Tools
Tools
See where you stand against a framework or across a security programme, check one decision such as how quickly a finding must be fixed, or run an incident exercise with your team. Each gives you something to act on.
- 21 tools
- 3 groups
What applies to us
4
- Scope check
Does DORA apply to us?
Say what kind of financial entity you are, whether an exclusion or the simplified framework applies, and whether you are a microenterprise. You get what DORA makes you and which of its requirements are yours, each with the reason.
8 questions · 52 DORA requirementsAbout 10 minutes - Scope check
Does HIPAA apply to us?
Answer up to 11 questions about what your organisation does with health information. You get the role HIPAA gives it: covered entity, business associate, subcontractor business associate, hybrid entity, neither, or not yet settled, and what that means for the Security Rule.
11 questions · 6 possible resultsAbout 8 minutes - Scope check
Does NIS2 apply to us?
Answer the questions NIS2's own scope test asks: what the entity does, the cases decided whatever its size, and its size. You get the classification, from essential entity to out of scope, the row of the test that decided it, and what it means.
10 questions · 17 rows of NIS2's scope testAbout 10 minutes - Scope check
Which SOC 2 report do we need?
Answer 13 questions about what your customers ask for, how long your controls have run, your date and your providers. You get a report type (Type 1, Type 2 or neither yet), the observation period, the categories and what to settle next. It is guidance for planning, not an audit decision.
13 questions · 5 report typesAbout 10 minutes
How are we doing
12
- Assessment
Where are our gaps? — ISO/IEC 27001 2022
Work through what ISO 27001:2022 actually asks for and see which parts you would struggle to evidence. For an organisation working towards certification, holding it, or answering a customer who has asked.
25 clause requirements and 93 Annex A controls · ISO/IEC 27001 2022 · 11 clauses and control themesAbout 70 minutes - Assessment
Where are our gaps? — NIST Cybersecurity Framework 2.0
A broad look at how your organisation manages cyber risk, covering governance and recovery as thoroughly as defences. No certification in view — NIST CSF is free to read and there is nothing to pass.
106 requirements · NIST Cybersecurity Framework 2.0 · 6 functionsAbout 65 minutes - Maturity
Does our board report work?
Test your last board cyber report against what a board needs to decide. You get a level in words, the content to add, most important first, and the content to take out.
24 criteria · 6 parts of the reportAbout 30 minutes - Maturity
How ready are we for DORA?
Say what kind of financial entity you are, then rate the duties DORA makes yours, across governance, ICT risk, incidents, testing and third parties. It names the gaps that block you, and gives no score.
20 readiness items · 7 areasAbout 30 minutes - Maturity
How ready are we for HIPAA?
Rate 36 readiness items against what the HIPAA Security Rule and the breach rules ask of a covered entity or business associate. You get the result in words, the blocking gaps, and every gap in priority order. It describes your records, not the law.
36 readiness items · 10 areasAbout 25 minutes - Maturity
How mature is our metrics programme?
Check whether the numbers you report drive decisions, arrive with an owner and are checked before anyone sees them. You get up to three next actions, each with the document that helps.
8 dimensionsAbout 10 minutes - Maturity
How ready are we for NIS2?
Rate each readiness item against what NIS2 asks of the entity, and see the blocking gaps first. You get the result in words and every gap in priority order.
17 readiness items · 5 areasAbout 25 minutes - Maturity
Which security policies are we missing?
For each policy topic your kind of organisation needs, check whether a document exists, is approved at the right level, in date, acknowledged and not duplicated.
18 policy topics · 3 profilesAbout 20 minutes - Maturity
How mature is our security programme?
Practice by practice, from governance to recovery: each domain's level today against the level you need, and the practices to raise first, one level at a time.
32 practices · 14 domainsAbout 40 minutes - Maturity
How ready are we for SOC 2?
Rate 32 readiness items that usually have to be true before a SOC 2 observation period starts. You get the result in words, the blocking items, and every gap in priority order. It gives no score and it is not an audit opinion.
32 readiness items · 5 areasAbout 20 minutes - Exercise
Run a tabletop exercise
Run one of the incident scenarios on a shared screen, from ransomware to a personal data breach. Injects arrive one at a time, the facilitator's notes stay hidden from the room, and the session ends with a debrief and what happens next.
8 scenarios · On a shared screen · Nothing is recordedAbout 3 hours per session - Maturity
How mature is our vulnerability management?
Answer questions about how your vulnerability programme actually works, from which systems are scanned to what management decides. You get the three changes most likely to reduce risk, each with the document that helps.
28 questions · 8 parts of a programmeAbout 15 minutes
Smaller checks
5
- Quick check
What should I check this week?
For a security leader who has inherited a programme: enter your first day to see your week and phase of the first 90 days, and the twenty things to find out, with the proof to ask for. Prints for the week.
20 items in 10 areas · Prints for the weekAbout 2 minutes - Quick check
Is this proof enough?
For a new security leader checking what they were told: choose what you were shown for one claim and get its finding word, from Evidenced to Contradicted, what to do next and the proof to ask for.
2 questions · One claim at a timeAbout 2 minutes - Quick check
Can this service recover in time?
For one critical service: give its recovery objectives, what it needs to run, its last recovery test and when they were agreed. You get the seven checks of the recovery objectives matrix, the time it would take to come back after a destructive attack, and its status in words.
7 questions · One service at a timeAbout 10 minutes - Quick check
Is our Stage 2 date realistic?
Give the totals from your ISO 27001 readiness assessment and your booked audit date. You get the earliest date a Stage 2 audit could pass, in the three steps that decide it, and whether your date holds. No names, no owners.
6 questions · Totals only, no namesAbout 5 minutes - Quick check
What priority and deadline does this finding get?
Four questions about one finding: is it being exploited, can it be reached from the internet, how critical is the system, how severe is it. You get its priority, its fix deadline and the dates that follow, from the rules in the vulnerability pack.
4 questions · One finding at a timeAbout 2 minutes
No tool matches those choices.