frinc · Executive brief · 01 / 05
01 · What frinc is

Finding rhythm in chaos.

Security and risk arrive as noise: audit findings, pen-test reports, supplier questionnaires, exceptions in email, spreadsheets with _FINAL_v3 in the name. frinc turns those signals into one ordered record that leadership can read, question, and track — as at today, not reconstructed for the meeting.

chaos · scattered signal rhythm · one ordered record findings · reports · questionnaires · email verified · owned · dated
Before · signals as they arrive
CPS234_evidence_FINAL_v3.xlsx RE: backup attestation? PTEST-002 report.pdf supplier questionnaire (2024) who owns AC-021? board pack v7 — slide 14 exception approved (verbal) insurer wants MFA proof by Fri ISO gap list (Sarah's copy)
frinc
After · one record, as at today
AC-021MFA enforcement — proof on file for the insurerverified today
BK-004Backup immutability — evidence stale94 days
ST-002Pen-test findings — 3 open, 1 accepted with exception3 open
SM-011Supplier assurance — annual reviewverified 9d
RK-017Ransomware — residual above appetite, owner namedabove appetite
Signals in
Every source, one place

Assessments, findings, risks, exceptions, actions, evidence and vendors stay connected instead of collected.

One record
Prove a control once

A control proven for one framework reads across the others — Essential Eight, CPS 234, ISO 27001, NIST CSF, PCI, ISO 42001.

Answer as at today
Read, question, track

The board answer is the live record, not a slide assembled the night before. Ask it a question and it answers with citations.

02 · How the platform is organised

Three pillars, one loop.

Assess what you have, manage what you found, report what matters — and the record the board reads is the same record the team works in.

Pillar 1Assess

Know where you stand against the frameworks that matter to your regulator, insurer and customers.

  • Maturity — CMMI-style scoring per control, tracked over time
  • Control gaps — what is missing, partial or unproven, ranked
  • Insurance readiness — the evidence underwriters ask for, on file
  • Strategy & planning — a prioritised uplift roadmap, phased and costed
Pillar 2Manage

Turn findings into owned, dated work — and keep the judgement calls on the record.

  • Risks — inherent and residual, against an appetite the board set
  • Exceptions — accepted risk with an approver, an expiry and a reminder
  • Actions — remediation with owners, due dates and closure evidence
Pillar 3Report

Measure what matters and put it in front of executives in a form they can question.

  • Measure what matters — a metric library, key controls tied to key risks
  • Interactive, executive-ready — the four board questions: coverage, exposure, momentum, governance
  • Demystify and simplify — plain-language summaries, ask-the-report Q&A with citations
assess→find gaps→raise risk / action→evidence closure→report as at today→reassess
03 · What it looks like · sample data

One screen per pillar.

Illustrative mock-ups drawn from the product. Figures are examples, not a customer's.

Assess · control crosswalkE8 · CPS 234 · ISO · CSF
Acme Insurance · FY26 · as at today
IDControlE8CPS 234ISO 27001CSF 2.0Status
AC-021Multi-factor authenticationverified
AC-014Restrict admin privilegesverified
BR-002Regular backupsstale 94d
VM-003Patch applicationspartial
TP-011Service provider assuranceverified
evidence satisfies frameworknot mapped

One test, read across every framework. The gap list and insurance-readiness view come from the same rows.

Manage · risk registerRK-017 · ransomware
Owner: Head of Infrastructure · reviewed 12d ago
5 4 3 2 1 12345
inherent 20residual 12above appetite (10)
EXC-004Legacy file server exempt from immutability until migrationexpires 31 Oct
ACT-031Immutable backup tier for production72 % · due 14 Nov
ACT-034Tabletop exercise with executive teamoverdue 6d

The risk, the exception that accepts part of it, and the actions that reduce it sit on one row. Approval is a task, not an email.

Report · board packfour questions
Q3 board pack · generated as at today
COVERAGE
86%
crown-jewel systems tested in the last 12 months
EXPOSURE
3
risks above appetite · 1 accepted at high residual
MOMENTUM
+0.4
average maturity change since last quarter
GOVERNANCE
2
exceptions expiring in 90 days · all with named approvers
Ask about this report ›“Which of the three above-appetite risks changed since Q2?”

