MansioSec

MansioSec in full

Every tool, framework and sample

What each tool does and a sample of what it makes, the frameworks one assessment maps to, the free tools for your website, and how it all works.

Start a 7-day free trialSee plans and pricing

What's inside

Each tool is built for one job in an engagement, and they share client records, so an assessment gap becomes a risk, a policy and a line in the board report without retyping.

Every tool has a sample of what it makes, for a made-up dental practice and a made-up firm, so you can see the finished work before you sign up.

Win the work

Readiness CheckA short self-assessment that scores a prospect and starts the conversation.Sample: Prospect's readiness report (PDF, 4 pages)
Agreement BuilderNDA, MSA and statements of work from one client record, priced from your catalog, on your own templates.Sample: Statement of work: Security Baseline Assessment (PDF, 2 pages)Sample: Master services agreement (PDF, 3 pages)

Assess

NIST CSF 2.0 AssessmentCurrent and target scores, risks and evidence, with the report and board deck.Sample: NIST CSF 2.0 risk assessment report (PDF, 25 pages)Sample: Board deck (PDF, 9 pages)
CISA CPG BaselineA baseline against CISA's Cybersecurity Performance Goals 2.0, with roadmap, report and board deck.Sample: Security baseline assessment report (PDF, 29 pages)Sample: Board deck (PDF, 8 pages)
Insurance ReadinessThe questions cyber insurers ask, answered with dated evidence, a fix-before-applying plan and a summary for the broker.Sample: Cyber insurance readiness report (PDF, 4 pages)Sample: Broker controls summary with evidence schedule (PDF, 6 pages)
Audit ReadinessMaps an assessment to SOC 2, ISO 27001, HIPAA, PCI DSS, NIST SP 800-53, NIST SP 800-171 and CMMC Levels 1 and 2, and tracks the auditor's evidence requests.Sample: Audit readiness report (HIPAA and PCI DSS) (PDF, 4 pages)Sample: One-page compliance dashboard (PDF, 1 page)
HIPAA Security Rule AssessmentEvery Security Rule standard and implementation specification with NIST's guidance, the documented decision for each addressable one, and a risk-ranked remediation plan.Sample: HIPAA Security Rule assessment report (PDF, 10 pages)Sample: One-page owner summary (PDF, 1 page)
Reassessment ComparisonThe earlier and current assessment side by side: maturity then and now, gaps closed, risks closed and new, and a one-page board summary.Sample: Reassessment report: what changed (PDF, 6 pages)Sample: One-page board summary (PDF, 1 page)
Asset InventoryThe security view of a client's systems: criticality, data and exposure, from their existing inventory.Sample: Asset inventory summary (PDF, 2 pages)

Deliver

Risk RegisterRated, owned, dated and decided. Imports assessment gaps and tracks scan and penetration test findings to a fix.Sample: Risk register report (PDF, 3 pages)Sample: Vulnerability findings and remediation plan (PDF, 2 pages)
Board ReportTwo pages for owners or a board: status, top risks, trend and the decisions needed.Sample: Quarterly security report to the owners (PDF, 3 pages)
Vendor Risk ReviewVendors sorted into tiers, with questionnaires, findings and review dates.Sample: Vendor risk report (PDF, 3 pages)Sample: Security questionnaire sent to a vendor (PDF, 2 pages)
Documentation GeneratorStarter policies, templates and evidence requests from a saved assessment, mapped to requirements.Sample: Information Security Policy (starter draft from the package) (PDF, 2 pages)Sample: Incident Response Plan (starter draft from the package) (PDF, 2 pages)
Document RegisterEvery governed document in one place: owner, version, approval, next review and acknowledgments.Sample: Document register report (PDF, 4 pages)
Client Portfolio, Firm Dashboard and Engagement CalendarEvery client side by side, every deliverable's due date in green, yellow, red or black by consultant with a firm calendar, and what's due and delivered in each phase of the engagement.Sample: Portfolio summary (PDF, 1 page)Sample: Firm dashboard and calendar (PDF, 3 pages)Sample: Delivery report: engagement to date and the next 90 days (PDF, 2 pages)

Security playbooks

Enterprise Playbook BuilderAn incident response plan for business clients: who to call, what to isolate, who communicates.Sample: Incident response plan (PDF, 14 pages)
Incident LogRun and record a client's incident by phase, save it as a file as you go, and hand the customer a clear incident report.Sample: Customer incident report (PDF, 5 pages)
Tabletop Exercise BuilderPlan and run a tabletop, then produce the after-action report.Sample: After-action report and improvement plan (PDF, 2 pages)Sample: Facilitator script for the day (PDF, 7 pages)
Personal Playbook BuilderLarge-print security playbooks for individual and family clients, including the owners and staff of your business clients.Sample: Large-print personal security playbook (PDF, 12 pages)Sample: Plain-language service agreement (PDF, 3 pages)

Your firm

Brand SetupYour firm's name, contact details, colors and logo, entered once and used on every report and deck.Sample: Branding settings and preview (PDF, 2 pages)
Service CatalogYour own services, prices and scope, each mapped to the tools that deliver it. Prices your statements of work and gives each client a work plan.Sample: Service menu (PDF, 2 pages)

MansioSec is not affiliated with or endorsed by NIST, CISA or any standards body. Assessments are self-checks to guide the work, not audits or certifications.

