GRC
Tools for governance, risk and compliance work. Each one runs entirely in your browser: what you enter is not sent anywhere and not stored, and it is gone when you close or reload the page.
Tools
Information security risk assessment
A seven-step risk assessment following the process in ISO/IEC 27005: context, criteria and scales, a risk register written as scenarios, analysis on a 4×4 or 5×5 matrix, treatment, residual risk and acceptance. Help text at every step. Save a draft as a file, and export as PDF, Word or Markdown with the matrices drawn in.
Statement of Applicability
A step-by-step Statement of Applicability: decide for each of the 93 Annex A controls whether it applies, why, and how far it is implemented, with a plain explanation of every control. Bring in the controls your risk assessment names, get pointed to the controls that are often excluded in your situation, and see what is still missing. Save a draft as a file, and export as PDF, Word, Markdown or CSV.
ISO/IEC 27001 gap analysis
See how far the management system is from the standard: 28 questions on context, leadership, planning, support, operation, evaluation and improvement, each with a plain description of what “in place” looks like and a mark where the standard asks for something in writing. You get a result per clause and an action plan for the gaps. Save a draft as a file, and export as PDF, Word, Markdown or CSV.
Business impact analysis
Find out what must be back first, and how fast: list your activities, say how long each can be stopped before the consequences become unacceptable, decide recovery time and tolerable data loss, and hold them against how fast the systems, suppliers and people each activity depends on can be restored today. You get an order of recovery and a list of gaps. Save a draft as a file, and export as PDF, Word, Markdown or CSV.
Threat model (STRIDE)
Find the threats to a system while the design can still be changed: describe it as external parties, processes, data stores and data flows in trust zones, and see the data flow diagram drawn for you. Go through each element for the kinds of threat in STRIDE that apply to it, with a question and examples for each, then rate the threats and decide what happens to them. Save a draft as a file, and export as PDF, Word, Markdown or CSV.
NIS 2 self-assessment
Find out whether you are likely to be covered, and how far you are: about thirty questions on management’s responsibility, the ten security measures of Article 21 and incident reporting, each with a plain description of what “in place” looks like. You get a result per area and an action plan for the gaps. It can start from your Statement of Applicability. Save a draft as a file, and export as PDF, Word, Markdown or CSV.
NIS 2 incident report
For when something has happened. Enter when you became aware of the incident and see the three deadlines count down; assess whether it is significant; and prepare the early warning (24 hours), the notification (72 hours) and the final report (one month) as drafts to copy into your authority’s form. What you enter is sensitive: nothing is stored or sent, and the files you take out are yours to protect.
Supplier security management
List the suppliers that matter for security, and let four questions decide how critical each one is. Assess one supplier at a time against what a good answer looks like, check what the contract gives you, including whether the supplier tells you about incidents in time for your own reports, and record what is decided about the gaps. Export the overview, one supplier’s assessment, or the questions to send to a supplier.
Cyber risk report for the board
Turn cyber risk into a short paper a board can act on. Tie a handful of scenarios to the business objectives, estimate how often each could happen and what it would cost, and see the likely loss, the bad case and the expected loss a year. Hold them against limit, appetite and capacity, add a few indicators, and state the decisions you ask for. Save a draft as a file, and export as PDF, Word or Markdown with the chart drawn in.
For AI systems, the AI risk assessment under AI covers the EU AI Act and ISO/IEC 42001.