A client asked for proof
A client asked for proof? Show them your security is real.
Security questionnaires and certificates are now part of winning and keeping work. Build your evidence once, then reuse it each time a client asks.
What it feels like, and what is at risk
What is at risk if you answer from memory.
A customer's security questionnaire has landed and nobody is sure where half the answers live. The work you do matters, but without proof it can cost you the contract.
Deals that stall
Security questions can hold up a contract. Slow or vague answers make a client wonder what else is vague.
The same work, over and over
Every client asks in a different format. Without one set of evidence, you start from scratch each time.
Claims you cannot back up
An answer that cannot be shown later can do more harm than a plain "not yet".
What changes with CyberGrape
See where you stand, fix what matters first, prove it.
See
See which of your client's requirements you already meet, and which you do not.
Fix
Close the gaps that matter to this client first, then the rest.
Prove
Work towards SMB1001, the standard built for small and medium businesses. It is published by Dynamic Standards International and certified through CyberCert.
How it works
Build your evidence once and reuse it every time.
The platform collects evidence from your own tools and records. You work towards SMB1001, the standard built for small and medium businesses, and reuse the same proof whenever a client asks.
Our people work on it with you, led by a senior security leader.
Your tools
The email, device and sign-in tools you already use.
The CyberGrape platform
Checks what it reads, ranks what matters, tracks every fix.
Proof you can hand over
Policies, reports and a proof pack for clients and insurers.
Connect the tools you already useWe read your sign-in, device, backup and email settings.How this works underneath
We connect to tools such as Microsoft Entra ID, Google Workspace, NinjaOne, CrowdStrike and Keepit. What they report is kept as dated evidence.Close the gaps this client cares aboutThe fix list puts the gaps that matter most to this client first.How this works underneath
Each fix has an owner and a status. Policies, training records and settings are collected in one place so they can be reused for the next client.Show it with a certificate and a proof packWork towards SMB1001 and hand over your proof when someone asks.How this works underneath
SMB1001 is published by Dynamic Standards International and certified through CyberCert. CyberGrape prepares and submits your evidence, but does not issue the certificate. Bronze, Silver and Gold are director-attested. Platinum and Diamond are independently verified.
What it connects to
Works with the tools you already use.
A small example
What this can look like.
- Starting point
- A larger client asks the consultancy to confirm its security measures before renewing a contract.
- What the tools show
- Most measures are in place. Two policies are missing and one laptop is out of date.
- What happens next
- The gaps are fixed, the policies are signed off, and the evidence is collected as the work happens.
- What the owner can show
- A proof pack for the questionnaire, plus progress towards an SMB1001 certificate.
Sample only. This is an invented scenario to show how the pages work, not a real customer. Your own picture comes from the tools you connect.
The first weeks
What the first weeks look like.
Minutes
Once your tools are connected
You can see which of your client's requirements you already meet, and which you do not.
Weeks
The biggest gaps are fixed, and your evidence is ready to share.
Ongoing
Evidence stays current. Platinum and Diamond take months, because an outside assessor checks the evidence.
Go deeper
See how each part works.
Proof clients and insurers will accept
Evidence gathered for you against the standards that matter.
Read moreQuestions
Common questions.
No. SMB1001 is published by Dynamic Standards International and certified through CyberCert. CyberGrape prepares and submits your evidence. CyberCert issues the certificate.
Bronze, Silver and Gold are director-attested: a director signs off that the measures are in place. Platinum and Diamond are independently verified by an outside assessor.
Yes. Evidence is collected once from your tools and records and kept up to date, so each new questionnaire starts from what you already have.
Yes. The readiness assessment is free and gives you a starting point. If we are not the right fit for you, we will tell you that too.
Other situations we help with
Find out where you stand.
The free readiness assessment shows you where you stand and what to fix first. If we are not the right fit, we will tell you that too.