Know where you stand against the framework someone is asking about.
Essential Eight, ISO/IEC 27001 or NIST CSF 2.0, from one five-minute evidence collection in your Microsoft 365 tenant. You get a board-ready report with the evidence behind every rating.
One collection of evidence, every framework you need
An insurer, a tender, a customer or your board names a framework. We read the settings that framework asks about and rate you against it. Buy one now and add another on the same evidence within 90 days, without collecting again.
Essential Eight
The Australian Cyber Security Centre model insurers and government buyers ask for.
- Maturity level per strategy, zero to three
- Measured against the level you target
- Gap list and next steps
ISO/IEC 27001 gap assessment
How far you are from a Stage 1 certification audit.
- Clauses 4 to 10 and all 93 Annex A controls
- Draft Statement of Applicability
- Gap list and audit readiness
NIST CSF 2.0 assessment
A common language for boards and customers outside Australia.
- Current and target profile
- A tier for each of the 22 categories
- Gap list and next steps
Planning to turn on Microsoft 365 Copilot, or working towards ISO/IEC 42001 or SMB1001? The AI readiness, ISO/IEC 42001 and SMB1001 assessments run on the same evidence.
Five minutes of your IT time, then we do the work
A read-only scan
Your IT administrator runs our read-only script in your tenant for about five minutes. It changes no setting.
A short questionnaire
It asks only what a scan cannot see, for the frameworks you bought.
Scored by code
Code scores the evidence against each framework. The same evidence gives the same rating every time.
Checked by a consultant
A consultant checks every finding and a director signs the report off.
A board readout
One meeting: where you stand, the three things to fix first, and your questions.
A report your board can read and your IT team can act on
A board page: one rating per framework, the three things to fix first and the trend since last time.
One card per finding: what we found, the evidence and where it came from, why it matters and the fix.
A maturity rating for every Essential Eight strategy, and a profile or heat map for each other framework.
A draft Statement of Applicability for ISO/IEC 27001.
The gap list and next steps, with the effort for each fix.
An evidence workbook for your IT team or managed service provider.
Your evidence stays in Australia
Your evidence stays in Australia, in Microsoft Azure Australia East and on our own server in Brisbane. It is never sent to a public AI service. Code works out every score, not an AI, and a consultant checks every finding.
Want the plan to fix it as well?
An assessment ends in a gap list and next steps. The Cyber Roadmap turns those gaps into a costed plan in three levels: urgent, should have and nice to have. It ranks each gap before it picks a fix, uses what you already own first and marks every product we would earn on.
With an assessment
Built on the same evidence, delivered at the readout.
On its own
A five-minute collection and a short discovery conversation.
Every quarter
Re-assessed and re-ranked, with a trend line for the board.