Score an organisation against a control framework, twice per control — once for whether the policy exists, once for whether it actually operates — then turn the result into a client-ready report.
Work through the framework, scoring policy and implementation maturity and recording findings against each control.
Turns a saved assessment into a formatted report: cover page, executive summary, maturity charts and detailed findings.
The earlier build that assesses NIST CSF 2.0 and CIS Controls v8.1 together on one pass, with the official crosswalk between them.
| Framework | Version | Groups | Controls | Cross-reference | File |
|---|---|---|---|---|---|
| Reading frameworks/index.json… | |||||
Three fictional organisations, fully scored with findings on every control. Load one into either tool to see the output before running a real engagement.
| File | Organisation | Framework | Score | Shape |
|---|---|---|---|---|
| demo-csf-kilcarn.json | Kilcarn Foods Ltd Chilled food manufacturer, 450 staff, three sites |
NIST CSF | 1.93 | Policy ahead of practice throughout; governance is the gap |
| demo-cis-kilcarn.json | Kilcarn Foods Ltd Same assessment, safeguard level |
CIS Controls | 2.36 | Scores higher — CIS asks about the technical controls they run well |
| demo-nis2-kilcarn.json | Kilcarn Foods Ltd Same organisation as an Annex II entity |
NIS2 | 1.65 | Scores lowest — incident reporting obligations they have never touched |
| demo-iso27001-corrib.json | Corrib Analytics Ltd SaaS analytics, 120 staff, stage 1 audit booked |
ISO 27001 | 2.26 | Strong engineering, weak management system — typical first certification |
| demo-dora-boyne.json | Boyne Payments DAC E-money institution, 200 staff |
DORA | 2.33 | Mature incident handling, immature ICT third-party management |
Open the assessment, pick a framework from the dropdown, and fill in the customer details. Score each control for policy and implementation, and record what you saw in the two findings boxes. Set targets on the Goals tab — they drive the priority ranking on the Recommendations tab.
Save early and often: everything lives in the browser tab until you press Save JSON. One file per customer per framework.
Open the report builder and drop the saved JSON on it. Set the cover details, edit the drafted executive summary, choose which findings to include, then print to PDF. Save your settings to reuse the same house style next time.
Drop the JSON into frameworks/ and add a row to
frameworks/index.json. Anything named framework-<id>.json is
found even without a manifest entry.
frameworks/
index.json
framework-csf.json
framework-yourown.json
Framework files use "schema": 3 — groups containing sections containing
controls, plus a flat item list carrying the question, recommendation and effort rating.
Copy an existing file to see the shape.
Editing recommendations in the framework file changes the starting point for every future assessment. Editing one inside an assessment only affects that customer, and is flagged as tailored in the exports.