CyBehave Themis In development

Policy and standards, from chaos to clarity for everyone.

A policy only protects you if people can follow it. Themis applies CyBehave's behavioural approach to governance - generating your security policies and standards from a human-validated requirement library and writing them to be readable and understandable by everyone, from the board to the front line. Documents people actually comprehend drive real adoption - and behind the plain language sits full rigour: your frameworks harmonised, the most restrictive requirement selected with the evidence to show why, and every clause traced to its source.

Themis - governed policy and standards generation

The scales in action: every requirement weighed across your frameworks - the most restrictive wins, and the rationale is yours to show.

Capabilities

Governance documents your auditors trust and your people understand.

Themis covers the full journey from framework selection to a governed, published document estate - a security charter, policies, standards by focus area, and a TOMs document - with the provenance, harmonisation rationale and lifecycle controls that make independent audit straightforward.

Generate policy & standards

Answer an engaging onboarding wizard - your sector, geography, frameworks, audience and pragmatism level - and Themis drafts a complete, contextualised document set. Standards are created by focus area: network, cloud, applications, DevSecOps, identity and more.

Harmonisation - most restrictive wins

Select NIST CSF, NCSC CAF, ISO 27001, PCI DSS and others together. Themis maps overlapping requirements, compares them as structured values, and selects the strictest - with a visible rationale showing which framework contributed what, and which won. Rank your primary framework and Themis anchors the wording and structure to it, without ever weakening an obligation.

Plain language for every audience

Documents are created first and foremost to be readable and usable by your colleagues - simple and to the point, because that is what makes them effective. The same validated requirements are rendered at three registers - board, practitioner and all-staff - with a meaning check ensuring simplification never becomes weakening. Policy that people comprehend is policy that gets followed.

A human-validated library - no hallucinations

Themis never lets AI invent a requirement. Every entry in the library was extracted by AI, then approved by a named human reviewer against the source text. Every generated sentence traces to a validated requirement with clause-level provenance.

Documents plus a requirements register

Branded DOCX output with full document control, classification markings and change history - and a linked XLSX register: one row per requirement with sources, crosswalk and harmonisation rationale. The compliance mapping matrix your auditor asks for, produced automatically.

Full lifecycle governance

Versioning with requirement-level diffs, approval workflows, publication as v1.0, review scheduling, attestation tracking, an exceptions register with justification and risk ownership, and an append-only audit trail across everything.

The Scales

One requirement set, however many frameworks you carry.

Most organisations answer to more than one authority - a primary framework, a contractual standard, sector regulation and national law all at once. Themis weighs them together, requirement by requirement, and resolves them into a single working set you can defend.

⚖️

Most restrictive wins

Requirements are compared as structured values - retention periods, review frequencies, authentication strength - and the strictest always prevails, whichever framework it came from.

📋

Visible rationale

Every resolved requirement carries its derivation: contributing frameworks and clauses, the values compared, the winner and why - shown in the app and exported in the XLSX register.

🏆

Primary framework anchoring

Rank your frameworks and Themis anchors wording and document structure to your primary - CSF-shaped documents for a CSF house - while stricter values from any framework still win.

🛡

Deviations, governed

Choose a less restrictive position where you have grounds, and Themis records it as a formal exception with justification, a risk owner and an expiry - never a silent weakening.

🔗

Crosswalk built in

The requirements register doubles as a compliance mapping matrix - requirement to policy clause to every framework clause it satisfies - the artefact multi-framework audits demand.

🧩

Contracts too

Client security schedules and contractual requirements can join the weighing alongside formal frameworks, so your obligations to customers are harmonised with everything else.

Document Architecture

A governed hierarchy, not loose documents.

Manage your whole policy suite - from charter to policy, through technical policies and standards, to TOMs - as one coherent, traceable estate. Each tier references the one above, and each requirement is carried consistently across tiers: when a requirement changes, everything that carries it is flagged together, so your documents can never quietly drift apart.

Tier 0 · optional

Security charter

The board-level mandate: intent, scope, governance and accountable ownership. Short, authoritative, requirement-free.

Tier 1

Policies

The what and the why per domain, carrying harmonised requirements at principle level.

Tier 2

Standards

The exactly-what by focus area - network, cloud, DevSecOps and more - where the specific values live.

Alongside

TOMs

A GDPR Article 32 Technical and Organisational Measures document, generated from the same validated set - with a redacted variant safe to share with clients and processors.

From Focus to Published

Pick a focus. Publish a standard.

The everyday loop is fast: choose the focus area you need, get a complete contextualised draft in minutes, refine it with an AI assistant or by hand, and publish v1.0 to your registry through a proper approval workflow.

Step 1

Select a focus

Network, cloud, applications, DevSecOps, identity, supplier security and more - one standard per focus, drawn from your harmonised requirement set.

Step 2

Draft in minutes

A complete draft in your context - your frameworks, your priority order, your audience register, your branding and classification.

Step 3

Refine your way

Work with the AI assistant in plain conversation or edit manually. Every AI proposal is a governed change you approve - it can tailor and rephrase, but it can never invent a requirement.

Step 4

Approve & publish

Through your approval workflow and into the registry as v1.0 - an immutable, fully attributed snapshot, with attestation and review scheduling from day one.

The Registry

One central registry. Every document, through its whole lifecycle.

The policy registry is the heart of Themis - the central registry where every document lives through its whole lifecycle: drafted, approved, published, reviewed, revised and retired in one governed place. It is the screen a CISO opens before an audit and an author opens every morning - every document across every tier, its status, owner, version, review date and attestation coverage.

Everything in one hierarchy

Charter, policies, standards and TOMs shown as the connected estate they are - with overdue reviews and expiring exceptions surfaced before they become findings.

Your history, preserved

Import pre-Themis policy versions to establish full lineage - clearly badged as legacy, carried in the change history, and kept for audit continuity.

Audit-ready on demand

One-click export of the full document control index, plus requirement-level diffs between any two versions - the questions auditors ask, answered before they ask them.

Impact-assess new requirements

A new regulation, framework version or client schedule lands? Assess it against your published estate to see where you already comply - and where the gaps and weaknesses are - before anyone asks.

Built the CyBehave way: language linting flags punitive, blame-laden phrasing and suggests just-culture alternatives, and requirements carry behavioural adoption tags - because a policy only protects you if real people can follow it, and auditors increasingly check exactly that.

Trust & Auditability

Built for the people who get audited.

Themis is a governance product, so it is governed like one - provenance on every clause, an evidence trail on every change, and strict separation between organisations.

Provenance on every clause

Every requirement in every document traces to a human-validated library entry, its source framework, clause and validation record. Org-specific additions are clearly marked as yours - nothing masquerades as a framework obligation.

An evidence-grade audit trail

Every change - human or AI-assisted - is recorded in an append-only, cryptographically chained audit log, with approvals, e-signatures and attestations alongside. AI-proposed changes are always attributed and always accepted by a person.

Strict client separation

Each organisation's documents, tailoring, exceptions and history are isolated per tenant. The shared, validated requirement library is common to all - your governance decisions are yours alone.

Data is encrypted in transit and at rest, and you can export or delete your organisation's data on request. Intellectual property is respected throughout - licensed framework text is never republished, and gated frameworks unlock only against your own licence attestation.