Five domains, each one accountable for a specific class of evidence.

Settings and metadata only

A posture scan requests configuration objects: conditional access policies, role assignments, sharing settings, transport rules, audit-log configuration, key vault and storage account properties. It reads the shape of your tenant, not its contents.

It does not read the body of emails, the contents of documents in SharePoint, OneDrive or Google Drive, chat messages, or any customer data your business holds. Where an API returns a document identifier or a mailbox name as part of a configuration object, that identifier is stored; the document is not fetched.

Two connectors, both read-only

A system nobody has connected produces no evidence, and its absence is a gap in your coverage rather than a pass. The platform reports unconnected scope as unknown. The exact scopes we ask for →

Forty-seven assertions across six families

Example assertions are shortened for readability. Check counts are as at 5 August 2026 and are restated on this page whenever they change.

No write access, ever

The connectors request read-only scopes. The platform cannot change a setting in your tenant, cannot disable an account, cannot quarantine a message and cannot remediate a finding. If a check fails, you get the finding, the control reference and the evidence record; the change is made by you or by whoever runs your IT.

This is a deliberate constraint, not a gap. A compliance tool with tenant write access is a very attractive target, and we would rather not be one.

Nine mandatory fields

A record that cannot answer “when”, “from where” and “by what method” is not evidence, it is a screenshot. Every record carries a control reference, a source system, a scope, a UTC collection timestamp, the collection method and API scope used, a result, a retention date and a content hash.

The full record model and a specimen record →

Corrections are new records

Records are never edited in place. If a scan was wrong, or a scope changed, a superseding record is written that references the original, and both remain visible with their timestamps. An assessor can see the history rather than a tidied version of it.

Content hashing

Each record is hashed at write time over its canonical serialisation. The hash is displayed alongside the record and included in exports, so a record extracted today can be checked against the record in the store later. This is a tamper-evidence measure, not a tamper-proof one, and we describe it that way.

Every record carries its own expiry

The retention date is calculated at write time and stored in the record rather than applied later by a housekeeping job. Evidence has a shelf life — an assessor decides whether a reading from fourteen months ago still says anything about today — so the date that governs disposal travels with the record it governs.

One check can satisfy several controls in several frameworks at once. The control reference field is a list for that reason: an MFA reading answers Annex A, the Cyber Essentials user access control theme and NIS2 21(2)(j) from a single collection.

A register, not a document generator

Assessors ask for policy documents, and then ask who approved them, when they were last reviewed, and who has read them. The three follow-up questions are where SMEs fail, because the document lives in a shared drive with no owner and a review date that passed in 2023.

CD-03 defines the register that answers all four: document, version, owner, approver, approval date, next review date, and an acknowledgement log per version. Each policy carries the control references it is offered as evidence for, so a gap in the register reads as a gap in the matrix rather than as a silence.

Fourteen drafted policies

A starting set drafted against Annex A themes, intended to be edited rather than adopted verbatim: information security policy, acceptable use, access control, cryptography, supplier security, secure development, change management, asset management, remote and mobile working, incident response, business continuity, data protection, logging and monitoring, and physical security.

These are templates. Adopting a template you have not read is a compliance risk in itself, and we say so at the point somebody adopts one.

Templates are not advice

We are not a law firm and the drafted policy set is not legal advice. It is a structured starting point for a business that is writing its policy set for the first time.

Questionnaires that produce records

Issue a security questionnaire to a supplier, tiered by how much damage that supplier could do to you. Track what came back, what did not, and when it is due to be asked again. Attach the certificates and reports they send. Hold the whole thing against the same control references as everything else.

Three questionnaire templates

Question counts are indicative and are edited to the supplier in front of you. Tiering by what a supplier could do to you, rather than by how much you spend with them, is the part that makes the answer defensible.

We do not score or rate suppliers

There is no risk score, no letter grade, no external scanning of your suppliers’ infrastructure and no threat-intelligence feed. We collect and hold what your supplier told you, with a date on it. Judging whether the answer is acceptable is your decision to make and to record.

Completion records, not engagement metrics

The compliance question is never “did your staff enjoy the training”. It is “show me, for this named person, that they completed the assigned module on this date, and show me the record”. CD-05 stores that, plus phishing simulation results by cohort, plus the starter, mover and leaver checks that keep access aligned to employment.

Phishing simulation, handled carefully

Simulated phishing produces personal data about employee behaviour, and it is easy to build something disciplinary out of it. Results are reported at cohort level by default, individual results exist to trigger further training rather than sanction, and an employer who uses them otherwise is making a decision that gets documented in the record like any other.

Where your business runs simulations through us, you are the controller of that data and we are your processor. See the processor sections of the privacy notice.

Not an HR system

No performance data, no absence records, no payroll, no disciplinary workflow. The People domain holds security training and simulation records and the minimum identity fields needed to attach them to a person.