One standard, measured the same way every time
Every firm we protect is assessed against the same set of controls, scored the same way and re-measured every quarter. This page shows how the framework is built, how much each tier covers, and how it lines up with NIST CSF 2.0 and the CIS Controls.
Every square is a control we evidence
Choose a tier and how your firm runs, then open any box to see what it achieves and where it sits in NIST CSF 2.0.
A score you can't game
The same rules apply to every firm, so this quarter's result can be compared with last quarter's and with the firm next door.
Every control needs proof
A control counts only when there is a scan result, a report or a record behind it. "We think so" is scored as a gap, because a regulator would score it the same way.
Some gaps matter more
The controls that stop the most common attacks count three times as much as the rest. If any one of them is missing, the overall score can't rise above 49%, however good everything else looks.
No credit for good intentions
A control that is only partly in place earns half credit, and we define in advance what full and partial mean for each critical control, so two assessors reach the same score.
Re-measured and tracked
Each review is saved, so you see the trend: what closed, what slipped and what changed since last time. That record is the evidence your insurer and regulator ask for.
Mapped to NIST CSF 2.0 and the CIS Controls
| Function | Core | Plus | Regulated |
|---|---|---|---|
| Govern | – | – | 3 |
| Identify | 15 | 16 | 18 |
| Protect | 30 | 41 | 45 |
| Detect | 17 | 23 | 24 |
| Respond | 3 | 3 | 3 |
| Recover | 5 | 7 | 7 |
| All controls | 70 | 90 | 100 |
Every control is mapped to a NIST CSF 2.0 category and, where one applies, to CIS Controls v8.1 safeguards. Your reports show your score against each CSF function, so you can answer an auditor in the language they use.
Govern grows with the Regulated tier, where policies, risk assessment and vendor reviews are delivered through our virtual CISO service.
Respond is 24/7 containment and remediation. Forensic, legal, insurer and regulator response is coordinated with specialist partners.
The detailed mapping is shared with clients as part of the assessment, alongside the full control list.
See the full control list for your firm
The individual controls, how we deliver them and the CIS mapping are shared as part of an assessment. Start with the check, or ask us for an outside view.