Most shops sell whichever framework they specialize in, whether or not it matches your contracts. We start with an unbiased read of what your customers, insurer, and regulators are actually asking for, then point you at the specific engagement — ours or someone else's — that fits.
A client security questionnaire references one framework, your cyber insurance application references another, and nobody on your team owns deciding which one to actually build toward.
Tell us what's driving the requirement — a client questionnaire, an insurance renewal, or a new contract. No documents required to start.
Your requirements checked against NIST CSF, CIS 18, ISO 27001, and vertical-specific frameworks to find the actual fit.
A clear recommendation and next step — including a handoff to a specialist track if that's the better fit — within 24 hours.
A plain answer on which framework actually matches your requirement, in 24 hours.
Request Free ScanPosture review against the recommended framework, prioritized gap list, and a 30-minute walkthrough.
Start with Free ScanOngoing advisory, control build-out, questionnaire and insurance renewal support, sequenced across whatever frameworks apply.
Start with Free ScanStart with what's asking for it — a customer contract, a cyber insurance application, or a regulator usually specifies or implies a framework. The free scan walks through that source document with you and gives a plain recommendation, not a sales pitch for whichever framework we happen to specialize in.
Not as one deliverable — they're different documents with different evidence requirements. What we do is sequence them: identify overlapping controls so you're not rebuilding the same evidence three times, and tell you honestly when a vertical specialist (SOC 2, HIPAA, GDPR) is the better next step.
For most SMBs, no — we provide vCISO-style guidance on demand: framework selection, questionnaire responses, and insurance renewal support, without the cost of a full-time hire. If your risk profile genuinely needs ongoing executive-level security leadership, we'll tell you that directly.
Usually, yes. Questionnaire turnaround is one of the most common reasons companies reach out to us, and it doesn't require a full framework build to get a defensible response out the door. Flag the deadline in the free scan and we'll prioritize accordingly.
Insurance applications increasingly mirror CIS 18 or NIST CSF language even when they don't name the framework outright. We map your renewal questionnaire to the closest framework, flag what's missing, and give you a realistic timeline before your policy lapses.
Business context only — no sensitive documents yet. Initial response within 24 hours.