Features & pricing
The full platform, priced by the size of the organisation it runs.
RateYourCyber
Single-organisation governance, risk and compliance. SME and Medium Enterprise.
RYCo Risk Management
Group, multi-org enterprise risk management with a multi-level hierarchy (Group, Division, Business Unit, Operational and deeper). Large Enterprise.
Posture Certificate
A one-off assessment and certificate for smaller companies that need to evidence their security posture to clients, not run a compliance programme. The entry point before a subscription.
£495one-off, renew at £295 a year
Get Posture Verified
Self-assessment with automated external checks. Not an audit, penetration test or independent assurance report. Framework and questionnaire names are the trademarks of their respective owners.
- Cybersecurity maturity and business continuity assessments
- External website and security headers scan
- Posture Certificate, valid twelve months, verifiable by your clients
- Pre-answered vendor security questionnaire, published through your trust centre
RateYourCyber
SME
For small and medium businesses starting on cybersecurity compliance.
£3,000/year
Get started
RateYourCyber
Medium Enterprise
For organisations building a compliance programme.
Contact MSP or consultant for pricing
Contact sales
RYCo Risk Management
Large Enterprise
For multi-entity organisations needing centralised oversight.
Custom pricing
Contact sales
Capability
SME
Medium
Large
Seven core scored assessmentsCybersecurity, business continuity, HR security, data privacy, physical security, third-party risk and AI security. All benchmarked to industry and size.
DPIA assessmentData protection impact assessment workflow.
AI security assessmentAssessment of AI tool usage, exposure and controls.
Full assessment libraryOver 30 scored assessments, each generating its own reporting and feeding the risk register.
Language toggleEnglish, Arabic and Spanish per framework.
Risk registerAuto-populated from assessment gaps, integration findings and monitoring.
FAIR quantitative engineNative annualised loss expectancy with loss and probability from the organisation profile.
Monte Carlo simulationThousands of iterations, with stress, reverse-stress and historical replay.
Breach-cost data sourcesIBM, Ponemon and Verizon DBIR with GCC and ME regional coefficients.
30+ risk visualisationsEisenhower, heat map, tornado, ALE curves, sensitivity and concentration.
Qualitative 5x5 matrixAvailable alongside the quantitative model.
ALE and VaR outputsQuantitative loss outputs.
Multi-level risk hierarchyGroup, division, business unit, operational and deeper, fully built with reporting.
PESTEL risk taxonomyAll six dimensions live. Political, Economic, Social, Technology, Environmental and Legal, each scored as a sign-normalised z-score composite against the country's own multi-year baseline.
Reputation dimensionFirm-level reputational stress per business unit, scored separately from the macro PESTEL environment. News volume, tone and severe negative spike days.
External risk signal ingestionWorld Bank, GDELT, USGS, NASA EONET, CISA KEV and NVD feeds resolved into signals and linked to register entries.
Departmental risk ownershipRisk domains assigned to departments, with scoped access per business unit.
Group stress and reverse-stress scenariosScenario levers applied across business units with reverse-stress solving.
Portfolio Monte CarloMulti-risk aggregation across business units.
Per-business-unit breakdownConcentration and composite scoring by unit.
RIMS Risk Maturity ModelMaturity assessment of the risk programme.
Bowtie analysisCauses, consequences and controls auto-derived from the register.
Expected Shortfall outputsTail-risk loss measure.
Cross-entity risk aggregationRoll up risk across subsidiaries.
Board-ready group risk dashboardHeadline narrative, historical ALE, top-risk bowtie, top-5 table, signals and governance.
Multi-subsidiary supportManage many entities under one group.
KPI trees with driver decompositionObjectives decomposed into measurable nodes, each linked to the risk drivers that move it.
848 statistical risk-driver conceptsEmpirical distributions sourced from regulators, national statistics offices and published consultancy research, with citation on every concept.
1,568 driver-to-KPI mappingsDirectional mappings with inversion handling, so a driver moving in its own terms resolves correctly against the KPI it depletes.
19 industry-calibrated templatesDriver distributions calibrated per industry, then scaled by organisation size and geography.
KPI forecasting and variance explanationPredicted values with variance attributed back to the drivers responsible.
KPI Monte Carlo and bowtieSimulation across the driver set, with bowtie causes, consequences and controls derived from the tree.
Automatic risk-driver classificationEvery risk raised is resolved to its underlying drivers and remediation tasks are generated from them.
KPI-sourced register entriesKPI breaches and forecast breaches raise register entries in their own right.
ISO 27001Information security management. Full ISMS, statement of applicability and internal audits. 132 clauses: 93 Annex A controls, the 25 management system requirements of clauses 4 to 10, and the 14 ISO 27011 telecom controls, which apply to a telecommunications organisation and stay out of the way of everyone else.
ISO 27701Privacy information management, the 2025 edition. 78 Annex A controls across controller, processor and shared, with five privacy registers that double as evidence rather than as paperwork.
