Cybersecurity readiness
Be ready before the questionnaire, the audit or the renewal arrives.
CyberWave Sentinel turns security requirements into controls, evidence, action and a readiness score you can show.
Self-service signup opens shortly — we will set you up in the meantime
- From
- $99/mo
- Published price
- Trial
- 14 days
- No card required
- Data
- Canada
- Stored in ca-central-1
Screens captured from a Sentinel workspace on 10 September 2026. Northstar Manufacturing Ltd. is a fictional example — a 180-person manufacturer in Ontario, Canada — not a customer, and its scores are computed by the product from its records rather than typed in for the picture.
The moment
Security becomes urgent when somebody else sets the deadline.
Nobody buys readiness on a quiet Tuesday. They buy it the week a form lands with a date on it — and by then the evidence either exists or it does not.
- Your insurer
“Complete this questionnaire before we can quote the renewal.”
Nine control questions, each one wanting evidence you have not assembled.
Deadline: the renewal date
- Your customer
“Send us your security controls before we can sign.”
A spreadsheet from their procurement team, and a deal waiting behind it.
Deadline: their legal review
- Your auditor
“Provide the evidence for these controls.”
Not the policy — the proof that the control actually operated, and when.
Deadline: fieldwork week
- Your board
“How exposed are we, and what are we doing about it?”
A question that a control list does not answer and a status update does not survive.
Deadline: the next meeting
You have controls. The question is whether you can prove they operated.
Policies are easy to write and easy to show. Evidence is what an underwriter, an auditor and a customer's security team are all actually asking for — and it is the thing a folder of documents cannot produce on demand.
How it works
One pipeline, from the requirement to the board pack.
Each step consumes the one before it. That is why it is a sequence and not a feature list — you cannot evidence a control you have not identified, or report readiness you have not evidenced.
CyberWave diagram · quantities from the example workspace
- 93ISO Annex ARequirements
The framework, the questionnaire, the customer review. One place.
- 142with ownersControls
Each requirement becomes a control with a named owner and a real status.
- 142items trackedEvidence
Proof attached once, carrying a status and an expiry date.
- 35expired or missingGaps
What is stale, absent or unowned — found here, not by an auditor.
- 19assigned, datedActions
Gaps become work with an owner and a date, not a note in a report.
- 78out of 100Readiness
Built from what you actually hold. Nine weighted categories.
- 1board summaryReporting
Where are we, what changed, what needs a decision.
- 93ISO Annex ARequirements
The framework, the questionnaire, the customer review. One place.
- 142with ownersControls
Each requirement becomes a control with a named owner and a real status.
- 142items trackedEvidence
Proof attached once, carrying a status and an expiry date.
- 35expired or missingGaps
What is stale, absent or unowned — found here, not by an auditor.
- 19assigned, datedActions
Gaps become work with an owner and a date, not a note in a report.
- 78out of 100Readiness
Built from what you actually hold. Nine weighted categories.
- 1board summaryReporting
Where are we, what changed, what needs a decision.
Quantities are from the example workspace used throughout this site. Northstar Manufacturing Ltd. is fictional.
Cyber insurance
Your renewal should not be the first time you find the gaps.
Underwriters ask the same control questions every year. The answer that costs you is not “no” — it is partial, discovered in the week the form is due, with no evidence and nobody assigned.
3 partial answers, 5 underwriter concerns, 4 missing critical evidence items — each with an owner and a date, months before the form is due.
CyberWave helps you prepare for underwriting and security questions, organise evidence, identify possible gaps and plan remediation. CyberWave is not an insurer or an insurance broker, does not bind coverage, does not interpret policy coverage as legal advice, and does not guarantee coverage, premium reduction, claim payment or insurer acceptance. You remain responsible for complete and truthful representations to your insurer or broker.
The product
Every step above is a screen you actually work in.
The register, the evidence, the risks and the actions — one connected system rather than four documents that disagree.
Controls
Requirements become controls with names against them.
26 controls mapped from 3 frameworks at once, 85% test coverage, 2 deficient and 2 still unowned — reported as gaps, not averaged into a percentage.
Risk and action
A gap nobody owns is a note, not a finding.
7 open risks, 1 critical. Gaps become work with a name and a date, bucketed the way an owner thinks — 2 critical now, 3 quick wins, 3 inside thirty days.
One requirement, traced
This is the part a spreadsheet cannot do.
A spreadsheet can hold every one of these rows. What it cannot do is know that the restore test is due on 30 September, that the A.8.13 evidence is flagged once it passes, and that somebody has to run it before the renewal.
The link is the product. Everything else is storage.
