Works

Why it exists

Most security programmes run on five tools: one to assess, one to decide, one to plan, one for the money and one for the board. Works runs all five in one record.

We built it because we needed it. Programme decisions were being made from artefacts that took a fortnight to assemble.Outside The Box · how we work

01Assess
02Decide
03Deliver
04Steer
05Prove
Keep scrolling

01 · Assess

Capture where you are.

Start with the current state, such as a framework self-assessment, and see what you've got: every outcome scored against its target, with the evidence attached.

AssessDecideDeliverSteerProveBaseline v3 · live

Cyber Resilience Programme · Assess · current state · CAF v3.2 · as at 14 Mar 2027

9 of 39 outcomes achieved; B and C are where the gaps are.

Achieved9

Partially achieved18

Not achieved12

Share of outcomes achieved, by objective Source: assessment register

D Minimising impact60%

A Managing risk57%

B Protecting40%

C Detecting events21%

Assessment tree · B4 and C1 Level · target · evidence

NodeLevelTargetEvidence

B4 Identity and access control

B4.a Identity verificationPartially achievedAchieved6

B4.b Device managementNot achievedAchieved2

B4.c Privileged user managementPartially achievedAchieved9

B4.d Access managementNot achievedPartially achieved1

C1 Security monitoring

C1.a Monitoring coverageNot achievedPartially achieved3

C1.b Securing logsPartially achievedAchieved4

02 · Decide

Make the scoping calls, on the record.

Triage the findings into remediate, accept or challenge, and score the work against agreed weightings. The decisions and the reasons are recorded; a proposed change shows its consequences before anyone accepts it.

AssessDecideDeliverSteerProveBaseline v3 · live

Cyber Resilience Programme · Decide · scope · weightings agreed 12 Mar 2027

31 findings triaged into six work packages; one decision is waiting.

Remediate 22Accept, with expiry 6Challenge 3

Risk reduction 40Regulatory 30Benefit 20Cost 10

Work packageBenefitEffortWeighted scoreStatus

WP1 Identity and privileged access968.1In scope

WP5 Backup and recovery737.8In scope

WP2 Security monitoring uplift887.4In scope

WP3 Supplier assurance646.9In scope

WP4 OT network segmentation996.6Decision 0231

WP6 Policy refresh323.1Out of scope

Review proposed change 1 of 1

Nothing changes until you decide. Proposed by J. Okafor, 3 Oct 2027.

Descope WP4 · OT network segmentation

FieldBeforeAfter

ScopeIn scopeOut of scope

Budget£4.80m£3.70m

B4.aPartially achievedNot achieved

B4.bPartially achievedNot achieved

R-07CriticalCritical

Why it is proposed. The OT supplier cannot start before Q2 2028; the money is wanted for monitoring.

Save this changeRejectSkip for now

03 · Deliver

Plan the work.

The Gantt, the steps, the risks and the benefits in one plan. The baseline moves only through logged change, so the history reads as decisions rather than drift.

AssessDecideDeliverSteerProveBaseline v3 · live

Cyber Resilience Programme · Deliver · schedule · baseline v3 · today 5 Oct 2027

Two work packages are on the critical path; one change is approved.

Steps 214 · 61 doneRisks and issues 18 open · 3 risingBenefits 11 trackedDependencies 9

TaskStartEndAprMayJunJulAugSepOctNovDecJanFebMarAprMayJunJulAugSep

1Identity and privileged access1 Apr 2730 Nov 27

1.2Privileged access workstation rollout1 Jul 2730 Nov 27

2Security monitoring uplift1 Jul 2730 Apr 28 CR-014 · +6 wks

3Supplier assurance1 Sep 2728 Feb 28

4OT network segmentation1 Nov 2731 Aug 28

5Backup and recovery exercising1 May 2731 Aug 27

Today

Critical pathIn progressDonePlannedBaseline v3CR-014 approved 3 Jun 2027 · WP2 +6 weeks · reason: SIEM procurement

04 · Steer

See what's drifting before the board does.

Budget against spend, the forecast against contingency, and the schedule and benefits that are slipping, reconciled to finance and flagged as they move.

AssessDecideDeliverSteerProveBaseline v3 · live

Cyber Resilience Programme · Steer · money and drift · reconciled to finance 30 Sep 2027

Three things are drifting; the forecast still lands inside contingency.

WP2 schedule +6 wksMonitoring spend +9% against planBenefit B-3 measurement 3 wks overdue

RecordedForecastBudget £4.80mWith contingency £5.28mIdentityMonitoringSupplier and OTRecorded, apportioned

05 · Prove

Produce the board pack, with evidence behind every line.

Generated from live data on the morning of the meeting. Every figure links back to the assessment, the decision or the ledger entry it came from.

AssessDecideDeliverSteerProveBaseline v3 · live

Cyber Resilience Programme · Prove · board pack · October 2027

Board pack · October 2027

Movement: 14 outcomes achieved, from 9 at baseline.

