Three ways to start
Pick the area that matters most right now. We build it with your team, inside BeyondSight, so you end up with a working system rather than a report that gathers dust.
How it works
Talk
We agree what you need and which package fits.
Build together
We set it up with your team in BeyondSight, using your own lists, policies and contracts as input.
Keep working
After delivery, you keep working in BeyondSight for a period at no extra cost.
Choose
Continue on the full platform, or take what you've built with you: your registers, assessments and decisions, plus a summary of the work.
Our method library and framework mapping stay with us. Your data and decisions are always yours.
Compliance Core
Do the compliance work once. We put the base of your compliance work in place: what you have, how sensitive it is, which requirements apply and which controls meet them. Each new framework or regulation is linked to the same control library and can build on work you've already done, instead of starting a new project.
Good fit if a new framework is on its way, or you're juggling several.
Talk to us about Compliance Core- Information assets and systems mapped and classified, with owners
- DORA, NIS2, ISO 27001 or the frameworks that apply to you, linked to one shared control library
- Scope decisions recorded, with the reasons behind them
- Your existing policies linked to the controls they support
Supplier Sentry
Know where you stand with every critical supplier. Supplier and contract registers, how deep to go per supplier, and a first assessment round done together. Each critical ICT supplier gets a dated verdict you can explain, and every contract gets a date for its next review, with a reminder when it's due. Once we hand over, your team runs the next round itself.
Good fit if you're working on DORA's ICT third-party requirements, or need supply chain control under NIS2.
Talk to us about Supplier Sentry- Supplier register by criticality, with critical ICT suppliers flagged
- Contracts assessed and reviewed on a schedule, with reminders
- Supplier questionnaires through a secure link, scored by rules you can explain later
- Your Register of Information built from the same supplier, contract and ICT service data
- Your first assessment round done, and your team ready to run the next
Risk Curator
Risk work that aims to make you more secure. A threat profile for your business, vulnerability assessments that end in a risk level and actions, and one risk register where every risk has an owner. We agree the method with you and run the first assessments with your risk owners. Effort can then be put where it makes a difference for your business, and the same work goes towards your regulatory requirements.
Good fit if you want risk work that drives decisions, especially under NIS2.
Talk to us about Risk Curator- A threat profile built for your business
- Step-by-step vulnerability assessments, from weakness to risk level and actions
- One risk register with owners, residual risk and review dates
- A method your team can repeat without us
Not in the usual sense. The work is done in BeyondSight, with our team guiding it. When the package is delivered, you have a working system, not a slide deck.
Yes. Compliance Core is the natural base, and the other two build on its registers.
You take with you what you've built: your registers, assessments and decisions, together with a summary of the work we did together. Your data and decisions are yours; our method library and framework mapping stay with us. We then close your access and delete your data from BeyondSight, as set out in our agreement with you.
It depends on scope. Tell us what you need and we'll send you a clear proposal.
Not sure which one fits?
Tell us where you are, and we'll suggest where to start.