# CyberHeed

> Cybersecurity compliance platform that builds real capability into organisations. AI-guided preparation, evidence validation, and continuous compliance management across 11+ frameworks.

CyberHeed is a GRC (Governance, Risk, and Compliance) platform headquartered in Melbourne, Australia. Founded on 18 years of experience regulating 750 financial institutions. ISO/IEC 27001:2022 certified.

## Core Product

- [Platform Overview](https://cyberheed.com/platform): One platform covering the full compliance lifecycle — Prepare, Comply, Manage.
- [SmartPrep](https://cyberheed.com/smartprep): An adaptive, AI-guided journey that generates a complete documentation suite from your team's actual answers. 
- [Evidence & AI](https://cyberheed.com/evidence): Upload evidence, AI validates it against controls (scored 0-5), AutoMatch maps documents to controls across frameworks automatically.

## Supported Frameworks

### Global
- [ISO 27001:2022](https://cyberheed.com/frameworks/iso-27001): 93 Annex A controls across 4 themes. Full certification lifecycle support.
- [NIST CSF](https://cyberheed.com/frameworks/nist-csf): 5 core functions, 23 categories, 108 subcategories.
- [PCI-DSS](https://cyberheed.com/frameworks/pci-dss): 12 requirements, 6 goals for payment card security.

### Australia
- [Essential Eight](https://cyberheed.com/frameworks/essential-eight): 8 ASD mitigation strategies across 4 maturity levels.
- [CPS 230](https://cyberheed.com/frameworks/cps-230): APRA operational resilience standard, effective July 2025.
- [CPS 232](https://cyberheed.com/frameworks/cps-232): APRA data risk management for regulated entities.
- [CPS 234](https://cyberheed.com/frameworks/cps-234): APRA information security standard for banks, insurers, super funds.

### Middle East
- [NCA ECC](https://cyberheed.com/frameworks/nca-ecc): Saudi Arabia's Essential Cybersecurity Controls — 5 domains, 114 controls.
- [DESC ISR](https://cyberheed.com/frameworks/desc-isr): Dubai Electronic Security Center Information Security Regulation — 12 domains, 188+ controls.
- [DFSA](https://cyberheed.com/frameworks/dfsa): Dubai Financial Services Authority cyber security guidelines for DIFC firms.
- [UAE IA](https://cyberheed.com/frameworks/uae-ia): UAE Information Assurance framework for government and critical infrastructure.

## Who It's For

- [Getting Certified](https://cyberheed.com/for/getting-certified): First-time certification for organisations with no compliance background.
- [CISOs](https://cyberheed.com/for/cisos): Multi-framework management, AI evidence validation, honest board reporting.
- [Regulators](https://cyberheed.com/for/regulators): Aggregated compliance dashboards across supervised entities.
- [MSSPs](https://cyberheed.com/for/mssps): Per-client workspaces, portfolio dashboards, AI-driven baseline work.
- [Partners / GRC Consultancies](https://cyberheed.com/for/partners): Scale compliance practices with AI-guided discovery.
- [Enterprise](https://cyberheed.com/for/enterprise): Centralised governance across subsidiaries and regions.
- [Cyber Insurance](https://cyberheed.com/for/insurance): AI-validated posture data for underwriting, not self-reported questionnaires.
- [Financial Services](https://cyberheed.com/for/financial-services): Multi-framework prudential compliance for APRA-regulated entities.
- [Third-Party Risk](https://cyberheed.com/for/third-party-risk): Vendor compliance assessment and monitoring.

## Company

- [About](https://cyberheed.com/about): Founded on 18 years regulating 750 financial institutions. Melbourne, Australia.
- [Trust Centre](https://cyberheed.com/trust): ISO 27001:2022 certified. Australian data residency. Per-organisation isolation. No model training on customer data.
- [Blog](https://cyberheed.com/blog): Insights on GRC, cybersecurity compliance, and AI in compliance.
- [Contact](https://cyberheed.com/contact): Book a demo or enquire about partnerships.

## Key Differentiators

- Capability-first approach: builds genuine security understanding, not just documentation.
- Multi-framework efficiency: ~60% of work reused when adding a second framework.
- AI that challenges, not rubber-stamps: evidence scored 0-5 with specific gap feedback.
- We use our own platform to manage our own compliance (ISO 27001:2022 certified).
- Australian data residency with no international data routing.
- Founded by a former financial services regulator with 18 years of industry experience.

## Optional

- [Full AI-readable content](https://cyberheed.com/llms-full.txt): Detailed product and framework information for AI agents.