuditLog.Read.All — Confirms that sign-in logs are available in the tenant. Requires: Entra ID Free.
• User.Read.All — Guest / external user count. Requires: Entra ID Free.
• Organization.Read.All — Tenant display name (shown in the integration card). Requires: Entra ID Free.
• IdentityRiskyUser.Read.All — Risky user counts from Entra ID Protection. Requires: Entra ID P2.
• DeviceManagementManagedDevices.Read.All — Intune device compliance posture (compliant / non-compliant / total). Requires: Microsoft Intune (or EMS E3/E5).
• SecurityEvents.Read.All — Microsoft Defender alerts and Microsoft Secure Score. Requires: Defender for Business or Defender for Endpoint P1/P2.
• SecurityIncident.Read.All — Security incidents and Sentinel-linked alert data. Requires: Microsoft Sentinel.

All of these are application permissions (app-only): SCH reads the data as its own app, never as the person who signed in, and never performs write actions. The sign-in asks only to sign the administrator in and read their basic profile; SCH uses it to learn which organisation they belong to and nothing else.

Option A2 — Live connection (Okta Identity Engine)

Connect your Okta organisation once and SCH checks your Cyber Essentials, CAF, DORA, ISO 27001, SOC 2 Readiness, CIS Controls, NIS2, CMMC, NIST CSF and FedRAMP answers against live IAM posture signals in your reports.

What data is pulled

• MFA enrolment coverage across user accounts
• Authenticator policy state (phishing-resistant methods vs SMS/voice)
• Number of active sign-on policies
• Assigned app count and group membership
• Risk event counts

How to connect

1. Go to My Hub → Workspace → Integrations. For an MSP client, open the client's Integrations tab in the MSP Portal.
2. Under the Okta card, click Connect and enter your Okta domain (e.g. https://yourorg.okta.com) and a read-only API token. The domain must end in okta.com, okta-emea.com, oktapreview.com, okta-gov.com or okta.mil.
3. Click Connect. SCH performs an initial data sync, and your next report is checked against it.

Option A3 — Live connection (CrowdStrike Falcon)

Connect your CrowdStrike Falcon environment once and SCH checks your Cyber Essentials, CAF, DORA, ISO 27001, SOC 2 Readiness, CIS Controls, NIS2, CMMC, NIST CSF and FedRAMP answers against live EDR signals (sensor coverage, prevention policies, detections, vulnerabilities, incidents) in your reports.

What data is pulled

• Sensor health: total devices, normally-reporting count, reduced-functionality-mode (RFM) count, healthy coverage percentage, stale sensor count
• Prevention policies: enabled / total count, NGAV policy presence
• Detections: open count, critical and high severity breakdown
• Spotlight vulnerabilities (requires Falcon Spotlight licence): open count, critical, high, exploitable
• Incidents (requires Falcon Insight access): active count, high fine-score (≥70) count

Assessment questions covered

How the figures appear

• Checked against your tools — in your report, each answer Falcon can speak to (e.g. "50 of 50 sensors reporting normally") and whether it agrees with what you said.
• Couldn't be checked — when a data point needs a Falcon module you may not hold (Spotlight for vulnerability data, Falcon Insight for incident data).

How to connect

1. Create a Falcon API client in your CrowdStrike console with read-only scopes: Detections:Read, Hosts:Read, Prevention policies:Read, Spotlight vulnerabilities:Read, Incidents:Read.
2. Go to My Hub → Workspace → Integrations. For an MSP client, open the client's Integrations tab in the MSP Portal.
3. Under the CrowdStrike card, click Connect, choose your Falcon cloud region (US-1, US-2, EU-1, US-GOV-1 or US-GOV-2) and enter the Client ID and Client Secret. Your Falcon console's address shows the region: falcon.eu-1.crowdstrike.com is EU-1, falcon.crowdstrike.com is US-1.
4. Click Connect. SCH performs an OAuth2 client-credentials sync, and your next report is checked against it.

