Compliance

Compliance in 786 Cyber isn’t a one‑off form — it’s a living score you can improve. Pick a framework, answer a guided wizard, and get a score plus a gap analysis that tells you exactly what’s missing and where to fix it.

Start an assessment

Go to Policy & Process → Compliance/CCM.
Choose a framework — the launch set is Cyber Essentials Plus, NCA ECC and SAMA CSF, with more in the catalogue.
Work through the wizard, answering each control Yes / Partial / No.
Get your compliance score and gap analysis.

As you answer, inline AI validation can review your responses and evidence and offer a finding and recommendation — helping you answer honestly and consistently. (AI is used to validate and verify, not to invent answers for you.)

Frameworks with a full question set

All 31 compliance frameworks are now asked as their real question set rather than one question per control, from Cyber Essentials (107 questions following the IASME self-assessment, sections A1 to A8) and ISO 27001 to SAMA CSF, NCA ECC, PCI DSS, NIST CSF, CJIS and the GCC data protection laws. The wording is always our own paraphrase of the source. That includes Dubai ISR, IEC 62443, CBUAE, Bahrain, Kuwait and Oman.

Answer each question in the form it asks for: yes or no, a choice (sometimes several), a list, or a short note. Questions that only apply after a particular answer appear once you give that answer.
Add a note to any yes/no or choice answer with + Add a note, for example which device or setting the answer covers. Some Cyber Essentials answers expect one. Under each question, What good looks like shows the guidance and example evidence, and Evidence attaches files, links or vault items.
Use what 786 Cyber already knows as evidence. Under Evidence, choose ✦ From 786 Cyber. The views that answer the question come first, for example your firewall and router assets for “Is there a firewall between your networks and the internet?”. Each view shows a live summary and where the data came from: Evidenced means from your directory sync or our scans, Declared means entered by hand or imported from CSV. The evidence stays live: if your data changes, the summary on the question changes with it.
N/A needs a reason, on questions and on the control checklist alike. Mark something not applicable and you’ll be asked why; the reason is kept with the answer. In a CSV upload, put it in the notes column.
Maturity scales. Some frameworks ask for a level rather than yes or no. SAMA uses 0 to 5, NIST CSF goes from Not started to In place and reviewed regularly. Pick the level you can show today; the target is shown, and options that meet it are marked. Below the target counts as Not met. A control’s maturity is its lowest level.
Statement of Applicability. ↓ Statement of Applicability downloads every control with whether it applies, the reason where it doesn’t, its status, maturity and evidence. ISO 27001 requires one; it works for any framework. Controls you haven’t answered show as Not yet decided.
Evidence pack. ↓ Evidence pack builds a PDF of the whole assessment: every question (or control) with your answer, notes and reasons for anything not applicable, the evidence attached to it, and what else in 786 Cyber stands behind it. Documented lists the approved policy sections that cover it; Evidenced lists live data, such as your registers, directory sync, software inventory and scans, for the capability it depends on; Declared marks things recorded by people rather than observed. The labels are kept separate and never combined into a single pass. The pack ends with a summary of your registers and scans and an attestation line for a director: add their name and role, or leave it blank to print empty signature lines. Tick Also save a copy to the Evidence Vault to keep it there. The pack is a self-assessment record, not a certificate.
Automatic fails are flagged. A few answers fail the assessment outright, such as not applying high-risk updates within 14 days, or no MFA for administrators. Those show Automatic fail with what to change. A few others need your judgement (for example a weak password rule that’s acceptable only because MFA is in use); they show Needs review. Any other “no” is marked Needs attention.
Your answers roll up into the framework’s controls, shown along the top (for Cyber Essentials, the five technical controls). A control is met when all its applicable questions are answered without issue, partly met when something needs attention or is still unanswered, and not met when an automatic-fail answer applies or a maturity level is below the target. Your score, gap analysis and cross-framework reuse are based on these controls.
Work offline with the CSV template: download it, fill in the Answer column (yes / no / N/A, an option or its letter, or a list separated by semicolons), use Notes for N/A reasons, then upload it. Rows that don’t fit are skipped and listed so you can fix them.

How your score is calculated

Your compliance score is the share of controls met, where a Partial counts as half. It updates as you answer more controls and close gaps — so progress on your dashboard and in your assessments moves together.

The Compliance Vault

The Compliance Vault stores your assessments and tracks progress over time, so you can pause and resume, compare against a previous run, and show how you’ve improved.

The framework catalogue

Browse the full catalogue of compliance frameworks and threat models under Policy & Process → Framework catalogue. Every framework in the catalogue is included in your plan — there’s no per‑framework purchase, so you can explore or start an assessment against any of them. Each framework shows:

its domains and controls, and
cross‑mappings to other frameworks.

Cross‑mapping is the time‑saver — but it shows you the overlap rather than scoring it for you. One control you’ve satisfied often corresponds to controls in many other frameworks, so the work you did for Cyber Essentials is usually most of the work for ISO 27001, NCA ECC or SAMA CSF. What that saves you is the thinking and the evidence‑gathering: you can reuse the same evidence and answer the mapped control quickly, with the mapping telling you exactly where to look.

It does not auto‑tick anything. Each framework’s assessment is scored only on the answers you give in that assessment — answering a control in one framework doesn’t silently mark the mapped control complete in another. That’s deliberate: an assessor asks what you attested to for that framework, and a score built partly from inferred answers wouldn’t survive the question.

Evidence

Where a control needs proof, you can attach evidence and link it to your answers, building an audit‑ready trail as you go.

The Evidence Vault

Everything you attach collects in the Evidence Vault (Policy & Process → Evidence Vault) — one org‑wide library of every document, link and reference you’ve gathered, rather than evidence buried inside whichever assessment you happened to be doing at the time.

Five kinds of item: an uploaded File, an external Link, a storage Bucket, or a Policy or Control you already hold in the platform.
Filter by type to find things quickly, and tag items with your own labels.
Each item shows what it actually proves — the controls it’s attached to — so an item proving nothing yet is visible rather than hidden.

Enter once, reuse everywhere it genuinely applies. You store an item once, against a single question — then tag it and reuse it to satisfy the same requirement wherever it comes up again, in any framework. A single penetration test report or asset register stays one item in the vault, rather than the same PDF re‑uploaded into every assessment that asks for it.

What it doesn’t do is propagate on its own: reusing an item is a deliberate step, not something applied silently to every mapped control. That’s the same principle the rest of Compliance follows — cross‑mapped controls are surfaced for your review, never quietly marked as met, because you should be able to say why every piece of evidence sits where it does.

Third‑party reports — a manual penetration test, an external audit — belong here too, alongside the scans you run in the platform. See Reports.

See Policies & controls for how controls and evidence fit together.

Explore your Security Universe

From Compliance/CCM you can open the Security Universe — a galaxy‑style visualisation of the full catalogue of frameworks, controls and cross‑mappings, showing your own coverage mapped onto it. It’s a way to see the shape of the whole catalogue at once, not just the frameworks you’ve started.

Why it matters

For everyday security: a framework is a ready‑made checklist of good practice. Even if no one’s asking you to certify, working an assessment tells you where your real gaps are.

For compliance: this is the heart of proving yourself to customers and regulators — a defensible score, a documented gap analysis, evidence linked to controls, and cross‑mapping that shows you where one piece of work answers the same question in several frameworks.

Next: Security capabilities →