PCI DSS v4.0.1Payment card industry data security standard. 350 clauses across the twelve requirements, 279 of them individually assessable, with compensating controls and the customised approach.
SOC 2Service organization control. 66 controls across the trust services criteria, with a self-service auditor portal, any external auditor and a 90-day scoped window.
DORADigital operational resilience. ICT third-party register, incident management and tabletops.
GDPRData protection regulation. RoPA, SAR, breach, DPA and LIA.
HIPAAHealth insurance portability. Security and privacy rules with breach notification letters.
NCA ECCEssential cybersecurity controls. 108 controls with SAMA automapping.
SACS-002Third-party cybersecurity. 92 controls, classification-aware, automated board reporting.
CMMC 2.0Cybersecurity maturity model. 110 practices with C3PAO questions, SPRS score, plan of action and milestones, and a CUI data-flow builder.
SAMA CSFCyber security framework. 95 controls, 222 questions, EN/AR board PDF, tabletop runner.
NIS2EU network and information security directive.
Essential EightACSC mitigation strategies. Assessed at individual control level rather than by strategy: 144 requirements with maturity levels zero to three, current and target state, and the requirements standing between a strategy and its next level named individually.
WA Government Cyber Security PolicyThe 2024 policy. 95 requirements across 25 clauses and six functions, plus the Annual Implementation Report, with Essential Eight maturity read directly rather than asked for twice.
ESG ReportingEDCI, SASB and GRI cyber disclosure.
ISO 42001AI management system.
ISO 22301Business continuity management.
LFPDPPPMexican federal data protection law. Full module.
UK GDPRUK data protection. Records of processing, subject access, breach, processor agreements, transfers and legitimate interests.
PTA CTDISRPakistan Telecommunication Authority critical telecom data and infrastructure security regulations. 109 requirements for licensed operators.
NCSC CAFCyber assessment framework. 41 contributing outcomes assessed against a regulator target profile, with the NCSC indicators of good practice built in.
NIST CSF 2.0Cybersecurity framework. 106 subcategories across all six functions, with the published 1.1 to 2.0 crosswalk carried for you.
CIS Controls v8.1Critical security controls. 153 safeguards with implementation group attribution.
IEC 62443Industrial and operational technology security. 77 requirements for the OT estate.
ISO 9001Quality management system.
COBIT 2019Governance of enterprise IT.
ITIL 4IT service management.
IIA Global Internal Audit StandardsThe 2024 standards. 52 requirements across the five domains, which the internal audit function is built on rather than mapped to.
Financial Crime ComplianceAML and CTF programme management with sanctions screening.
Regulatory trackingTracks the position against legislation in real time across multiple jurisdictions.
Legal-requirement compliance checkAssesses whether what the organisation has in place meets the legal requirements.
Policy-presence checkChecks whether the required policies exist in the organisation.
Regulation readinessAssesses whether the organisation is ready to comply with a specific regulation.
Policy libraryBrowse the policy catalogue.
Assessment-driven policy generationPolicies generated from real results, not templates. Patent pending.
Localised policiesLocalised where applicable, including a dedicated data privacy policy for each core geography.
Policy-adherence checksVerifies whether the organisation's policies are actually being adhered to.
Auto-verified complianceCompliance verification with cross-policy conflict detection.
Distribution and acknowledgementTracked per policy.
AML / FCC moduleTen control areas, business-wide risk assessment and obligations register.
Jurisdiction-aware AML policy generatorUnited Kingdom, European Union, Spain, Saudi Arabia and Mexico variants.
MLRO governance and SARWith suspicious activity reporting.
KYC / CDD and sanctions screeningPlus transaction-monitoring posture.
AML trainingAwareness training with evidence to the regulator.
Vulnerability scannerNative, CVSS-based deep checks.
Threat and supplier monitoringVulnerability, supplier and SSL and domain monitoring.
Attack surface scoringRatio-based seven-category, NIST SP 800-30 and CVSS v4.0.
Dark web credential monitoringSurfaces exposed credentials.
Domain impersonation detectionDetects look-alike domains.
Credential breach monitoringContinuous breach exposure checks.
Continuous monitoring consoleControl state evaluated from connected platforms on a schedule rather than when somebody remembers, with executive, governance and operational views over the same signals.
Connected source healthEvery connector reports its own state: a credential that has expired, an entitlement withdrawn, a source that has stopped reporting. A control that cannot be observed is reported as unobserved rather than as compliant.
Asset coverage and gapsEvery managed endpoint and server reconciled across the connected categories, so a machine seen by one tool and not another is a coverage gap rather than an assumption.
Drift from baselineA known-good state is recorded and every later evaluation is compared to it, so a control that was in place and is no longer is visible as movement rather than as a number.
