Essentials
£249/mo
or £199/mo billed annually
compliance, plus automation
Start free →Policy & Process
Your security policies are the foundation your business builds compliance on.
Prove your standards are set, enforced and evidenced across the whole organisation — continuous best practice, not an audit-day snapshot.
786 Cyber generates production-ready, organisation-specific policies and maps your controls across every compliance framework — automatically. From first policy to audit-ready in minutes, not months.
Applies to: All UK & EU businesses ·
businesses without a security team ·
MSPs managing client compliance
Identify & Aggregate
Every framework you answer to, and the evidence you already hold — policies, reports, scan output, directory data — gathered once into the Evidence Vault.
Protect & Validate
Each control marked Evidenced, Declared or Unknown. Policies drafted for your organisation and validated against the frameworks they serve. A green tick never means "someone said so".
Unify & Manage
One control model across 31 frameworks — evidence gathered for one counts everywhere it genuinely applies, and stays current between audits, not just on the day.
Why policies matter
A security policy isn't a document you file away. It's how your business proves it operates responsibly.
Most organisations understand they need security policies. Fewer understand what those policies actually unlock — commercially, operationally, and legally. The cost of not having them is significant. The value of having them properly documented and maintained is even greater.
What undocumented policies cost you
Failed audits: The most common reason organisations fail compliance audits isn't that they lack security controls — it's that they can't evidence them. An undocumented control is an absent control in the eyes of an auditor.
Lost commercial opportunities: Enterprise procurement teams and public sector buyers require written policies before supplier onboarding. Without them, the conversation ends before it begins — regardless of how secure your systems actually are.
Insurance claim rejections: Cyber insurers are increasingly denying claims where no documented security policies were in place. A policy you can't produce is a policy that didn't exist.
Regulatory exposure: GDPR, NIS2, and DORA all require specific written documentation. The absence of an Incident Response Policy or Data Protection Policy is itself a regulatory breach — separate from any incident that may occur.
Inconsistent staff behaviour: Without clear written policies, staff make judgement calls under pressure. One inconsistent decision — how a lost device is handled, how a client file is shared — can cascade into a breach, a fine, or a contract dispute.
What well-documented policies unlock
Procurement credibility: Walk into any enterprise supplier assessment with a complete policy suite and you immediately signal maturity. Documented policies turn a conversation about whether you're secure into a conversation about how you work together.
Faster due diligence: Investment, acquisition, and partnership due diligence all include security reviews. A versioned, documented compliance programme removes a major risk item and accelerates the process significantly.
Lower insurance premiums: Insurers price risk based on evidence. Documented controls and reviewed policies are proof of a security culture — and they're reflected in the premium you're quoted.
Operational clarity at scale: Policies are institutional memory. They scale your security culture without adding headcount — new staff know the rules from day one, contractors understand their obligations, and the business grows without introducing new risk at every hire.
Incident recovery speed: When something goes wrong, documented incident response processes mean your team acts decisively and consistently. The evidence vault means you can demonstrate what was in place — which matters for regulators, insurers, and clients.
"The question isn't whether your business takes security seriously. It's whether you can prove it — to a client, an auditor, an insurer, or an investor — in under five minutes."
Policies aren't compliance admin. They're business infrastructure.
Every scaling business reaches a point where informal practices become liabilities. A team of five runs on shared understanding. A team of fifty needs documented processes — not because a regulator demands it, but because the business can't function consistently without them.
The moment you document how your organisation handles data, responds to incidents, manages access, or onboards staff, you stop relying on individual judgement under pressure. You create accountability, reduce error, and build a culture where security is a reflex — not an afterthought.
786 Cyber generates these policies in minutes, tailored to your organisation's specific context, and keeps them current as your business and regulatory landscape evolve — without manual overhead.
During procurement
Enterprise clients and public sector buyers ask for your Acceptable Use, Data Protection, and Incident Response policies as part of supplier onboarding. With 786 Cyber, you generate and export audit-ready documents in minutes — not weeks of manual drafting.
During fundraising or acquisition
Security due diligence is now standard in investment and M&A. A documented policy suite, version history, and compliance audit trail removes a common deal risk and builds confidence at the negotiating table.
