Our Framework

Discover5 & Ready5

A two-part assessment that looks at business risk and cyber capability. Discover5 covers business risk with executives; Ready5 covers cyber capability with IT. Together they show a small organization where it is exposed and what to address first.

Request an assessment See the standards alignment

3 hours

Full assessment and out-brief, delivered by a practitioner

1 to 100,000 Employees

One model that scales from a single employee to a hundred thousand

Business-First

The first conversation is with leadership, not with IT

File · CRC/010 · The assessment

Two halves, one picture

Business risk first. Cyber capability second.

We start with the question a cybersecurity leader has to answer first — if this system went dark, what happens to operations, finances and reputation? — and only then look at whether the controls that would prevent it are in place.

D5 · Business risk

Discover5

Executive-led · 36 findings across 5 areas

A structured business-risk assessment run as a conversation with organizational leadership. It examines who has access to systems and data, how cyber spend is prioritized, what the business actually runs on, how much PII sits in the environment, and whether anyone owns the security program. A higher score means more risk present.

PersonnelNon-employee access, contractor ratios, endpoint and personal-device sprawl6
FinancesIT spend as a share of revenue, budget trend, card-payment exposure4
OperationsCritical systems, data storage, web presence, PII volume, remote access15
IT SupportWhether support exists, where it sits, how mature the relationship is4
GovernanceCyber insurance, IR planning, tabletops, awareness training, program ownership7

R5 · Cyber capability

Ready5

IT-led · 43 controls across 5 domains

A focused capability evaluation run with the IT team or the MSP. Every control asks whether a capability is in place and operating, not whether a license is owned. Coverage is validated where it can be: EDR reconciled against the asset inventory, backups restore-tested rather than job-checked. A higher score means the capability is present and validated.

EndpointInventory, patching, EDR coverage, 24/7 MDR, isolation, tamper protection11
IdentityUser lifecycle, MFA strength, phishing resistance, admin separation, help-desk verification15
EmailSPF / DKIM / DMARC, safe links and attachments, phishing triage4
EdgeDNS, web filtering, secure browsing, segmentation for guest Wi-Fi and IoT, remote access5
ResponseBackup restoration, IR plans, tabletop exercises, ransomware and BEC playbooks8

File · CRC/010 · Threat model

What it is built to stop

The drive-by attack, and where each control acts on it.

The framework is not a general theory of security. It is aimed at the two events that actually bankrupt small organizations: ransomware, and business email compromise ending in wire fraud. Every domain exists because it interrupts a specific link in that chain.

$274,000 USD

avg SME incident · NetDiligence 2025

Small businesses and nonprofits rarely have the basics in place. So we focus first on the controls that prevent the highest-frequency, highest-cost losses, before anything advanced.

Stage 1: Lure
A malicious ad, a spoofed site, or a fraudulent invoice reaches a user.
Discover5 · Awareness
Stage 2: Entry
An exploit kit fires, or a phishing page harvests credentials.
eg1-eg2 · em1-em4
Stage 3: Foothold
Payload lands on an unpatched or EDR-uncovered endpoint.
ep4 · ep6-ep7
Stage 4: Escalate
The attacker gains admin rights, or payment approval authority.
id10-id14 · id5
Stage 5: Impact
Ransomware encryption, or a fraudulent wire leaves the account.
ep8-ep9 · rs7-rs8
Stage 6: Recover
Restore operations and limit financial and reputational damage.
rs1-rs4 · rs5-rs6

File · CRC/010 · Alignment

Standards alignment

How Discover5 and Ready5 line up with NIST, CMMC and CIS.

Discover5 and Ready5 are readiness assessments, not audit standards. Every finding and every control carries an explicit reference to NIST CSF 2.0, NIST SP 800-171, CMMC Levels 1 and 2, and CIS Controls v8.1, so an organization can see where our assessment lines up with the standard it cares about, and where it does not. Pick a standard to compare.

