Six weeks on RateYourCyber: 30 frameworks, close to 100 integrations, internal audit and project risk

We have spent the last six weeks building and have not been very disciplined with posting, so this is a catch-up on what has changed at RateYourCyber since the start of September. Everything below is live in production.

Recognition

techUK named RateYourCyber one of the 10 finalists for Cyber Innovator 2026 at its Cyber Innovation Den on 6 October, where we pitched to a judging panel drawn from Accenture, NHS England, OneAdvanced and iD Mobile.

At the Computing Cloud Excellence Awards 2026 we were shortlisted in three categories: Cloud Security Product of the Year, Best Use of AI in the Cloud, and Most Innovative Cloud Product or Service. We were Highly Commended in Most Innovative Cloud Product or Service.

The platform now runs 30 frameworks on one engine, covering more than 1,600 clauses, and connects to close to 100 integrations and data sources.

Frameworks

PCI DSS v4.0.1

PCI DSS is live across 350 clauses. The hardest question for most merchants is not whether they encrypt account data; it is which requirements apply to them at all. A merchant on one self-assessment questionnaire answers a few dozen requirements, while the same merchant on another answers all of them, and getting that wrong puts an organisation on the wrong questionnaire for a year.

The platform asks a branching set of scoping questions, determines which of the self-assessment questionnaires applies, records the reasoning an assessor will ask for, and shows which change would reduce the burden. It then writes the cardholder data environment scope statement from those answers. Alongside the 350 clauses sit tabs for scoping, the cardholder data environment, inventories, targeted risk analyses and attestation, and the attestation is generated from the assessment answers with the organisation's details taken from its profile.

Australia's Essential Eight

The Essential Eight is assessed at requirement level: all 144 requirements of the ASD maturity model, each answered as implemented, partially implemented, not implemented or a documented exception. A strategy reaches a maturity level only when every requirement at that level and below is implemented, and the organisation is assessed at its weakest strategy, exactly as the model requires. For each strategy the platform names the requirements standing between it and the next level, which is what an assessor and an uplift plan both need.

Evidence comes from across the platform rather than from uploads alone: published policies and acknowledgements, tabletop and disaster recovery exercises, the incident and change logs, training, the joiner, mover and leaver lifecycle, the asset register, and vulnerability and attack surface scans.

WA Government Cyber Security Policy

The 2024 Western Australian Government Cyber Security Policy is live as its own framework: 29 clauses over 95 requirements across Govern, Identify, Protect, Detect, Respond, Recover and the Annual Implementation Report, with each requirement recording whether the policy says "must" or "should". Where the policy asks for Essential Eight maturity, it reads the organisation's Essential Eight assessment rather than asking the same questions again.

Telecoms: CTDISR-2025 and ISO 27011

The Pakistan Telecommunication Authority's Critical Telecom Data and Infrastructure Security Regulations 2025 are now on the platform: fourteen chapters and 85 regulations covering governance, assets, risk, incidents, access, operations, continuity, cloud, people, assurance and regulatory oversight. Compliance is a licence condition for PTA licensees and is assured by audit firms the Authority certifies, so the readiness view matters more here than for a standard an organisation asserts for itself. Telecoms exercise scenarios are included.

ISO 27001 now runs on the framework engine, with the ISO 27011 telecoms overlay applied automatically to organisations in the telecoms sector.

ISO 31000 and the IIA Global Internal Audit Standards

ISO 31000 is part of the framework engine, so a group can assess and evidence its risk management process against the standard, with risk capacity, escalation thresholds and reassessment built in. The IIA Global Internal Audit Standards sit beside it, evidenced from the internal audit module's own records.

Integrations and continuous monitoring

The platform now connects to 96 integrations and data sources, up from 75 in August. New connectors include ServiceNow, Qualys, Rapid7 InsightVM, CyberArk, Sonatype, Google Cloud Security Command Centre, Snowflake, Genesys Cloud and Ivalua. The Ivalua connector writes findings and vendor risks back as exceptions.

Each connector follows the same rule: a check whose source does not answer is recorded as unobserved, never as passed. AWS Security Hub and Microsoft 365 findings now close when the provider confirms resolution, and reopen if the issue returns.

A new continuous monitoring console brings connector findings and SOC alerts into one view, so an event reported by two tools appears once with both tools named. It covers asset inventory and coverage, baselines and drift, signed webhook ingest and audit log export, and escalates through email, Slack, Jira or ServiceNow. It is built for organisations that do not have a senior security professional watching a screen all day.

Internal audit

Internal audit is now a full module for groups. It has an independence model, audit roles assigned by invitation, and an append-only log of every access to restricted audit material. Engagements carry time recording, audit ratings and event-driven reassessment.

Committee packs are generated by the platform, downloaded with a hash so the copy can be verified, and approved by someone other than the person who generated them: the platform refuses approval from the generator. Weaknesses found in internal audit, in risk and control self-assessment and in business continuity are raised as issues without being re-entered.

Project and portfolio risk

Project Risk covers the portfolio and individual projects. Its risks sit on the same engine as the enterprise register, so they roll up into group ERM rather than living in a separate spreadsheet. It includes:

schedules with the critical path calculated by PERT;
interdependency views between projects;
project valuation with a discount rate set by the organisation;
an optimism bias adjustment;
stage gates valued as real options;
portfolio analysis showing the distribution of outcomes across all projects.

Enterprise risk

Enterprise risk management gained a set of capabilities that large groups and regulated firms expect:

Key risk indicators with an escalation line. Every threshold change records a reason and keeps its history, and a red reading raises an issue automatically.
An issue register with priority alongside severity, reminders, overdue notices and escalation to a named person.
A control library recording each control's type, nature, frequency and regulatory tags, with the last operating test, the next one due and the full test history. A failed test raises an issue.
Risk acceptances that record compensating controls and an expiry date, with a scheduled re-review.
Attestation campaigns in which control owners across every entity confirm their controls on a set schedule.
A loss event register recording potential loss and provision, with Basel operational risk scoping for financial institutions.
A risk library built from the Orange Book and the Basel event types, with a loss method for each entry. Groups can add their own library on top.
Custom fields on registers, so a group can record what its own governance requires.

Third parties

Supplier management now screens suppliers daily against sanctions and politically exposed person lists, including OFAC SDN, UK OFSI and the UN Consolidated List. It records each supplier's subcontractors, with approval required before data is shared with them, and measures supplier service levels each period, so a missed level raises an issue.

Regulation and KPIs

The regulatory library now holds the full text of Georgian legislation by article and 32 Australian Acts and instruments by section, including APRA CPS 234 and CPS 230. The library's interface is available in English, Georgian, Spanish and Arabic, with Arabic displayed right to left, and no text in it is machine translated.

Regulatory KPIs can be set from a regulator's prudential requirements with limits specific to each entity, including the liquidity coverage ratio by currency, and are monitored beside the group's own performance KPIs. Recording a breach raises an issue for each breached figure. The KPI library covers banking and other industries.

Also new

A three-year security investment plan with three priced options per domain, from free and open-source tools upwards, set against sourced breach exposure. Tool prices are kept in the currency the vendor published, with the source and the date checked.
A rebuilt REST API for enterprise use: keys scoped to named endpoints, calls rate-limited, and every call logged.
The Posture Certificate partner programme, which gives member networks a co-branded route for their members to prove their cyber posture once and share it with every client.

See it on your own organisation

Everything in this update is live in production on RateYourCyber

Get Started