The quarterly board pack
Board packPosture trend, dollar exposure, framework coverage. Rendered from assessment data you already entered — no second data entry.
Who it's for
Built for the job you hold.
CISOs, founders, compliance leads, regulated SaaS — each section shows the artifacts and frameworks that matter to your role.
Pick the role that fits — each card jumps to the artifacts, frameworks, and example output for that job.
Role · CISOs
Numbers your CFO can read.
Risk in dollars, not a color-coded heat map — so a budget meeting ends in a decision. Board pack, audit evidence, the 8-K call, the renewal, each rendered from data you already entered.
Six things you do every quarter
Audit evidence prep
Auditor packEvery audited control mapped to its evidence — findings, intake answers, snapshots, documents. Gaps ranked by remediation effort.
The 8-K materiality call
SEC materiality moduleThe materiality determination — not the incident — starts the four-business-day clock. The engine drafts the dollar estimate — labeled modeled — and the disclosure narrative.
See the materiality tools →The insurance renewal
Broker packThe questionnaire arrives pre-filled from your posture. Premium-loading answers are flagged before you submit.
Tool consolidation analysis
Consolidation findingsOverlapping capabilities surface with the dollar delta, labeled modeled. You decide what to cut before renewal.
The posture trend
Dated snapshotsEach re-upload adds a dated snapshot. The year-over-year chart is history, not memory.
Do-Nothing scenario · Acme Capital
ALE today
$3.8M
modeled · middle year, ±37% band
ALE after Balanced
$720k
−$3.08M risk reduction
ROI multipleStack $128,400/yr
24×
SOC 288
ISO 2700171
PCI DSS64
Illustrative — sample numbers for a representative fintech profile.
Exhibit 1
Quarterly hours — hand-assembled vs rendered
Source: Illustrative estimates, calibrated against public CISO time-allocation surveys — not measured CyberTwin usage data
Role · Founders & CTOs
For the week it becomes urgent.
No CISO yet, a questionnaire on the table. Assess produces the document in one session.
01
The SOC 2 ask
Symptom
A 5,000-person prospect sends a SIG Lite questionnaire and asks for your SOC 2 report. You have neither. Vendor-risk teams send these regardless of your headcount.
Response
Run Assess in one session for a scored posture assessment and a compliance-only report to answer it with. Pre-filled answers, like the sample here, come from the questionnaire auto-answerer on Program — same day, deal alive.
02
The board question
Symptom
A director asks about your cyber risk profile. Every answer you have sounds improvised.
Response
Walk in with the PDF: posture score, top risks, a dollar-labeled do-nothing scenario, a 90-day roadmap.
03
The peer breach
Symptom
A company in your category gets breached. Investors ask: are we exposed to that?
Response
The assessment names the techniques active in your sector and the controls in your stack that answer them. A specific answer, not arm-waving.
04
The insurance questionnaire
Symptom
Renewal lands with twelve pages of technical questions you can’t answer alone.
Response
Your assessment gives you the posture to answer from, truthfully. On Operate and up, the insurance broker pack flags the premium-loading questions first.
05
The first security hire
Symptom
They start with “tell me about your posture.” You have nothing written down.
Response
Hand them the assessment on day one. They start fixing instead of spending a month on discovery.
SIG Lite excerpt · Acme Capital
- Do you have a documented information-security policy?YesDefinite
- Is MFA required for all administrative accounts?Yes — Entra Conditional Access policyDefinite
- Do you maintain an incident-response plan?Yes — last reviewed 2026-04Definite
- Are encryption-at-rest and -in-transit applied to customer data?Yes — encrypted at rest; TLS 1.2 or higher in transitDefinite
- Annual penetration test performed by qualified third party?In flight — first test scheduled Q3 2026Inferred
Illustrative — sample answers for a representative profile, pre-filled by the questionnaire auto-answerer on Program.
Assess
$499/mo or $4,800/yr — annual saves $1,188.
Monthly, cancel anytime.
Not included on Assess
- Attack-path mapping across your stack · Operate and up
- Cross-vendor attack chains · Program
- Questionnaire auto-answer · Program
- Evidence ledger · Program
- Auditor + insurance broker packs · Operate and up
- Monthly engine refresh · Operate and up
Most founders start on Assess and upgrade when the first security hire lands. Upgrades prorate.
