Pre-launchSpartan Trust is not open yet: nothing here can be bought and there is nothing to sign in to. Early adopters will be invited first.
You are here because someone asked you this
I just got asked “How secure are you?”
Or some version of it. The rest of this page is the answer. The form is one click away when you want a person.
Or one of these, which we hear just as often
Answer it once. Then send a link.
One version of the truth: one assessment and one Passport you release, instead of a different answer in every spreadsheet.
Spartan Trust is built so that you answer one assessment about your own business, and we turn it into a Spartan Business Cybersecurity Passport that you release by name to whoever asks, by a private link. If you choose, at Verified you can publish it at one public address instead. No more spreadsheets filled in from memory. It is not open yet: early adopters will be invited first.
Why you are being asked at all
The customer sending that form is not suspicious of you. Their board, their auditor and their insurer are asking them the same question: which of our suppliers could stop our operations, and can they prove they will not.
So they pass it down the chain, to you and to everyone else they buy from. That is third-party risk management. It is now a condition of doing business with anybody regulated: a hospital, a defence prime, a bank, a government department.
Every one of them writes their own form. Same questions, different order, different words, because each was written from a different framework by a different person. That is why the twentieth still feels like the first.
Nothing about this is personal. The form is their auditor’s question, wearing their letterhead.
How one answer covers all of them
Every one of those forms came from a published framework. So we do not answer forms. We answer the frameworks, and your Passport projects onto whichever one the person asking used.
Here is how much of each we reach today: controls at least one of our questions covers, over controls the framework publishes. Real numbers, gaps included.
| Framework | Controls covered | Who sends it to you |
|---|---|---|
| CMMC 2.0 | 110of110 | United States defence supply chain. Arrives from a prime contractor. |
| CISA SCuBA | 252of266 | US federal secure cloud baselines for Microsoft 365 and Google Workspace. |
| ASD Essential Eight | 119of126 | Australian Signals Directorate. Maturity levels one to three. |
| NIST CSF 2.0 | 99of106 | The frame most insurers and boards have settled on. |
| CyFun | 102of108 | Belgian Centre for Cybersecurity. Common across the EU supply chain. |
| CAN/DGSI 104 | 38of56 | The Canadian small-business standard. Arrives from a public buyer. |
| Across the six frameworks we can measure: | 720of772 |
The gaps are real, so we publish them. A supplier who claims a framework completely has either read it very differently from us or has not counted.
The three we claim and do not measure
- ISO/IEC 27001
- ISO/IEC 42001
- SOC 2
ISO sells the control text, and the AICPA publishes the SOC 2 criteria under terms we have not yet read. We hold no licensed list for these three, so they are claimed and not measured — and a SOC 2 Type II is an auditor’s report, not a certification, whoever holds it.
Behind your Passport there is a Spartan Score, and the Trust Center never shows it. What it shows is a band for each of the ten categories — Strong, Established, Developing, Early — plus how many points were confirmed by reading your environment. A buyer you release your Passport to, and a Managed Trust operator working for you, receive the score as well, with nothing held back: they are accountable for what they do with it. The bands answer their actual question, do you clear their floor. The score lets them sort, filter and watch it move.
How it will work, in three steps
Answer
We connect to nothing.
Questions about your own business, in your own words. We will not touch your systems and will never ask for an administrator account. At the end you will hold a complete Passport: a real score, every category, every recommendation. Not a trial of one.
Declared is free, and permanent.
Send
Released by name.
You will release your Passport to the customer who asked, by name, and every release will be recorded. Private otherwise, and you will be able to withdraw it. That release replaces their form.
Prove
At Verified we connect and check.
You will let us read your Microsoft 365 or Google Workspace tenant. The answers stop being what you told us and start being what we found. Your Passport will carry the count of points confirmed by reading, and you can choose to publish it at one public address instead of releasing it twenty times.
Verified costs 3 units per licensed user, per month.
About these prices
These are the prices we plan to open with. Nothing can be bought yet, and they may change before we open.
A unit is one major unit of your own market’s currency: 99 units is 99 CAD in Canada and 99 EUR in Spain. Nothing is converted and no exchange rate exists, so the currency sign is shown once we know which market you are in.
Paying for three years up front is discounted 15%. Paying month by month carries no discount.
Ask us
One form, at one address. Tell it which doorway you are at and it asks for what that doorway needs, and nothing else. A person reads it and answers you, in the language you wrote in.
What to do next
One thing: tell us you want in. If you would rather talk to a person, that is here too.
Spartan Trust is not open yet. Early adopters are invited first. It is a request, not an account: nothing is created and nothing is bought.