During an incident
A documented Incident Response Policy means your team acts immediately and consistently. The 786 Cyber compliance vault means you can demonstrate controls were in place — critical for GDPR breach notification, insurance claims, and client communication.
During growth
Every new hire is a security risk without documented expectations. A Password Policy, Remote Working Policy, and BYOD Policy mean new staff understand your rules from day one — reducing the human error risk that causes most breaches.
What you get
Two capabilities. Everything your compliance programme needs.
Policy & Process is two capabilities — the Compliance Engine and the Policy & Controls Vault.
1
Compliance & Best Practices Engine
AI compliance wizard
6-step assessment produces a prioritised, customised roadmap across all selected frameworks in minutes.
Framework recommendations
AI recommends the right frameworks based on your industry, size, region, and existing certifications.
Progress tracking
Visual progress rings per framework — showing % completion, controls implemented vs total required.
Compliance Vault
All assessments, roadmaps, evidence, and renewal dates stored and version-controlled in one place.
Supports GDPR · Cyber Essentials · ISO 27001 · NIST CSF · NIS2 · DORA · PCI-DSS · HIPAA
2
Policy Management & Controls Vault
AI policy generation
15+ policy types auto-populated with your company name, industry context, and regulatory requirements.
Cross-framework tagging
Every control and policy is tagged — one control satisfies multiple frameworks simultaneously.
Version history & audit trail
Full change history on every policy — who changed what, when, and why. Essential for audit submissions and regulatory evidence.
PDF export
Export any policy or compliance summary as a formatted PDF — ready for board reporting or regulatory submission.
Evidence Vault
A single browsable library of every piece of evidence you have gathered — filter by type, tag or search, see how many controls and frameworks each item supports, and get told before something expires.
Acceptable Use · Password · GDPR · Incident Response · Remote Working · BYOD · and more
How the tagging system connects everything
Every control, policy, and compliance requirement in 786 Cyber carries a set of tags. These tags are the intelligence layer that removes duplicate work — when you answer a question in one framework, the platform shows you every other framework that asks for the same control, and the evidence you attached is there to reuse rather than re-gather.
Example — Multi-Factor Authentication control
domain:access-control control:mfa framework:cyber-essentials framework:iso27001 framework:gdpr policy:password policy:acceptable-use severity:critical
One MFA control, mapped to Cyber Essentials, ISO 27001, and GDPR and linked to 2 policies. Implement it once and the platform shows you all three requirements it answers, with the same evidence attached to each — so the work happens once even though three frameworks ask for it.
Platform features
Built to make compliance achievable — and maintainable long term.
Getting compliant once is only part of the job. 786 Cyber keeps your policies current, your team aligned, and your evidence vault ready — automatically.
AI policy generation
Generate any of 15+ policy types in minutes, pre-populated with your organisation's industry, size, and regulatory context. No templates to fill in manually.
Audit trail & version history
Every policy change is logged automatically — who made it, when, and what changed. When an auditor or insurer asks for evidence, it's already there.
Role-based access control
Admin, Security Lead, and Viewer roles let you assign the right level of access to each team member. Sensitive compliance documents are protected by default.
Risk score & compliance rings
A live overall risk score and per-framework progress rings show your compliance posture at a glance — and update in real time as controls are implemented.
Monthly security summaries
Automated monthly reports delivered to your inbox — policies created, controls implemented, risk score movement, and recommended next steps for the month ahead.
Multi-org & MSP portal
Manage multiple organisations from one account. MSPs get a dedicated multi-tenant dashboard — generate client-branded compliance reports across every client simultaneously.
Sample extract
See what 786 Cyber actually produces.
This is a real extract from a compliance roadmap generated for a fictional UK professional services firm — Meridian Consulting Ltd, 47 employees. It shows exactly what your team, or your MSP clients, would see after running the Compliance Wizard.
Want a personalised sample for your industry?
Speak to our team — we'll run the wizard live and show you your actual roadmap. Book a call →
Frameworks in this extract:
Cyber Essentials UK GDPR ISO 27001 NIST CSF
View as:
Compliance Roadmap Extract
Meridian Consulting Ltd
Professional services · 47 employees · London, UK
58
Risk score
3
Frameworks
12
Actions
Framework progress
Cyber Essentials40%
UK GDPR55%
ISO 2700118%
Priority controls
!
