Learn compliance. Get answers.
Start with plain-English compliance basics for MSPs and vCISO teams, then find product help on onboarding, workflows, reporting, and regions.
Learn compliance
Evergreen explainers on the compliance work MSPs and vCISOs deliver, each tied to primary sources.
Compliance 101
- Compliance 101
What is a vCISO?
A plain-English guide to the virtual CISO role: what a vCISO does, how an MSP delivers it, how to decide between a vCISO and a hire, and common mistakes.
- Compliance 101
SOC 2 Type 1 vs Type 2
A plain-English comparison of SOC 2 Type 1 and Type 2 reports: what each covers, why customers ask for them, and how an MSP can prepare clients.
- Compliance 101
ISO 27001 Statement of Applicability
What the ISO 27001 Statement of Applicability is, how it links to risk treatment, how MSPs and vCISOs build one, and the mistakes auditors tend to flag.
- Compliance 101
What is NCA ECC?
A plain-English guide to the Saudi NCA Essential Cybersecurity Controls (ECC-2:2024): who it applies to, how it is structured, and how MSPs support compliance.
- Compliance 101
What is a gap assessment?
A plain-English guide to the cybersecurity gap assessment: what it measures, how current and target profiles work, how MSPs run one, and common mistakes.
- Compliance 101
What is a risk register?
A plain-English guide to the cybersecurity risk register: what it records, why it matters, how MSPs and vCISOs maintain one for clients, and common mistakes.
- Compliance 101
What is control mapping?
What control mapping is, the five relationship types in NIST IR 8477, a worked access review example, published mapping sources and common mistakes.
- Compliance 101
Policies, standards and procedures
How security policies, standards and procedures differ, how they fit together, how MSPs and vCISOs build a document set for clients, and common mistakes.
- Compliance 101
What is Def Stan 05-138?
A plain-English guide to Def Stan 05-138 Issue 4, the UK MOD cyber standard for defence suppliers: Levels 0 to 3, who it applies to, and how DCC fits.
- Compliance 101
What is DEFCON 658?
A plain-English guide to DEFCON 658, the UK MOD cyber flow-down condition: what it does, the public 2017/2022 edition, and how DCC evidences compliance.
Use GetCybr
Onboarding
- Onboarding
Getting started with GetCybr
A practical onboarding overview for MSPs and vCISO teams adopting GetCybr for compliance and cybersecurity delivery.
- Onboarding
Onboarding requirements for new clients
Understand what information and decisions are needed to onboard a new client cleanly into GetCybr.
Workflows
- Workflows
Evidence collection in GetCybr
Understand how to approach evidence collection, what to prepare, and how MSPs should structure repeatable workflows.
- Workflows
MSP workflows in GetCybr
See how MSPs should structure client delivery workflows, standardise operations, and avoid one-off compliance processes.
Compliance
Reporting
Platform
General
Templates & FAQ
Working documents you can adapt, and quick answers to the questions we hear most.
Need a walkthrough?
If you're evaluating GetCybr for your MSP or vCISO practice, we can show the workflows live.