A requirement nothing covers
A requirement in a standard you follow, such as ISO 27001 or the ASD Essentials for enterprise IT, that none of your security measures meets.
Compliance tools tell you you're fine.
Get Frank tells you what is true right now.
Frank is for the person who has to sign off on your organisation's security and compliance. You run it on yourself before the audit, the board meeting or the regulator's questions. It shows what is actually true, who is responsible for each part, and when it needs checking again.
Introduction · 40 seconds
Read the transcript
One record says the backups are tested. Another says the test to recover the data hasn’t been done. Organisations promise to keep information safe and services running. Their own records should back those promises up. Get Frank is software that reads those records together. It reports where they disagree, or where a claim has no support in those records. Someone has to decide what to fix or accept. Frank records who owns that decision and when it comes back for review. See what your organisation can actually show. Talk to us about a short demonstration.
What Frank gives you
A statement of where you stand, with a name on it and an end date.
- What it covers
- Which part of your organisation it covers, and the laws, contracts and customer promises that apply to it.
- Who stands behind it
- A named person in your organisation. Not the software vendor.
- What backs it
- Records in the systems you already use.
- Known gaps
- Each with an owner and a date to fix it by.
- When it runs out
- A fixed date, set when the statement is made. After that date it has to be checked again.
§ 01
What this means for your role
Most compliance tools are built for audit day. Frank is built for the eleven months in between, when people change roles, systems change and evidence gets old. Looking safe on paper without being safe is compliance theatre.
Security and risk leaders
Your control records say the work is done. Your exceptions tell a different story.
Watch the 38-second film →Boards and executives
Boards don’t need more dashboards. They need to know what the business can show today, and when it needs another look.
Watch the 33-second film → § 02
What Frank finds in the first week.
Four kinds of problem it looks for, so you can deal with them before an auditor finds them.
A supplier nobody is checking
A safeguard you have handed to a supplier or another outside party, with no evidence anyone checks that it is done.
An assumption nobody wrote down
A security measure marked as not needed, or left to a supplier, with no written reason. Frank flags it until someone records why.
A record your own evidence contradicts
A risk marked as reduced while incidents in that area keep happening, or a fix marked done that stalled months ago. Frank shows where your records and your evidence disagree, before an auditor does.
Your risk register says what you typed. Frank says what your evidence shows. It draws no heat maps and gives no credit for risk scores you assign yourself. Read why risk registers go stale faster than anyone notices
§ 03
How it works.
Frank is software you run yourself. Start from the spreadsheets and registers you already keep, or give it read-only access to SharePoint or GitHub. It sorts what you record into four questions, answered in order by the people who own each part, checks every answer against your own evidence by the same fixed rules each time, and keeps one set of answers for every standard you report against. Nobody at Frank reviews your records, and no AI model reads them.
- Step 01
What applies
The laws, contracts and commitments you record as binding on you, and the assumptions behind them.
- Step 02
What you promised
What your organisation has told customers, regulators and the board it will do.
- Step 03
What you actually do
How each promise is kept day to day: the evidence behind it, how it could fail, what it depends on, and where exceptions have been made.
- Step 04
What you can prove
The statement shown at the top of this page, linked to its evidence.
Frank reads only what you point it at, and you can see and withdraw that access at any time. What Frank connects to and what it can read
§ 04
What Frank will not do.
Frank does not replace an audit. It is a tool you use on yourself.
Issues no certificate
Frank gives no pass mark or score. It is the check you run before an audit, not a replacement for one.
Keeps no copy of your evidence
Your evidence stays in the systems that produce it. Frank points to it, so there is no second copy to protect.
Will not help you mislead a regulator
If your evidence does not support a claim, Frank will not publish the claim.
Pays no one to recommend it
No auditor, assessor or consultant earns anything for recommending Frank, and it is never sold as part of an audit or advisory engagement, so nobody who audits you can also sell you Frank. If we ever list practitioners, listing will be free, earned and carry no commission.
Start here
What applies to you, and what are you assuming?
Start with one part of your organisation and the records you already keep. Frank shows where they contradict each other, what nobody is checking, and what has gone out of date. That first view is free.