One assessment, mapped to the frameworks your clients are asked about

Assess once against NIST CSF 2.0 or CISA's CPG 2.0, then show a client where they stand on the framework their insurer, customer or contract names. Every mapping says where it comes from.

Official mappings

NIST SP 800-53 Rev. 5 and NIST SP 800-171 Rev. 3, using NIST's own published CSF 2.0 mappings. The assessments themselves follow NIST CSF 2.0 and CISA CPG 2.0 as published.

Derived from official mappings

CMMC Level 1 and CMMC Level 2 (SP 800-171 Rev. 2), linked through NIST's own Rev. 2 to Rev. 3 and SP 800-53 mappings; it shows readiness from the assessment, not a CMMC assessment or SPRS score. The HIPAA Security Rule, by its 22 standards, from the HHS Office for Civil Rights crosswalk to the NIST CSF, carried to CSF 2.0 with NIST's references. HIPAA also has its own full assessment: every Security Rule standard and implementation specification, with NIST SP 800-66 Rev. 2's guidance.

Our own mapping, labeled as ours

SOC 2, ISO 27001 and PCI DSS. Their official mappings are licensed, so ours is clearly marked, with links to the official documents.

Mappings guide the work; they are not audits or certifications. NIST, CISA and HHS do not endorse MansioSec.

Free tools for your website, in your name

Bring a web address and a home page. MansioSec gives you the rest of a practice, including the free tools that bring prospects to you.

Security Readiness CheckA 5-minute self-assessment that scores a prospect's business and gives them a report, with their results sent to you.
Cyber insurance quick check"Would we pass a cyber insurance application?" The questions insurers ask, in plain language, with the fixes that matter most.
Incident TimelineA clean, timestamped record for a client who's in the middle of an incident, ready to hand to you.
Office checkup and scam drillFamily Security Playbook's Small Office Security Checkup and 15-minute staff drill, for the small offices you serve.

Each one carries your name, colors, logo and phone number, and when a visitor sends their results, they come to you. Copy an embed code into a page of your site (WordPress, Squarespace, Wix or plain HTML) or share the link. They work only on your own website, so nobody else can show them as theirs, and nothing a visitor types is kept by MansioSec.

Free for professionals

Incident Timeline

A free, light version of MansioSec's Incident Log for the next incident you work: timestamped entries by phase, actions, and every notification with its deadline and reference number. Save it as a file, export the timeline as CSV, or print it. It runs in your browser, and nothing you type is sent anywhere.

No checklists or hand-holding. When you want the full response (checklist by incident type, evidence hashes, indicators, decisions and a branded customer report), the same file opens in the Incident Log.

Open the Incident Timeline

See a sample printout (PDF)

Also from JCady LLC

Family Security Playbook, for families and small organizations

Your clients' families, churches, nonprofits, HOA boards and small offices need a plan too, but not a NIST assessment. Family Security Playbook is JCady LLC's separate package built for them, and it works alongside MansioSec.

  • Family Security Playbook: a large-print plan for a household: who to call, what to do when a scam call comes, and how to report it
  • Small Office Security Playbook: who decides, who to call, the money rules everyone follows, and what to do about a fake invoice, a hacked email or locked files
  • Free tools to share: a scam quiz, a practice scam call, an office checkup, an office drill, a security calendar and the "Write down what happened" incident record, a step-by-step record a client fills in after a scam to bring to the bank and the police. All with your firm's name and phone, and the record opens straight into the Incident Log.

With a Family Security Playbook partner plan, you give the people you serve playbook codes from your organization page, branded with your firm. They build their own plan; you stay the one they call when something goes wrong.

For small organizationsFor families

How it works

Built by a security practitioner, the way a security practitioner would want it.

  1. Sign in with your own loginEvery person on your team has their own sign-in, with a required second step (an authenticator app, passkey or security key). No shared passwords.
  2. Client data stays with your firmThe tools run in your browser. Client data stays in your browser and the files you save on your computer, or, in the encrypted workspace (beta), is encrypted in your browser before it's saved, so only your firm can read it, not MansioSec.
  3. Your brand on every pageReports, decks, policies and playbooks carry your firm's name, logo and colors, not ours.
  4. Add your teamOwners add and remove their own staff on the Team page, within the firm's seats.
A mansio was a way station on a Roman road: a place to check in, resupply, and get back on the route.

Why we built it

MansioSec started inside a working vCISO practice. Software for professional client reports cost far more than a small practice or its clients could carry, so we built our own, and it has been used on real client engagements since.

Now it's ready for other practitioners: new vCISOs who need repeatable, professional deliverables from day one, and small firms that want to serve the businesses the big providers pass over.

Now open

Founding members

We're opening MansioSec to a small group of founding members: practitioners who want professional tools now and a say in what comes next.

  • Every tool, including new ones as they're added
  • A direct line to the people building it
  • Founding-member pricing: 50% off your first 12 months with code FOUNDING50, for the first 10 new customers

Plans start at $79 a month. Choose one, or tell us a little about your practice and we'll set up a walkthrough.

See plans and pricingEmail us

Or call (520) 223-9878 ext. 800.

Want to try it first? Start a 7-day free trial.