Security controls,
plain English.
226+ controls across 5 frameworks with implementation steps, tool recommendations, and the exact evidence your auditor will ask for.
226+
Controls
5
Frameworks
58
Critical
Free
Always
Written for engineers, not auditors
Every control explains what it means, how to implement it, and what evidence to collect. No jargon.
Plain-English controls
No audit jargon. Each control explains what it covers, why it matters, and what failure looks like in practice.
Step-by-step implementation
Each control breaks down into ordered implementation steps with specific tool recommendations so you know exactly what to do.
Auditor-ready evidence lists
Every control lists the specific evidence an auditor will ask for, with real examples so you can prepare before your examination.
Security and compliance frameworks
Full control libraries.
CISA Cybersecurity Performance Goals
v2023
The CISA Cybersecurity Performance Goals (CPGs) are a prioritized subset of cybersecurity practices designed to meaningfully reduce risk for organizations of any size. Published by the US Cybersecurity and Infrastructure Security Agency, the CPGs cover the most impactful controls across account security, device security, data protection, vulnerability management, and incident response. They are designed as a starting point, not a ceiling.
CMMC Level 1
v2.0
The Cybersecurity Maturity Model Certification Level 1 defines 17 foundational cybersecurity practices required for any organization handling Federal Contract Information under Department of Defense contracts. The practices derive from FAR 52.204-21 and cover basic safeguarding of contractor information systems. Level 1 is the entry point for DoD contractors and must be self-assessed annually.
HIPAA Security Rule
v2003
The HIPAA Security Rule (45 CFR Part 164) establishes national standards for protecting electronic Protected Health Information (ePHI). It requires covered entities and their business associates to implement administrative, physical, and technical safeguards that ensure the confidentiality, integrity, and availability of ePHI. Any healthcare provider, health plan, or healthcare clearinghouse that transmits health information electronically must comply.
NIST Cybersecurity Framework
v2.0
The NIST Cybersecurity Framework 2.0 provides guidance for organizations to manage and reduce cybersecurity risk. It is organized around six core functions (Govern, Identify, Protect, Detect, Respond, and Recover) that apply to any organization regardless of size, sector, or maturity.
SOC 2
v2017
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA based on the Trust Services Criteria. It evaluates controls at a service organization relevant to security, availability, processing integrity, confidentiality, and privacy. Security (Common Criteria) is required for all SOC 2 reports.