Role · Compliance leads
Provenance on every score.
All 24 frameworks scored at once — each control labeled with where its score came from.
Direct per-product mappings
We authored the mapping from the product to the framework’s controls. It is the strongest score we give, and it is still modeled: an auditor will ask for the config, and when you upload it, any finding against that control cites the setting it comes from.
Crosswalk from anchor frameworks
Scored through the crosswalk table, capped at 75% per control. A signal for direction, weaker than a direct mapping.
Direct plus crosswalk supplement
Part direct mapping, part crosswalk. Strongest where direct, indicative where derived, and every contribution is shown.
When a framework has no authored mappings at all (all-derived), we show no framework number — it reads not directly scored rather than a manufactured score. When direct evidence exists but is thin, the number is capped at 70/100 (ceiling) with a footnote. A derived score never masquerades as a direct audit.
Coverage, by region
The engine scores 24 frameworks from around the world: 13 from direct product mappings, and 11 through the crosswalk while their direct mappings are built. Provenance is always visible.
United States & general
Direct per-product mappings, our strongest modeled score. CMMC Level 2 is scored through the crosswalk for now.
SOC2SOC 2 Trust Services Criteria
NISTNIST CSF 2.0 + 800-53 Rev 5
PCIPCI DSS 4.0
HIPAAHIPAA Security Rule
CISCIS Controls v8
CMMCCMMC Level 2
Europe & UK
Scored via direct control mappings, calibrated for European regulatory specifics. Deployment playbooks for NIS2 / DORA are deferred — and the assessment says so.
GDPRGeneral Data Protection Regulation
ISOISO/IEC 27001
NIS2NIS2 Directive
DORADigital Operational Resilience Act
CECyber Essentials
KSA & Gulf
Direct mappings for NCA ECC and SAMA; the rest are scored through the crosswalk for now. Provenance always visible.
NCANCA ECC v2 / CCC / CSCC / OTCC
SAMASAMA Cyber Security Framework
PDPLPersonal Data Protection Law (KSA / UAE)
UAEUAE IA / NESA
DESCDubai Electronic Security Center
APAC & LATAM
Derived from anchor frameworks, ceiling-capped, labeled.
E8Australia Essential Eight
DPDPIndia Digital Personal Data Protection
LGPDBrazil LGPD
Fintech & payments teams land here. PCI DSS, SOC 2, plus your regional banking framework — scored together, in one pass.
Industry · Regulated SaaS
For the enterprise security review.
Your buyer's vendor-risk team treats you like any third party touching customer data — whatever your headcount.
The SIG Lite moment
The questionnaire arrives and their review runs 6–12 weeks. CyberTwin scores SOC 2 and ISO 27001 against your real configurations in one session — so you answer with artifacts, not promises.
Three threat patterns that define SaaS risk
Supply-chain compromise
T1195 · Supply Chain Compromise
A poisoned dependency reaches production before any review catches it. Days later it touches customer data.
Answered bySoftware-composition checks at build time, dependency-review gates on every PR, lockfile pinning in CI.
Credential theft from developer machines
T1078 · Valid AccountsT1552 · Unsecured Credentials
Laptops carry production-adjacent credentials. One leaked secret in a public commit is immediate access.
Answered byWorkforce SSO with conditional access, a managed secrets vault, push-time secret detection.
Insider exfiltration through legitimate exports
T1041 · Exfiltration Over C2 Channel
A departing admin exports customer data through product paths — CSV, tokens, BI. No perimeter alert fires.
Answered byDLP on export paths, behavioral analytics over the audit log, just-in-time access to production data.
Honest scope
SOC 2 and ISO 27001 playbooks are both authored and current — each scored on its own direct mappings, with provenance labels showing direct versus derived. NIS2 and DORA are scored via direct control mappings too; what's deferred is their deployment playbooks — and the assessment says so explicitly.
Healthtech teams land here too. HIPAA, ISO 27001, PHI handling — the same review, scored against your regulators.
Whichever section is yours