packets.build
Book Demo

Resilience Elevator

Resilient by default, one level at a time.

We take you up, one level at a time. You get resilient without building a compliance team first.

Get a quote for your level See the three levels

Managed, run for you · Priced by level · Billed quarterly

The thought behind it

Built in levels, not badges

  1. 01

    Resilience is built in levels.

    A team of ten and a team of five hundred need different controls, so each level is defined by the controls in place, not by a badge on a wall.

  2. 02

    Start with what prevents the most common losses.

    L1 is that baseline, small enough to reach within three months.

  3. 03

    The right path has to be the easy path.

    Autonomous agents collect and check. A Forward Deployed Expert does what needs a person. People take the easy road, so we make it the safe one.

  4. 04

    Proof has to be live.

    A continuous attestation shows your controls as they are today, reviewed by an independent assessor, not as they were on audit day.

  5. 05

    Going up is a choice.

    You move to L2 and L3 when your growth, your customers or your regulators ask for it, and not before.

The three levels

Start on the ground floor. Go up when you need to.

The Resilience Elevator has three levels, L1, L2 and L3, and each is defined by the controls in place. Start on the ground floor. Each level adds to the one below it.

L1Baseline

The baseline customers and regulators keep asking for

What customers and regulators ask for first

Time to reach it
Within 3 months of onboarding

You are likely here if

  • Your first big customer just sent a security questionnaire
  • Nobody owns security yet, or it is a side job
  • Policies live in scattered docs, or nowhere

What we put in place

  • A named security owner, a risk list and short, approved policies
  • Two-step sign-in, same-day leaver removal, admin reviews
  • Device encryption, updates and remote wipe
  • Backups with tested restores and an incident plan
  • Evidence collected per control on a schedule

L1 covers 10 areas, each checked against evidence from your own systems

  1. 01Access and identityOnly the right people get in, and only for as long as they should.Two-step sign-in on email, code, cloud and admin tools · Leavers lose access the same day · Admin access reviewed on a schedule
  2. 02AwarenessPeople know what to watch for and how to raise a flag.Training at joining and every year · One-step reporting of suspicious messages · A second check before payment details change
  3. 03DevicesEvery laptop and phone that touches work is known and protected.A list of devices and who has them · Encryption, screen lock and updates enforced · Remote lock or wipe when one is lost
  4. 04Data and privacyYou know where personal data lives and how it is handled.A map of the data you hold · Encryption at rest and in transit · Steps for access, deletion and breach notification
  5. 05SuppliersThe companies you depend on are listed, owned and checked.A supplier list with an owner for each · A security check and a data agreement for critical suppliers
  6. 06Incidents and recoveryWhen something goes wrong, you know who acts and how you recover.Scheduled backups with a recorded restore test · An incident plan with contacts · Alerts that reach a named person
  7. 07Change and releasesWhat you ship is reviewed and scanned before it reaches customers.A second person reviews code · Secret and dependency scanning · A penetration test
  8. 08EvidenceEvery control has proof from your own systems, on a schedule.Evidence collected for each control · A written scope of what is covered
  9. 09AI governanceAI tools are in use on purpose, with clear limits.A list of the AI tools in use · A rule on what data may go into them
  10. 10Ownership and riskSomeone owns security, and the risks are written down.A named security owner · A risk list and a system list · Short, dated, approved policies

You end withA live L1 attestation shared through your trust portal

L2Assured

Proof that holds up in enterprise procurement

Proof that survives enterprise procurement

Time to reach it
Set together at scoping

You are likely here if

  • You sell to larger or regulated customers with deep vendor reviews
  • Security questionnaires now take weeks, not days
  • A certification is likely in the next year, but not today

What we put in place

  • Formal risk assessment with treatment plans owned by name
  • Vendor and third-party risk management for critical suppliers
  • Evidence collected automatically from your connected tools
  • Tested incident response and recovery, with records
  • Controls mapped so ISO 27001 or SOC 2 is a side road, not a rebuild