Evidence freshness and expiryAttached evidence ages against its own review window and raises an event when it crosses, once per crossing, so evidence does not quietly become historical.
Escalation rulesThresholds and channels the organisation sets, so a signal that matters reaches a person rather than a dashboard nobody opened.
Internal audit functionEngagements from planning to closure: scope, fieldwork, findings, management responses, follow-up and lessons learned, against the IIA Global Internal Audit Standards.
Auditor independence enforcedAn internal auditor cannot edit what it audits. The separation is applied server side on every request rather than by convention.
Findings into the registerAn audit finding raises a task and, where it warrants one, a risk, so the audit result is worked rather than filed.
Audit-ready evidence trailEvery access and every change recorded with actor, time and the values before and after, in a hash-chained log whose integrity is verified on a schedule.
Executive summary and recommendationsWith a PDF report generator.
Framework mappingMaps results to frameworks.
ESG disclosure reportsEDCI, SASB and GRI.
150+ reportsAcross thousands of permutations.
Per-framework and per-assessment reportingEvery framework module and every assessment generates its own reports.
Board and enterprise language registersReporting tuned for board and for operational enterprise audiences.
Three languagesEnglish, Spanish and Arabic.
Industry benchmarkingNCSI regional maturity data, size and geography adjusted.
Investor and 3-year-plan reportsBuilt in.
No external LLM exposureClient data is never sent to any external large language model.
AI cyber advisorGuidance from results. Enhanced from Medium Enterprise up.
AI security assessmentDedicated assessment of AI tool usage, exposure and controls.
AI governanceAligned to ISO 42001 for AI management systems.
AI vendor due diligence and portfolio riskWith executive briefings.
Business continuityISO 22301 aligned assessment.
Third-party risk assessmentScored supplier assessment feeding the register, with the supplier tiered by what it can reach rather than by what it is called.
Supplier questionnaire portalThe supplier answers through a link, with no account to create and nothing to install. Four templates across 56 sections, and the answers score themselves on return.
Supplier screeningSanctions and adverse media screening at onboarding and on review, so a supplier is checked rather than assumed.
Supplier lifecycle and lane statusOnboarding to exit as recorded states rather than a spreadsheet column, with the history of every move held and reportable.
Review dates and overdue assuranceA supplier assessment that has passed its review date is reported as out of date, because an assurance position that is out of date is not evidence.
Supplier audit findingsFindings raised against a supplier, tracked to closure and visible beside that supplier rather than in a separate file.
HR personnel securityJoiner-mover-leaver, insider threat and board liability.
LMS and awareness trainingEmployee training portal with completion certificates.
Enterprise vendor managementFull vendor lifecycle, not just questionnaires.
Vendor master syncThe source to pay system keeps the vendor master and the platform matches on its identifier rather than on a legal name, so a renamed supplier does not become a second one. Six third-party control checks are evaluated from it.
ICT third-party registerDORA ICT register.
Trust CentreBasic from SME, full from Medium Enterprise.
Share with MSPGrant managed-service-provider access.
Hardened authAuth0, httpOnly cookies, no local-storage auth.
Verifiable code gatesPHPStan Level 9 and Semgrep on all production code.
Team, task and calendar managementWith the cyber maturity journey.
80+ integrations and data sources34 platform connectors, 17 native scanners, device agent, 11 AI observability integrations, 6 external risk feeds, 6 regulatory jurisdictions, 3 sanctions lists and 2 FX sources. All with verified security posture, multi-tenant support and partner API.
Enterprise vaultEncrypted, isolated tenant database with split-key recovery.
Custom integrations and API accessWith a dedicated account manager.
Every framework module and every assessment generates its own reporting. Feature availability is curated for this page and kept in step with the licence configuration.
Frequently asked questions
Each completed assessment across any of the available assessment types counts towards your annual limit. You can reassess the same area multiple times to track progress.
Yes, you can upgrade at any time. We will pro-rate the difference for the remainder of your subscription period.
RateYourCyber maps to ISO 27001, SOC 2, GDPR, NIS2, the NCSC CAF, DORA, NIST CSF 2.0, CIS Controls v8.1, IEC 62443, HIPAA, CMMC 2.0, NCA ECC, SACS-002, SAMA CSF, LFPDPPP, ISO 42001, ISO 22301, ISO 9001, COBIT 2019, ITIL 4, ESG reporting, and financial crime compliance with AML programme management. Evidence is collected once and counts everywhere it applies, so a policy, audit or training record satisfies every framework that asks for it at the same time. Medium Enterprise includes one framework as a full ISMS, Large Enterprise includes all of them.
The Medium Enterprise plan is available through our MSP and consultant partner network. Partners can customise features and pricing based on your requirements.
We offer a one-time assessment at £799 for organisations wanting to evaluate the platform before committing to an annual subscription.
Ready to strengthen your security posture?
Join organisations using RateYourCyber to manage compliance and reduce cyber risk.