Compare with

NIST CSF 2.0

6 functions · 106 subcategories

A voluntary framework organizing cybersecurity outcomes across six functions.

Where we are similar

Protect, Detect, Respond and Recover map to the Ready5 control domains
Govern and Identify map to Discover5 governance, asset and risk items
A CSF reference is cited on every Ready5 control in the assessment catalog
All six functions are touched across the combined Discover5 and Ready5 set

Where we differ

Scope CSF spans all 106 subcategories; we assess a focused subset
Govern depth CSF goes further into strategy, policy and supply-chain oversight
Unit of measure CSF Tiers describe organization-wide maturity; we score control-level readiness
Output CSF describes outcomes; our report is a prioritized set of recommended actions
Business-risk layer spend, insurance and PII exposure sit outside CSF's technical scope

File · CRC/010 · Positioning

Straight answers

What Ready5 is, and what it is not.

What it is

Rapid — assessment and out-brief delivered in three hours
Scalable — one model that works from 1 to 100,000 employees
Business-First — the first meeting is with executives on structure and risk, before cyber capabilities
Built for Drive-by Attacks — prioritizes detection and response to break the attack kill chain
Built for SMBs — right-sized for small and mid-sized businesses and nonprofits
A readiness foundation — the posture many regulated entities build on

What it is not

Not a compliance framework — we map to NIST, CMMC and CIS without being an audit standard
Not built for targeted threats — insider, APT and enterprise-targeted attacks belong to specialist programs
Focused on the common attack — built to stop drive-by ransomware and business email compromise
Welcoming to regulated entities — not a regulated-compliance program, but the base many build on
Cyber readiness first — we start from what actually stops loss, and audit readiness follows

File · CRC/010 · Get started

Get started

See where your organization actually stands.

The full assessment and out-brief take about three hours, and it is free for qualifying nonprofits.

Book your assessment For MSPs: Ready5 Validation

Chart · loading

Loading page…

Business risk first. Cyber capability second.

D5 · Business risk

Discover5

Executive-led · 36 findings across 5 areas

PersonnelNon-employee access, contractor ratios, endpoint and personal-device sprawl6
FinancesIT spend as a share of revenue, budget trend, card-payment exposure4
OperationsCritical systems, data storage, web presence, PII volume, remote access15
IT SupportWhether support exists, where it sits, how mature the relationship is4
GovernanceCyber insurance, IR planning, tabletops, awareness training, program ownership7

R5 · Cyber capability

Ready5

IT-led · 43 controls across 5 domains

EndpointInventory, patching, EDR coverage, 24/7 MDR, isolation, tamper protection11
IdentityUser lifecycle, MFA strength, phishing resistance, admin separation, help-desk verification15
EmailSPF / DKIM / DMARC, safe links and attachments, phishing triage4
EdgeDNS, web filtering, secure browsing, segmentation for guest Wi-Fi and IoT, remote access5
ResponseBackup restoration, IR plans, tabletop exercises, ransomware and BEC playbooks8

The drive-by attack, and where each control acts on it.

$274,000 USD

avg SME incident · NetDiligence 2025

Small businesses and nonprofits rarely have the basics in place. So we focus first on the controls that prevent the highest-frequency, highest-cost losses, before anything advanced.

Stage 1: Lure

A malicious ad, a spoofed site, or a fraudulent invoice reaches a user.

Discover5 · Awareness

Stage 2: Entry

An exploit kit fires, or a phishing page harvests credentials.

eg1-eg2 · em1-em4

Stage 3: Foothold

Payload lands on an unpatched or EDR-uncovered endpoint.

ep4 · ep6-ep7

Stage 4: Escalate

The attacker gains admin rights, or payment approval authority.

id10-id14 · id5

Stage 5: Impact

Ransomware encryption, or a fraudulent wire leaves the account.

ep8-ep9 · rs7-rs8

Stage 6: Recover

Restore operations and limit financial and reputational damage.

rs1-rs4 · rs5-rs6