Generated 09:14 · 5 Oct 2027
every line linked to its evidence

Movement since the March baseline, by principle 10 up · 0 down · 4 unchanged

Not achievedPartially achievedAchieved

A1 Governance

A2 Risk

A3 Assets

A4 Supply chain

B1 Policies

B2 Identity

B3 Data

B4 Systems

B5 Networks

B6 Awareness

C1 Monitoring

C2 Discovery

D1 Response

D2 Lessons

March 2027October 2027Up

The one recommendation

Decision · the boardKeep WP4 in scope. Descoping saves £1.10m and leaves B4.a and B4.b at Not achieved through 2028; R-07 stays Critical.Evidence · assessment 14 Mar · D-0231 · ledger 30 Sep

Since the September pack

B5 Resilient networks moved to Achieved.E-0412 · 3 items
WP2 slipped six weeks under CR-014; the critical path held.CR-014
Forecast at completion £4.95m, inside contingency.Ledger 30 Sep
Benefits landed: 3 of 11; next is recovery time, 48 h to 8 h.B-1 · B-2 · B-5

A bright boardroom: a long table with chairs down both sides, abstract paintings on the walls, and a presentation display at the far end in front of the window

Then it goes to the board

Same numbers. Zero curation.

The pack on the wall was generated that morning from the system the team steers by. The board reads the picture the team works from.

Boardroom image: PrintOnDemandLibrary, Pixabay Content Licence

What it does

Five steps. One record.

Other tools cover part of this chain. Works covers all of it, so each step starts from what the last one produced rather than from a copy of it.

Assess

Capture the current state, such as a framework self-assessment, and see what you've got.

Usually lives in~~A spreadsheet or a GRC tool~~Hands onFindings, with their evidence

Decide

Triage the findings and make the scoping calls. The decisions and the reasons are recorded.

Usually lives in~~Email threads and meeting minutes~~Hands onScoped work packages, and why

Deliver

Plan the work: the Gantt, the steps, the risks and the benefits.

Usually lives in~~A project tool~~Hands onA baselined plan

Steer

See the budget against the spend, and what's drifting, before the board does.

Usually lives in~~A finance spreadsheet~~Hands onThe forecast, and what is slipping

Prove

Produce the board pack, with evidence behind every line.

Usually lives in~~Slides, assembled by hand~~Hands onThe pack, generated on the day

What is different about it

It runs in your estate. One signed container on your infrastructure; no SaaS, no vendor access, nothing leaving your network unless you switch it on.
Nothing changes until you decide. Changes to scope, schedule and baseline can be held for approval, with their consequences shown first.
It is in production. The base edition is the tool UK central government runs its programmes on today.
The framework is part of the plan, not a spreadsheet beside it: the assessment, the scope, the money and the pack are one record.

More on the platform, including how we built it and why: outsidethebox.io/platform

Concrete multi-storey car park at night, lit floor by floor

Self-hosted: one signed container, deployed inside your network, on your infrastructure.

Concrete car park, lit floor by floor · the infrastructure nobody looks at until it fails

Where it runs

In your estate. Nowhere else.

One signed container, inside your network

Self-hosted on your infrastructure. No SaaS, no vendor access. Backups stay yours.

Nothing leaves unless you switch it on

No telemetry to us and no vendor callbacks. Any connection to another system is one you switch on.

Used in production today

Works runs UK central government programmes now, with the NCSC Cyber Assessment Framework built in. It is in development as a licensable product.

How to get it

Licensed per instance, per year.

A licence is a signed file, verified inside the application. There is no licence server and no phone-home. If a licence lapses, your data stays visible, read-only and exportable; nothing is ever deleted by licensing.

DeliverThe base edition

What central government runs today: plans, work packages and steps; RAID, benefits and outcomes; baselines and change control with hold-until-approved; the derived business case and actuals against it; board-pack templates; roles, permissions, audit log and single sign-on.

AssureThe whole chain

Everything in Deliver, plus framework assessments (CAF, ISO 27001, NIST CSF, DORA, custom), findings and the exposure they add to the business case, re-assessment with the movement report, and the evidence library.

EnterpriseLarger or regulated organisations

Everything in Assure, plus an API with scoped tokens and tracker integration, a longer support window on older release lines, and white-labelling included.

Add-ons, any edition

White-labelling · Advisor, AI over the programme on your own model keys · custom declared statuses and threshold tuning · configurable sign-off chain · configurable change-approval path · extra non-production instances · extended support for an older release line.

Channels

Direct from Outside The Box; bundled with an engagement; through consultancy partners, each client on its own instance; or on G-Cloud via a reseller. One non-production instance is included with every production licence.

Prices

The price card is being finalised. Ask for it below and we will send it when it is signed off; until then, pricing is agreed per deal.

Start a conversation

See your programme live.

Ask anything about Works, ask for the price card, or request access to the demo instance. A person replies either way.

Prefer email?hello@outsidethebox.io

Your programme,steered live.

Most security programmes run on five tools: one to assess, one to decide, one to plan, one for the money and one for the board. Works runs all five in one record.

Capture where you are.

9 of 39 outcomes achieved; B and C are where the gaps are.

Make the scoping calls, on the record.

31 findings triaged into six work packages; one decision is waiting.

Plan the work.

Two work packages are on the critical path; one change is approved.

See what's drifting before the board does.

Three things are drifting; the forecast still lands inside contingency.

Produce the board pack, with evidence behind every line.

Movement: 14 outcomes achieved, from 9 at baseline.

Same numbers. Zero curation.

Five steps. One record.

Assess

Decide

Deliver

Steer

Prove

In your estate. Nowhere else.

One signed container, inside your network

Nothing leaves unless you switch it on

Used in production today

Licensed per instance, per year.

See your programme live.

Talk to us

Request demo access