Services
Each service works on its own, or in a project where it can reuse the results of the others. Open a service to see the document it produces.
The same account runs every service and project, for one company or several. Run any service with or without an account. A free account adds prefilled forms, saved results and their editing.
The scope statement of a management system or programme: what it covers, what it leaves out and why, and what it depends on.
SWOT, PESTEL and interested parties of your company, and what they mean for it.
Who decides, who does it, who is asked first and who is told after, activity by activity.
Every use case of your organisation in one inventory: AI, IT, software, cloud, processes, data, network or security, with gaps and overlaps found.
24 kinds of policy, from information security and BYOD to quality, human resources and procurement, each built from its own professional template.
IT plans and step-by-step procedures: incident management and response, change management, IT continuity, SOPs, recurring workflows and operational handbooks.
What your company owns and depends on, each asset with an owner, a sensitivity and an importance.
The risks of any part of your company, chosen by you, each with its cause, consequence and owner.
The risks of any part of your company, chosen by you, rated on a 5×5 matrix with the reason for each rating.
The risks of any part of your business in one register: rated, with an action, an owner and a review date.
What to do about each risk of your register: three proposed treatments, an action, an owner and a deadline.
Management-ready summary of your risk position: main risks, treatment progress and decisions to take.
Context, scope, impact and likelihood criteria, risk acceptance criteria and responsibilities of a risk assessment.
Assessed risks compared with the acceptance criteria: risks within criteria, risks requiring treatment and priorities.
Residual risks after treatment, the acceptance criteria they meet or not, and the approvals still pending.
Review schedule, reassessment triggers, risk indicators and responsibilities for ongoing risk monitoring.
Assess a supplier, provider or partner: inherent and residual risks, evidence gaps, contract requirements and a treatment plan.
Rank your activities by what their interruption costs and set their recovery targets: RTO, RPO, dependencies and the systems to recover first.
Missions, business values, supporting assets, feared events with their gravity, and the security baseline.
Risk sources, the objectives they pursue, and the relevant source/objective pairs retained.
Ecosystem threat mapping and strategic scenarios leading from each retained pair to the feared events.
Operational attack paths on the supporting assets, their likelihood and the assumptions to verify.
Risk map, treatment strategy, security measures, owners, deadlines and residual risks to validate.
System, missions, stakeholders, RMF roles, initial authorization boundary and risk tolerance.
Proposed FIPS 199 categorization of the information types and of the system, with rationale and validations.
SP 800-53 controls of the baseline matching the categorization, tailoring decisions and controls to implement.
Implementation register: description, responsible person, evidence reference, status and missing information per control.
Assessment plan (objectives and methods per control), results provided by the assessor, deficiencies and recommendations.
Authorization package: system summary, control and assessment summary, POA&M, residual risk and the decision to document.
Continuous monitoring: controls and activities, frequency, indicators, reassessment triggers and responsibilities.
Your vulnerability management programme: policy, procedure, roles, assessment schedule, remediation SLAs, exceptions and escalation.
All vulnerabilities in one register: standardised, checked for errors and duplicates, with severity, status and overdue counts calculated.
What to fix first: a priority for each vulnerability from its severity and its business context, with the reasons and the order of work.
Prioritised vulnerabilities turned into actions: who fixes what, by when, with tests, rollback and how to verify, in the right order.
Document a vulnerability that cannot be fixed on time: justification, residual risk, compensating controls and expiry, for the authorised person to decide.
Prove a fix worked: original against current status, result of the verification, residual exposure, and whether the vulnerability can be closed.
Measure the programme: exposure, severity, SLA compliance, overdue items, trends and what to improve, with every rate calculated.
A questionnaire built for the framework you select, with its own questions and references, your answers analysed.
Register of your security controls: owner, implementation status, expected evidence and next review.
Gaps against any framework, regulation or internal rules.
Non-conformities and improvement opportunities from an audit, each with its evidence, cause and corrective action.
Prioritised action plan to close your gaps, with owners, deadlines and the evidence each action produces.
All 93 Annex A controls with applicability and justification.
How a change in a law, standard, contract or internal requirement affects your documents and controls.
A DPIA under GDPR Article 35: whether it is required, the processing described, necessity and proportionality, risks to people, measures and residual risk.
Assess, document and better understand your network environment through practical network analysis tools.
Design a new network from your needs: topology, equipment, IP and VLAN plans, security, redundancy, documented in full.
Draft router and switch configurations for Cisco, Juniper, Aruba and MikroTik, ready for review.
IPv4 and IPv6 subnet allocation per site, with capacity for growth.
Masks, ranges, usable addresses and capacity of an IPv4 or IPv6 block.
Proposed firewall rules from traffic requirements, explained and reviewed before implementation.
Audit your whole network or the areas you choose, and get a professional report: findings, evidence, severity and remediation roadmap.
For IT specialists: a structured network incident investigation, from your evidence and priorities to a professional diagnostic report.
A structured investigation of server, virtualization, storage, power, telecom and cloud incidents, with a diagnostic report.
A structured investigation of application and service failures, from the front end to the data, with a diagnostic report.
A structured investigation of security incidents, from identities to detection, with a diagnostic report.
One detection scenario, equivalent patterns in SPL, KQL, Regex, Grok, Sigma and Lucene, explained and with test cases.
Describe your architecture or paste your code: complete Terraform, Ansible or Docker Compose files.
Track SaaS subscriptions, cancellation deadlines, costs and unused licenses, and decide each renewal in time.
Software whose support has ended or ends soon, and what to do about it.
