Assess and Comply

Measure posture against frameworks, close gaps, produce audit-ready evidence.

Measure posture against the frameworks you're held to, close the gaps that matter, and produce evidence an auditor will accept.

Book a Demo Explore the tours

Compliance score

65%

5 assessments scored

Active assessments

5 total · 2 completed

Controls assessed

48/106

22 compliant · 9 non-compliant

Open gaps

4 critical · 5 high

Evidence collected

18/40

45% of requested documents

Top gaps requiring attention

Across NIST CSF 2.0 and CIS Controls v8

View all →

Control	Fn	Framework	Finding	Priority	Status	Owner
PR.AA-03	PR	NIST CSF 2.0	MFA not enforced for 14 privileged accounts	Critical	In Progress	R. Mehta
CIS 13.1	DE	CIS Controls v8	No centralised network monitoring for the DMZ segment	Critical	Open	S. Whitfield
GV.SC-04	GV	NIST CSF 2.0	Supplier register incomplete for tier-2 vendors	High	In Progress	A. Lindqvist
CIS 3.11	PR	CIS Controls v8	Data at rest unencrypted on two legacy file shares	High	Open	R. Mehta
ID.AM-02	ID	NIST CSF 2.0	Software inventory diverges from the deployed estate	Medium	Resolved	T. Nakamura

What this category delivers

Three outcomes, not a feature list.

Know your real score

Maturity scored control by control, not estimated in a spreadsheet by whoever had time.

Close gaps in priority order

Every gap carries an owner, a priority, and a status, so the list moves instead of growing.

Walk into the audit ready

Evidence collected continuously and mapped to the control it satisfies, not assembled the week before.

The agents

2 agents in Assess and Comply

Each one owns its job end to end, with its own pipeline, its own integrations, and its own workspace.

GOVERN

Organizational context, risk strategy, policies

18/32

Assessed

GV.OCOrganizational Context

5 ctrls4 done3 ✓1 ✗

GV.OC-01

The organizational mission is understood and informs cybersecurity risk management

Manual2 files

GV.OC-02

Internal and external stakeholders are understood, and their needs are considered

Manual1 files1 issues

GV.OC-03

Legal, regulatory and contractual requirements are understood and managed

Hybrid3 files

GV.RMRisk Management Strategy

7 ctrls5 done2 ✓2 ✗

GV.SCCybersecurity Supply Chain Risk Management

10 ctrls4 done1 ✓3 ✗

IDENTIFY

Asset management, risk assessment, improvements

12/21

Assessed

ID.AMAsset Management

8 ctrls6 done4 ✓1 ✗

ID.AM-01

Inventories of hardware managed by the organization are maintained

Automated4 files

ID.AM-02

Inventories of software, services and systems are maintained

Automated2 files2 issues

ID.RARisk Assessment

10 ctrls5 done2 ✓2 ✗

PROTECT

Access control, data security, platform security

10/22

Assessed

PR.AAIdentity Management, Authentication and Access Control

6 ctrls5 done3 ✓1 ✗

PR.AA-03

Users, services and hardware are authenticated

Automated6 files1 issues

PR.AA-05

Access permissions and authorizations are defined and enforced

Hybrid3 files

PR.DSData Security

10 ctrls3 done1 ✓1 ✗

DETECT

Adverse event analysis, continuous monitoring

4/11

Assessed

Function scoresCategory heatmapGaps and findingsDocument requestsAutomated scans

01 / 02

Assess and Comply

NIST CSF 2.0 Assessment

Scores your maturity across all six CSF 2.0 functions, tracks every gap to an owner, and produces the report your board asked for.

Six-function scoring. Govern, Identify, Protect, Detect, Respond, and Recover, each scored with the controls behind the number.
Control-level assessment. Every control carries a status, an assessor, and the evidence supporting its score.
Gap tracking. Each gap has a priority, an owner, and a state, so the list is worked rather than admired.
Evidence collection. Evidence is gathered from your connected tools and mapped to the control it satisfies.

Full NIST CSF 2.0 detail →Take the tour

Overall Compliance

68%

Total Safeguards

153

In Progress

Completed

CIS 1Completed

Inventory and Control of Enterprise Assets

Actively manage all enterprise assets connected to the infrastructure

5 / 5 Safeguards100%

Low Risk

CIS 2In Progress

Inventory and Control of Software Assets

Actively manage all software on the network so only authorised software executes

5 / 7 Safeguards71%

Moderate Risk2 Findings

CIS 3In Progress

Data Protection

Develop processes to identify, classify, retain and dispose of data

7 / 14 Safeguards50%

High Risk3 Findings

CIS 4In Progress

Secure Configuration of Enterprise Assets and Software

Establish and maintain the secure configuration of assets and software

6 / 12 Safeguards50%

High Risk4 Findings

CIS 5Completed

Account Management

Use processes and tools to assign and manage authorisation to credentials

6 / 6 Safeguards100%

Low Risk

CIS 6In Progress

Access Control Management

Use processes and tools to create, assign, manage and revoke access credentials

5 / 8 Safeguards63%

Critical Risk2 Findings

CIS 7In Progress

Continuous Vulnerability Management

Develop a plan to continuously assess and track vulnerabilities on all assets

4 / 7 Safeguards57%

High Risk1 Findings

CIS 8In Progress

Audit Log Management

Collect, alert, review and retain audit logs of events

6 / 12 Safeguards50%

Moderate Risk2 Findings

CIS 9Completed

Email and Web Browser Protections

Improve protections and detections of threats from email and web vectors

7 / 7 Safeguards100%

Low Risk

Safeguard scoringImplementation groupsAsset inventoryAI remediation guidanceDocument library

02 / 02

Assess and Comply

CIS Controls v8 Assessment

Assesses all 153 safeguards against CIS Controls v8, scoped to your implementation group, with the automatable ones checked automatically.

Safeguard-level detail. Every safeguard across all 18 controls, scored one by one, not rolled up into a control-level guess.
Implementation-group scoping. Scope to IG1, IG2, or IG3 so you're measured against what applies to you.
Automated inventory safeguards. Controls 1 and 2 are answered from real asset and software inventory, not a questionnaire.
Maturity scoring. Each safeguard scored on a maturity scale, with the score's basis recorded.

Full CIS Controls v8 detail →Take the tour

Coming soon

SOC 2 Readiness

Continuous SOC 2 monitoring with automated evidence collection and control mapping.

Coming soon

Third-Party Risk

Vendor risk scoring, questionnaire automation, and continuous supply-chain monitoring.

The other categories

Detect and RespondTriage alerts, govern AI usage, and contain compromise across the estate.

Protect and HardenRead findings, decide what matters, author the fix, and drive it to closure.

Train and AwarenessTraining, phishing simulations, and closed-loop feedback.