Implement multi-factor authentication (MFA)
Required for all admin accounts. Closes critical access control gap.
~
Complete Data Protection Policy
Draft exists — needs review, approval, and staff acknowledgement.
○
Configure boundary firewall and patch within 14 days
Mandatory for Cyber Essentials certification. Currently unverified.
Acceptable Use Policy — published v1.2
All 47 staff acknowledged. Last reviewed 14 Mar 2026.
Page 1 of 6
Sample extract only. Sign up free to generate your organisation's real roadmap.
Framework coverage
Policy & Process underpins every major compliance framework.
Start here and you're building the foundation for all of them.
UK · Mandatory
Cyber Essentials
Policies cover 3 of the 5 CE control categories. Required for UK government suppliers.
UK & EU · Legal
UK & EU GDPR
Data Protection Policy, Privacy Notice, and DPIA process — required under Article 32 for both regimes.
International
ISO 27001
ISMS policy suite and all 93 Annex A controls — 786 Cyber maps and generates them all.
US / International
NIST CSF
Protect and Identify functions are heavily policy-driven. 786 Cyber covers both.
EU · Mandatory
NIS2
Incident response, business continuity, and supply chain policies — all NIS2 requirements.
EU · Financial
DORA
ICT risk management framework and policy documentation mandatory from January 2025.
Payment
PCI-DSS
Written security policies are requirements 12.1–12.4 — non-negotiable for card processing.
UK · Enhanced
Cyber Essentials Plus
All CE policies must be in place before the independent technical audit begins.
Quick checklist
The 10 policies every UK business needs.
786 Cyber generates all of these automatically — version-controlled, tagged to your frameworks, and exportable as PDF.
- !Acceptable Use Policy — governs how staff use company systems, devices, and internet access. Required for Cyber Essentials.framework:cyber-essentialsframework:iso27001policy:acceptable-use
- !Data Protection Policy — documents how personal data is collected, stored, and processed. Required by UK & EU GDPR Article 32.framework:gdprframework:uk-gdprframework:iso27001policy:data-protection
- !Incident Response Policy — defines how your organisation detects, responds to, and reports security incidents. Mandatory for GDPR 72hr notification, NIS2, and ISO 27001.framework:gdprframework:nis2framework:iso27001policy:incident-response
- ~Password Policy — sets minimum standards for password complexity, rotation, and MFA requirements.framework:cyber-essentialsframework:iso27001policy:passwordcontrol:mfa
- ~Remote Working Policy — governs secure access, device usage, and data handling outside the office.framework:cyber-essentialsframework:gdprpolicy:remote-working
- ~BYOD Policy — covers personal devices used for work. Required if staff access company systems on personal phones or laptops.framework:cyber-essentialspolicy:byoddomain:endpoint
- ~Third Party Risk Policy — governs how you assess and manage supplier and vendor security. Required for ISO 27001, NIS2, and DORA.framework:iso27001framework:nis2framework:dorapolicy:third-party-risk
- Business Continuity Policy — defines how the organisation maintains operations during and after a disruption.framework:iso27001framework:nis2policy:business-continuity
- Change Management Policy — controls how changes to systems, software, and processes are assessed, approved, and recorded.framework:iso27001framework:pci-dsspolicy:change-management
- Information Security Policy — the top-level policy establishing your ISMS scope and management commitment. Required by ISO 27001 Annex A.5.framework:iso27001framework:nist-csfpolicy:information-securitydomain:governance
Legend: ! Critical — all businesses ~ Important — most businesses Good practice — growing businesses
Ready to get your policies in order?
Generate your first policy in minutes. No security expertise needed. 786 Cyber does the heavy lifting — you stay in control.
For MSPs: enquire about the partner programme →
Controls Library
One control, many frameworks
The 786 Cyber controls library maps your implemented security controls against multiple frameworks simultaneously. Add a control once — see it scored across Cyber Essentials, ISO 27001, SAMA CSF, and more.
Explore compliance frameworks →Policy Vault
Every policy, versioned and audit-ready
Generate, store, and version-control all your security policies in one place. Each policy is AI-validated against your selected framework, exported as a branded PDF, and tracked through approval workflows.
Start free →Where to go next
See it priced
AI-assisted policies are included on every plan; annual plans get unlimited.
Pricing →