Common questions about the platform, the frameworks we cover, and how the whole process actually works.
Complete our guided questionnaire about how your organisation actually operates - no security background needed. From your answers, we generate your policy set, registers, and framework-specific evidence (Statement of Applicability, Targeted Improvement Plan, etc.) automatically.
It depends on your package and how much detail you have ready. Most customers complete the core questionnaire in a single sitting; you can also save progress and come back.
No. Questions are written in plain business language, not security jargon - for example "Do staff use a password manager?" rather than technical control references. If your organisation has an IT provider or MSP, they can help answer the more technical questions, but it's not required.
No, and we want to be direct about this. We are a documentation and readiness platform, not a certification body. ISO 27001 and Cyber Essentials / CE+ certifications are issued by independent, accredited third parties following their own assessment. We build the audit-ready evidence base you bring to that assessment - see our Terms of Service for the full detail.
CAF (Cyber Assessment Framework) is an NCSC resilience framework, usually self-assessed or reviewed by a regulator - not a certificate you buy. ISO 27001 is an internationally recognised, independently-audited management system certification. Cyber Essentials is the UK Government-backed technical baseline, with Cyber Essentials Plus adding an external technical audit. See our CAF, ISO 27001 and Cyber Essentials pages for more detail on each.
No. Cyber Essentials / CE+ is a genuinely separate, smaller offering with its own short, focused questionnaire - not a stepping stone to the full Cyber Assurance Pack.
Often, yes indirectly - many enterprise customers and public-sector tenders ask for ISO 27001 (or evidence you're working toward it) as part of vendor security assessment, even when it isn't stated as a strict requirement. Whether a specific contract requires it depends on that buyer's own rules. We help you build the audit-ready evidence base - policies, risk register, Statement of Applicability, internal audit and management review records - that an accredited certification body will assess.
Your generated documents don't update automatically the moment you change an answer - you need to click Regenerate for that specific document (or Regenerate All) so the change is baked into the actual downloaded file. This is deliberate: it keeps a clear distinction between what you've told us and what's been formally reissued.
The portal flags any document affected by a changed answer since it was last generated, so you're never guessing which documents need attention.
Entirely on infrastructure we control, located in the United Kingdom. Your data is not transferred outside the UK as part of normal service operation, and never passed through a third-party AI service - see our Privacy Policy and Sub-Processors page for full detail.
No. Every customer-facing part of the platform is scoped so your data is only ever accessible to your own account.
Yes. Every policy document, register export and report we generate for you is encrypted (AES-256) the moment it's created, and only decrypted at the moment you download it - it's never stored on disk as a readable file.
There are two parts: a one-off fee when you sign up, which covers your initial setup, document generation, and your first 30 days of portal access, then a recurring monthly fee that begins automatically once those 30 days are up. Ongoing portal access depends on that monthly fee continuing to be paid.
The same thing that happens if you cancel yourself: we'll try to notify you and may retry the payment, but if it isn't resolved, you get the same 30-day grace period to download anything you need before your portal access is automatically revoked. You don't need to do anything to trigger this - it happens on its own if the monthly fee stops being paid.
Yes, self-serve from within your portal account, or by contacting us. You get a 30-day grace period after cancellation to download anything you need before access is revoked.
Reactivating after cancellation is treated as a new signup at the standard package fee, not a discounted return.
Email us at info@cyberseccompliance.co.uk and we'll get back to you directly.