CyberWave diagram · one requirement, traced
- RequirementISO/IEC 27001:2022 · A.8.13Information backup
- ControlBackups immutable and offlineOperating
- OwnerM. DelacroixAccountable
- EvidenceBackup restore test — Q4Expired 18 Feb 2026
- GapRestore test out of dateOpen, awaiting retest
- ActionRun and document restore testDue 15 Apr 2026
Where to start
What brought you here?
These are different jobs with different evidence and different deadlines. Pick the one that is actually on your desk.
The questionnaire is the deadline, and it arrives with a date on it.
Answer each question from evidence you already hold, and see the gaps early enough to fix them rather than disclose them.
What you will be asked for
- MFA across email, remote access and admin
- Backups immutable, offline and restore-tested
- A documented and tested incident response plan
- Critical supplier security reviews
Why Sentinel
Three honest alternatives, and where each one stops.
Most growing businesses are choosing between a spreadsheet, a platform built for a company ten times their size, and a tool that solves exactly one framework.
| Spreadsheets | Heavy GRC | Point tools | Sentinel | |
|---|---|---|---|---|
| Evidence connections | A folder somewhere else; nothing links a file to a control. | Full lifecycle, once an implementation team has configured it. | Scoped to the one framework the tool does. | Every item attached to its control with a status and an expiry, reused across frameworks and renewals. |
| Ownership | A column, filled in once. | Role-based, after a workflow project. | Usually one administrator. | A named owner on every control, risk and action; unowned reports as a gap. |
| Readiness | A percentage somebody calculated. | Dashboards, usually needing a specialist to read. | One framework’s progress bar. | Nine weighted categories with published weights, computed from the records and openable back to the underlying controls and evidence. |
| Cyber insurance | Last year’s answers, from memory. | Not the use case. | Not the use case. | 22 underwriter controls, concerns and missing evidence, and a renewal workspace. |
| Executive reporting | Written by hand each time. | Powerful, and a project to set up. | A certificate-shaped output. | What moved and what needs a decision, generated from the register. |
| Implementation complexity | None, until it decays. | Months, and a consultant. | Fast, then you need another one. | Same week. One framework in scope on Essentials; published pricing from $99/month. |
- Evidence connections
- Every item attached to its control with a status and an expiry, reused across frameworks and renewals.
- Ownership
- A named owner on every control, risk and action; unowned reports as a gap.
- Readiness
- Nine weighted categories with published weights, computed from the records and openable back to the underlying controls and evidence.
- Cyber insurance
- 22 underwriter controls, concerns and missing evidence, and a renewal workspace.
- Executive reporting
- What moved and what needs a decision, generated from the register.
- Implementation complexity
- Same week. One framework in scope on Essentials; published pricing from $99/month.
- Evidence connections
- A folder somewhere else; nothing links a file to a control.
- Ownership
- A column, filled in once.
- Readiness
- A percentage somebody calculated.
- Cyber insurance
- Last year’s answers, from memory.
- Executive reporting
- Written by hand each time.
- Implementation complexity
- None, until it decays.
Executive reporting
The board does not want another control list.
It wants three things: where are we, what changed, and what needs a decision. Same register, read for a different room — generated, not assembled the night before.
Readiness moved from 68 to 76 since July. One critical risk is open, and the cyber insurance renewal is 96 days out.
Needs a decision
- Critical risk — ransomware via phishing on plant-floor workstations: approve the treatment or formally accept it with conditions.
- Two contracts expire inside 90 days: the shipping and EDI portal (20 October) and OT line-controller support (28 November).
- Finalise the Statement of Applicability before the Stage 1 readiness review on 20 October.
Frameworks
Five readiness profiles, one register.
Not five projects. The same controls and the same evidence answer to every framework you activate, so a second framework starts partly answered.
Sentinel supports readiness, governance, assessment, evidence organisation and control management. CyberWave does not certify compliance, issue audit opinions, guarantee compliance, or replace independent auditors, certification bodies or legal counsel. Framework references are informational readiness mappings.
Advisory
Software when you can operate it. A person when you cannot.
Some companies need the platform and nothing else. Others need someone accountable for the programme. Both are priced and published — there is no quote-on-request tier.
2 users, one framework in scope, 14-day trial with no card.
5 users, all frameworks, the full evidence and reporting set.
A reviewed, broker-ready insurance evidence package, assembled from your workspace.
Plainly
What CyberWave is not.
Every claim on this site is meant to survive being checked. These are the ones worth stating before you ask.
Don’t wait for the next questionnaire to discover the gaps.
Start building evidence-backed readiness now, while the deadline is still yours to choose.
Self-service signup opens shortly — we will set you up in the meantime
- Published pricing — no quote-on-request tier
- No credit card required for the trial
- No automatic charge when a trial ends
- Tenant-isolated architecture, data stored in Canada
- Clear data-processing terms
- No compliance guarantee — human judgement still required