Option A4 — Live connection (Google Workspace)

Connect your Google Workspace tenant once and SCH checks your Cyber Essentials, CAF, DORA, ISO 27001, SOC 2 Readiness, CIS Controls, NIS2, CMMC, NIST CSF and FedRAMP answers against live identity-layer signals (2-Step Verification coverage, account lifecycle, managed-device counts) in your reports. Designed for organisations on Google Workspace rather than Microsoft 365.

What data is pulled

• 2-Step Verification — enrolment percentage (Google's own metric) and admin-enforced coverage percentage
• Accounts — active / suspended / super-admin / delegated-admin counts
• ChromeOS devices — active and disabled Chromebooks under enterprise enrolment
• Mobile devices — Android and iOS devices under Google MDM (approved / blocked / compromised counts)

Assessment questions covered

How to connect

The auth flow differs from Microsoft Entra and Okta: Google Workspace uses Domain-wide Delegation (DWD). You don't generate any credentials. Your Workspace super admin grants access once by pasting SCH's service account identity into the Google Admin console, then an administrator signs in with Google, which tells us which Workspace to read.

1. Go to My Hub → Workspace → Security Tool Integrations and click Connect on the Google Workspace card (for MSPs, the client's Integrations tab in the MSP Portal). The card shows two steps.
2. Click Show instructions. SCH shows its service account Client ID and the four read-only OAuth scopes, both copyable. Your Workspace super admin signs in to admin.google.com, goes to Security → Access and data control → API controls → Manage Domain-wide Delegation, clicks Add new, and pastes the Client ID and scopes.
3. Click Get sign-in link. The link is valid for an hour and works once. Open it yourself if you're an administrator of the Workspace, or send it to one.
4. The link opens a Security Compliance Hub page that shows the administrator who asked: your name, your email address, your organisation and, from the MSP Portal, the client's name. It also says what will be read and how long the link lasts. They click Continue to Google, or Cancel request if they don't recognise you.
5. The administrator signs in with their Google Workspace account. SCH checks through Google that the account is an administrator there, connects the Workspace and runs the first sync. When the page says the Workspace is connected, come back to the card.

How the figures appear

• Checked against your tools — in your report, each answer Workspace can speak to (e.g. "87% of users have 2-Step Verification enrolled") and whether it agrees with what you said.
• An MSP client's own domain — on a client's assessment only that client's Workspace is read, and the section names its domain, so the source of the data is unmistakable.

Coming soon

The following integrations are on the roadmap. Contact us to register interest and get early access:

🏷️Platform Terms

📚Framework Terms

🔐Security Terms

❓Frequently Asked Questions

My auto-save isn't working across devices — why?

Cross-device draft sync is included in the Assessment Bundle, demo accounts, CE One-Shot, the PE Due Diligence / SOC Maturity / CMMC Level 2 / FedRAMP Moderate / HIPAA Security Rule claims, and the MSP Portal (for client assessments). Sign in on the second device and open the same assessment — a teal banner offers to load progress from the cloud. Trial users save to local browser storage only and cannot sync across devices. See Collaborative Drafts for the full sync behaviour, including tenant sharing and the "Last saved by" / "🔒 Being edited by" indicators on My Hub.

I ran analysis but I'm seeing the local analysis fallback (yellow banner)

When the Phronesis API returns a 502 or the response cannot be parsed, the platform falls back to a local JavaScript scoring engine. The yellow banner indicates this happened. Try clicking Analyse again — transient Cloud Function cold-starts are usually the cause. If the problem persists, check your internet connection or contact support.

My trial has expired but I can still see results — can I export them?

Results remain visible after trial expiry, but export (PDF/JSON) and sharing remain gated behind a subscription or one-shot purchase. Your saved scores in My Hub are retained indefinitely. Upgrade via Pricing or MSP & vCISO.