Four questions a board actually asks, answered from the live record, with a plain-language summary and a place to ask the next question.

04 · Deep dive · executive report

Four questions a board actually asks.

The board pack is not a chapter per module. It is one page that answers the four questions directors keep coming back to, from the live record, with the threshold the board set and the date it was true.

COVERAGE
Are the things that matter most actually being looked at?
  • Which crown-jewel systems have not been pen-tested in the last 12 months?
  • Which material AI systems lack a current impact assessment?
  • Which key risks are overdue for review?
crown jewels tested in window · material AI with current impact · key-risk reviews on time
EXPOSURE
What sits above the appetite we set, and who owns it?
  • Which risks are above appetite today, and for how long?
  • What have we accepted at high residual, and when does that acceptance expire?
  • Is the exposure coming from general risk, AI systems or pen-test findings?
above-appetite risks · accepted high-residual ≥ threshold · aging buckets · source-tagged general / AI / pentest
MOMENTUM
Are we getting better or worse since we last met?
  • Has maturity moved, per framework and per domain?
  • Which framework is weakest, and did the gap close?
  • What changed since the last pack?
frozen snapshot series · conformance by framework (lowest first) · maturity delta quarter on quarter
GOVERNANCE
Are the judgement calls on the record, and are they still valid?
  • Which exceptions expire in the next 90 days?
  • Did every risk acceptance have a named approver?
  • Are access reviews and vendor reviews complete, or stalled?
exceptions expiring ≤ 90 days · approvals as tasks · review completion by campaign
AS AT
Frozen at generation. Every pack is a snapshot the record cannot quietly rewrite — the figure the board saw is the figure that stays on file.
THRESHOLDS
The board's numbers, not ours. Residual threshold, coverage window and review lead time are set per organisation; the pack measures against them.
PLAIN WORDS
Signal · impact · ask. A three-part written summary above the numbers, so a director reads the point before the chart.
ASK IT
Question the report. Ask in plain language; the answer cites the risks, controls and evidence it drew on.
READ ACROSS
One control, every framework. Conformance is shown per framework without re-testing per auditor.
DRILL IN
Click through to the record. Every figure opens the register row behind it — read-only for the executive seat.
TAKE IT
PDF, print and phone. The same pack renders to PDF for the papers and to a mobile dashboard for the car on the way in.
Ask about this report · sample
“Which of the three above-appetite risks changed since Q2?”
RK-017 Ransomware moved from residual 16 to 12 after ACT-031 (immutable backups) reached 72 %; still above the appetite of 10. RK-004 Third-party outage is unchanged. RK-022 Model drift is new this quarter, raised from the AI impact assessment of the claims-triage model. cites RK-017 · ACT-031 · EXC-004 · AI-IA-003
05 · Tiers

Start free. Grow into the record.

Every tier runs the same connected record. Tiers add modules, scale and support — never a different product.

Free
Small teams proving one framework and getting findings out of spreadsheets.
3 users · 1 organisation2 active assessmentsSaaS only
  • Essential Eight, ISO 27001, NIST CSF, plus sector starter packs
  • Risk, issue and action registers
  • Assessment engine, basic metrics, board pack (read)
  • Guidance library
  • Self-serve MFA · community support
free forever
Standard
Organisations running several frameworks with a risk function and a board to report to.
25 users · 1 organisationUnlimited assessments · 50 guidance seatsSaaS
  • All standard frameworks, incl. CPS 234, PCI DSS, ISO 42001
  • Exception, asset, third-party and application registers
  • Calendar, access reviews, assessment reports, full board pack
  • Policies & standards, guidance assistant
  • AI summaries with your own key · MFA policy, backups · email support
everything in Free, plus
RECOMMENDED
Enterprise
Regulated or multi-entity groups that need the full stack, on their terms.
Unlimited users · multi-tenantUnlimited assessments and guidance seatsSaaS or on-premises
  • Custom frameworks and control libraries
  • Pen-test tracking, AI governance
  • Full AI stack: private LLM, semantic search, ask-the-data, Evidence AI
  • SSO / SAML, backup and restore, white-label branding, audit export
  • Priority support with SLA
everything in Standard, plus