2Dark Forest hero with a full-bleed photo. Fox mark sits on a Paper badge over the photo, keeping to the "light backgrounds only" rule for the orange fox.
Cybersecurity compliance for small and mid-sized businesses
Security policies your insurer, your clients and your auditor will accept.
Policy Fox writes your information security policy from how your business actually runs, assesses the gaps against ISO 27001 and NIST CSF, and hands you a clear, severity-rated plan. Done in days, not months, for far less than a consultant engagement.
PhotoBusiness owner at a conference table reviewing a printed, branded policy binder with an advisor. Natural light, calm, no screens glowing. Landscape, 3:2.
3Trust strip. Frameworks set as text, not third-party logos (ISO and NIST marks carry usage rules). Can swap for partner/insurer logos once permitted.
A severity-rated tracker plus a starter System & Data Inventory. Owner and target-date columns are left for management, by design.
PhotoOffice manager following a printed procedure checklist
SOP Gap Findings
The procedures and instruments you still need so the policy works day to day.
GraphicCalendar ring showing version 1.0 → 2.0
Annual Review
Policies expire. Each year we re-open the interview against last year's answers, update the version and re-baseline the register.
5Coverage graphic drawn from the 23 domains. Color encodes state: Forest covered, Ember documentation gap, Orange control gap. Illustrative, not a real client.
Assessment
See exactly where you stand across 23 security domains.
We keep two logs during the assessment: control gaps (things not being done) and documentation gaps (procedures not written). You get both, rated, with a recommended approach for each.
Confirms rather than assumes. Brief answers in high-consequence areas get a follow-up.
Never logs a gap from "not sure".
Rates risk and recommends. Never decides for you.
CoveredDocumentation gapControl gap
6Mapping diagram: one policy feeding the four things buyers actually get asked for.
Compliance
One policy. Every question you'll be asked.
Insurers, enterprise clients and auditors all ask for the same evidence in different words. Your policy is mapped clause by clause, so you answer once and point to the page.
7Process is a true sequence with timing, so numbers and a timeline are earned. The interview is described, not offered; it starts after sign-up.
Process
From sign-up to signed-off policy in about a week.
1
Day 1
Sign up and onboard
Create your account, tell us your industry and headcount. We research your website before the first question.
2
Days 1–3
Guided assessment
Plain-language questions, one at a time, across 23 domains. Pause and resume. Assign sections to the people who know.
3
Day 4
Review your findings
Confirm the stated defaults and the systems we flagged for a second look.
4
Day 5
Your policy goes live
Policy, assessment and gap register open in your Policy Fox workspace, scored and tracked from day one. Branded exports are a click away.
8Industry tiles are photo-led. Four to start; the list should follow where engagements actually come from.
Industries
Built for businesses that get asked to prove it.
Examples and depth are tuned to your size, your industry and the tools you already use.
Real estateBrokerage office, agents at desks. Six offices, one policy.
Professional servicesAccounting or law firm reception, client files visible.
Healthcare & dentalFront desk, intake tablet, privacy notice on wall.
9Case study with figures from the brokerage engagement. Quote is placeholder wording until the client approves one.
PhotoPortrait of the brokerage owner or operations lead, in their office, holding the binder.
Case study · Real estate brokerage
"We had six offices, a hundred agents and no written policy. One afternoon later we had something our insurer accepted on the first pass."
Operations lead, six-office brokerage (name and photo pending approval)
117policy requirements
22gap findings, rated
16SOP findings
10Pricing teaser; values blank until decided. Links to its own page.
Pricing
One engagement, or keep it current every year.
Every plan includes the full assessment, your policy and gap register in the platform, and branded exports. The annual plan adds regulation watch and a yearly re-assessment.
1"Start your interview" is gone from the page. The primary action everywhere is "Get started" (account creation); the interview begins inside the portal.
2Hero is now a dark, photo-led compliance-service opener. The orange fox stays on a Paper badge because the guide forbids it on green or photographs.
3Framework names are typeset rather than shown as logos until trademark usage is confirmed.
4Six service cards: the five deliverables plus Annual Review as the subscription hook. Each has a photo or graphic slot with a shot description.
5The 23-domain coverage grid is drawn from real domain names; its coloring is illustrative.
6Mapping diagram and severity bar are vector, so they render crisp at any size and in both themes.
7Process timeline uses approximate days; adjust once the self-service pipeline is measured.
8Industry tiles are photo placeholders with shot briefs. Swap the set to match real pipeline.
9Case-study quote is placeholder wording; figures are real (117 / 22 / 16).
10Pricing values are blank until decided. Partner program removed from the home page for v1.
11Sign-up form is UI only in this wireframe; submission does nothing.
12Photo slots carry a short brief in the caption so a photographer or stock search can source them; the tint is a stand-in.