Compliance frameworks
Proof your clients and insurers will accept
Clients and insurers want proof that your security is real. The platform gathers evidence as you work and checks it against the standards that matter.
Prove it
Proof takes weeks to pull together.
Evidence is scattered
Settings, reports and policies sit in different tools and folders, so assembling them is a project.
Different buyers ask for different standards
Clients ask for SMB1001, enterprise customers for ISO 27001 and government buyers for NZISM. Each is written for specialists, and working out what it means for your business takes time.
Proof goes out of date
Evidence gathered once for a certificate or questionnaire is stale by the next renewal.
What changes
From a scramble to proof on hand.
First
Your current settings are checked against the standard, and each measure shows as covered, partly covered or not yet assessed.
Then
Evidence arrives from your connected tools as you fix gaps, with documents added where a tool cannot supply them.
Ongoing
The platform keeps watching, so a measure that slips is flagged and renewals do not start from nothing.
How it works
How it works.
Your tools supply the evidenceReadings are matched to the security measure they support.How this works underneath
Connected tools report settings such as device protection, patching, email protection, backup and training completion. Each reading is stored as dated against the matching . Items a tool cannot supply, such as policies, are uploaded.One evidence library, several standardsSMB1001, ISO 27001 and NZISM from one place.How this works underneath
The platform supports , ISO 27001:2022 and NZISM. Where requirements overlap, evidence can support more than one framework. NIST CSF 2.0 and ISO 42001 are coming soon.A proof pack you can hand overPrepared for you and submitted for certification.How this works underneath
For SMB1001, CyberGrape prepares the , completes the certification and submits it. Bronze, Silver and Gold are . Platinum and Diamond are . The certificate is issued by CyberCert. CyberGrape does not issue certificates.
What it connects to
Evidence from your tools, certified through CyberCert.
SMB1001 is published by Dynamic Standards International. Certificates are issued by CyberCert. CyberGrape prepares and submits your evidence but does not issue the certificate.
A small example
What this can look like.
- Situation
- A larger customer asks a 30-person firm to show that its security is in place before renewing a contract.
- What the platform shows
- Most measures are covered with dated evidence. Three need a document, and two need a fix.
- What happens next
- The firm uploads the documents and finishes the fixes in the Action Hub.
- What the firm hands over
- A proof pack, and where it chooses, an SMB1001 certificate issued by CyberCert.
This is an invented example to show how the module works. The names and figures are not a real customer's.
What is in it
What is in compliance frameworks.
Clients, insurers or tenders ask for SMB1001
All five tiers, Bronze to Diamond, tracked together with the next milestone always visible.
Enterprise customers ask for ISO 27001
ISO 27001:2022 with a statement of applicability, and implementation status and evidence for each Annex A control.
Government buyers ask for NZISM
Managed alongside the other frameworks, with separate reporting where an agency requires it.
One evidence library
Where requirements overlap, evidence can support more than one framework.
Other frameworks
NIST CSF 2.0 and ISO 42001 are coming soon.
Coverage by measure
Each security measure shown as covered, partly covered or not yet assessed.
Evidence from connected tools
Dated readings stored against the measure they support.
Proof pack
Evidence and documents compiled in the format a certifier or client asks for.
Monitoring after sign-off
A measure that slips is flagged so your position stays current.
Questions
Common questions.
No. SMB1001 is published by Dynamic Standards International and certificates are issued by CyberCert. CyberGrape prepares your evidence, completes the certification and submits it.
Bronze, Silver and Gold are director-attested. Platinum and Diamond are independently verified, with a separate external audit fee.
It gives you evidence insurers ask for. We do not promise acceptance or a lower premium. CyberCert connects certified businesses with insurance partners who recognise the certificate.
Related
Works with.
Find out what proof you already have.
The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.