I updated my sector in Dashboard Settings but benchmarks haven't changed

Benchmark data is pre-aggregated every 6 hours per (type × sector) segment. After changing your sector, re-run any completed assessment's analysis (or simply reload the dashboard after 6 hours) to see the updated sector comparison. Note that your historical scores contribute to the previous sector's dataset until the next aggregation run.

Can I share a PE Due Diligence report with a client?

Yes — the Share button is available on PE Due Diligence results. Shared links require no login to view and expire on the schedule you select (7/30/90 days or no expiry). The shared page includes scores, the critical risks, strengths, next steps, and the Phronesis deal analysis. Evidence Vault files are not included in the shared view.

The NCSC CAF assessment is very long — can I save progress and return later?

Yes. All assessments auto-save every second to localStorage. When you return to the page, your previous answers are automatically restored. The sidebar progress tracker shows your completion percentage per principle. On My Hub, in-progress drafts appear as cards in the "Your Assessments" grid so you can navigate back easily.

Do you use tracking cookies or web analytics?

No. The platform uses only essential browser storage (Firebase Authentication session cookies for sign-in) and functional localStorage entries that auto-save your assessment progress and remember dialog dismissals. We do not run Google Analytics, advertising, retargeting, or any third-party tracking. The first time you visit you will see a one-line consent banner; you can re-open the preferences (and a "Clear local data" reset) at any time from the Cookie preferences link in the page footer. Full breakdown in our privacy notice.

🐛Reporting Issues

The fastest way to get a technical issue investigated is Support, in the Resources menu's Help column at the top of every page. On My Hub and the MSP Portal there is also a Support button in the top bar. Anyone signed in can use it; if you don't have an account, use the contact form instead.

What the Support form asks for

• Short summary (up to 200 characters) — one line saying what went wrong.
• What happened? (up to 4,000 characters) — what you were doing and what you saw on screen.

With what you type, the ticket carries the page you were on, your browser, screen size and language, and your account's email address, so we can reply. If your browser recorded an error on that page, the form shows it, marked Attached, before you send. Nothing else about your account is collected.

What happens after you send it

You'll see a confirmation with a reference number. Two things then happen:

1. Auto-triage — within seconds, an AI support engineer reads your ticket alongside the platform's recent logs for your account and the time of your problem, and writes a first diagnosis: what it thinks went wrong, the evidence for that, and a suggested next step. You don't need to do anything.
2. Human review — a support engineer reviews your ticket and that diagnosis. When they close it, you get an email with a note on what was found and what was done.

What auto-triage cannot do

Auto-triage only diagnoses. It never changes your account, your data or your access; only a support engineer takes action, and they check its diagnosis first.

Limits

You can send up to 5 tickets in 10 minutes, which stops an accidental loop from flooding the queue. If you have several problems at once, put them in one ticket.

💬Getting Help

If you have a question not covered here:

• Technical bugs and broken features — Use Support in the Resources menu (see Reporting Issues above). Without an account, use the consultancy contact form.
• Quick questions about what the platform does — The Sales advisor button in the bottom corner of our public pages, this one included, is an automated assistant that answers questions about frameworks, features and plans from what our website says, and hands anything else to our sales team. It doesn't see your account or your assessments; for help with an assessment, use the Phronesis chat on the assessment page. Questions asked there are kept for 90 days to improve the answers (see Data Privacy), so leave out personal details.
• General enquiries and access requests — Use the contact form on the MSP & vCISO Partner Hub.
• Billing and subscription — Contact via the consultancy page with "Billing" in the subject.
• Something to forward to a colleague or procurement — The Datasheets page has the one-page platform overview, the Assessment Catalogue, the Third Party Risk Hub, the problems it solves, Risk Management, Crosswalk Mapping and a step-by-step risk management guide as plain PDFs. For MSPs and vCISOs, the MSP & vCISO Partner Hub has the Compliance-as-a-Service sheet and the Posture & pipeline sheet. No sign-up.