Assess
Find out where you actually stand — against a framework somebody recognises.
A cyber-risk assessment that produces a specific gap list with owners, not a colour-coded feeling. Built on one shared control library so the work you do for one standard counts towards the rest.
- 13 frameworks with authored, assessable content
- 375 individual requirements covered
- Answer once, satisfy every framework it maps to
- Versioned assessments, so improvement is measurable
Restrict administrative privileges
- Privileged accounts identifiedImplemented
- Privileged access reviewedPartial
- Separate admin accountsNot implemented
- Also satisfiesNIST, ISO, CIS
- Evidence attached2 files
- Raised into action planYes
One answer, recorded once, reflected in every framework the control maps onto.
- Assessable frameworks
- 13
- Requirements covered
- 375
- Master controls
- 65
- Cross-framework mappings
- 504
How it works
Scope it. Answer it. See the gaps. Do it again next quarter.
- 1
Scope what applies
An applicability questionnaire works out which frameworks and requirements genuinely apply to your organisation, so you are not assessed against payment-card rules you never touch.
- 2
Answer the control questions
Work through the shared control library in plain English. Each answer records a status, a note and any evidence you attach.
- 3
See the gaps, mapped
Your answers propagate to every framework the control maps onto, producing a per-framework readiness view and a single consolidated gap list.
- 4
Reassess and compare
Assessments are versioned. The next one sits alongside the last, so movement is a number rather than an impression.
Why one control library matters
The reason assessments normally take three weeks.
Most organisations answer the same question four times in four different formats — once for the insurer, once for the client security questionnaire, once for the grant application and once for the IT provider. The control library exists to end that.
- Controls are written once, in plain English, and shared across every framework.
- A mapping records exactly which requirement a control satisfies, and how fully.
- Adding a framework is authorship, not engineering — it maps onto controls that exist.
- Evidence attached to a control is visible everywhere that control is referenced.
- A control that changes status updates every framework view at once.
You answer once
“Multi-factor authentication is enforced for all users”
Every framework in the library maps onto one shared control set, so evidence you collect for one standard counts towards the others instead of being re-gathered.
What is included
Assessment features.
One control library
65 master controls covering identity, endpoints, email and cloud, data and recovery, and governance and AI. Every framework maps onto these rather than duplicating them.
Cross-framework mapping
504 mappings link controls to specific requirements. Answer "MFA is enforced" once and it satisfies the Essential Eight, NIST CSF, ISO 27001, CIS and your insurer's question at the same time.
Applicability scoping
Requirements that do not apply are marked out of scope with a recorded reason, rather than quietly counting against you or being silently dropped.
Gap register
Every unmet or partially met requirement becomes a tracked gap you can filter by framework, domain, owner or urgency — and raise into the action plan in bulk.
Evidence collection
Attach the screenshot, policy or export that demonstrates a control, with a verification state and a review date so stale evidence is visible.
Progress tracking
Maturity and readiness are recorded per assessment version, so a board or insurer sees the trend rather than a single point in time.
Reassessment cycles
Set a review frequency per framework. Requirements come up for reassessment on schedule instead of when someone remembers.
Framework reports
A per-framework readiness report as a controlled PDF, including scope, method, results, gaps and the disclaimers that belong on it.
Being precise
What an assessment here is, and is not.
It is a self-assessment, supported and structured.
You (or your IT provider) record the answers. Cyber Guys structures the questions, maps them, tracks the evidence and shows the trend. It does not independently verify your environment.
It produces readiness and alignment, not certification.
Cyber Guys is not a certification body and issues no accreditation. Where a standard has a formal certification path — ISO/IEC 27001 is the clearest example — that requires an accredited external body engaged separately.
It is not legal advice or a compliance guarantee.
Frameworks like the Australian Privacy Principles and APRA CPS 234 carry legal and regulatory obligations. The platform helps you organise and evidence your position. It does not tell you whether you have met a legal obligation.
Independent assurance is a separate, good idea.
For the Essential Eight in particular, a self-assessment and an independent assessment are different artefacts and are treated differently by the people who ask for them. We label which one you are holding.
See an assessment run end to end.
Scoping, the control questions, the gap list it produces, and the report you would hand to an insurer.