Adds to L1

Risk assessment / Vendor risk / Automated evidence / Recovery drills / Framework mapping

You end withAn L2 attestation and a trust portal your buyers can check

L3Resilient

Resilient by default, across every framework you answer to

Multi-framework, audit-ready all year

Time to reach it
Set together at scoping

You are likely here if

  • You answer to several frameworks, regions or regulators at once
  • You build or ship AI and customers ask how it is governed
  • Your board, investors or largest customers expect regular reporting

What we put in place

  • One control set mapped across ISO 27001, SOC 2, ISO 42001 and GDPR
  • AI governance for every AI system you build, deploy or use
  • Internal audit cycle with findings tracked to remediation
  • Continuous monitoring through integrations and automated checks
  • Board- and customer-ready compliance reporting

Adds to L2

Multi-framework mapping / AI governance / Internal audit / Continuous monitoring / Reporting

You end withAn L3 attestation, with any certification a short step away

Every level

Every level comes with the same crew

Managed, run for you. You do not need a compliance team first.

  • 01packets platformSet up and run by us.
  • 02A dedicated Compliance ExpertAccountable for your program at every level.
  • 03A Forward Deployed EngineerWorking inside your tools.
  • 04Independent attestationAt each level, reviewed by an independent assessor.
  • 05A live trust portalTo share with customers.

How it works

From your tools to an attested level

  1. 001

    Connect your tools

    Our autonomous agents read your cloud, code, identity and device tools, compare them with the controls for your level, collect the evidence and find the gaps.

    Your tools. One control tower.

  2. 002

    Fix the gaps

    A Forward Deployed Expert works with your team to put the controls in place and close the gaps, most important first.

    The gaps. Closed in order.

  3. 003

    Verify

    An independent assessor reviews the evidence. You receive an attestation at your level. It is continuous: it updates when your controls or your evidence change.

    The evidence. Verified.

  4. 004

    Share and keep it

    Show your attestation to customers in the trust portal. Keep your level active by continuing your plan. When you are ready, move to the next level.

    Shared. Kept. Growing.

Proof

Attested, never certified

An attestation is a live representation of your controls, reviewed by an independent assessor. It is not a certificate.

A certificate

One moment

Dated · audit day

Describes where a company stood on the day it was signed.

An Elevator attestation

Live

Live now

An independent assessor reviews your evidence, and it updates as your controls change.

Certifications are side roads you can take from any level, through the Certification Accelerator. Many companies hold both.

Questions

Before you step in

01We’re new to compliance. Where should we start?

Most companies early in the journey start on the Resilience Elevator at L1. It covers what customers and regulators ask for first, without committing you to a certification you may not need yet.

02How long does it take to reach L1?

Within 3 months of your onboarding date.

03Do we need ISO 27001 or SOC 2 to start?

Not for the Resilience Elevator. Certifications are side roads you can take from any level, through the Certification Accelerator.

04What is the difference between an attestation and a certification?

A certification describes where you stood on the day it was signed. An Elevator attestation is live: an independent assessor reviews your evidence and it updates as your controls change. Many companies hold both.

05What happens after L1?

You keep L1 active, and you can choose to move to L2 with us. L3 follows when your growth, your customers or your regulators ask for it.

06Why don’t you publish prices?

Because scope drives cost. A 15-person startup reaching L1 and a 500-person company certifying to three frameworks need very different amounts of work. A quote tells you what you will actually pay.

07How does billing work?

All plans are billed quarterly against the scope in your quote. If your scope changes, for example moving from L1 to L2, we re-quote before anything changes.

08Is the external auditor’s fee included?

Certification bodies and audit firms charge their own fees. Your quote shows clearly what is included and what is billed by the auditor.

Keep exploring

Keep exploring

Start at the level you need today.

Most companies start at L1. We tell you what it takes, how long, and what you will have at the end.

Get a quote for your level Book a demo