Independent compliance scoring, priced in EBITDA.
For the companies you own, and the ones you are buying.

Compliance is a cost centre in your accounts.
It is a margin line in ours.

You have ISO 27001. That evidence already answers most of what nine other regimes ask for — and you are paying to produce it again for each of them. Bawin connects to your clouds read-only, resolves every artefact to one canonical control, and shows you every clause it already satisfies. Then it argues against you in the voice of the assessor who will see it, and prices what is still open.

See what you already evidence →Get access

§01

Your compliance tool is on your side. That’s the problem.

And it never tells you what that costs.

INDEPENDENT: We do not sell what we assess.
REPRODUCIBLE: Published weights. Any score recomputable from the edition in force.
SOVEREIGN: UK/EU residency by default. UK regimes served first, not last.
ADVERSARIAL: Every control shows how it fails before how to fix it.

—

Not yet scored

0 / 4 sources connected

AZAWSGHOK

Until real evidence is connected we show no number. A trust product should not default a visitor's first impression to a fabricated reading.

ILLUSTRATIVE

The Bawin Index is not a rating. It is an index of the evidence you have chosen to connect, scored against the clauses that ask for it. It is comparable to your own last reading, not to another company's. Anyone who tells you their compliance number is comparable across companies is selling you a curve they cannot show you.

§02 Map

Evidence once. Answered everywhere.

One canonical control spine sits between your evidence and every regime you operate under. Pick an evidence item and watch it resolve — to a spine control, then out to every clause that accepts it, each carrying its relationship type, its confidence, its source and the date a human last reviewed it.

Those four fields are the whole argument. A mapping without them is an assertion; with them, you can check our work.

See the full coverage matrix →

Evidence item

Resolves to spine control

BWN-03-004

Multi-factor authentication enforced for all interactive access

Every human account with interactive access completes a phishing-resistant second factor, with no standing exclusions.

Freshness half-life 30 days · Crosswalk edition v1.0

Satisfies 7 clauses across 7 frameworks

NIST CSF 2.0PR.AA-03
Users, services and hardware are authenticated
equivalentAuthoritativeNIST OLIRReviewed 2026-07-24
ISO/IEC 27001:2022 + Annex AA.5.17
Authentication information
subsetDerivedNIST OLIR (CSF 2.0 ↔ ISO 27001)Reviewed 2026-07-24
NIST SP 800-53 Rev 5IA-2(1)
Identification and authentication — MFA to privileged accounts
subsetAuthoritativeNIST OSCAL catalogueReviewed 2026-07-24
SOC 2 Trust Services CriteriaCC6.1
Logical access security measures
intersectsBawin reviewBawin analysisReviewed 2026-07-22
PCI DSS v4.0.18.4.2
MFA for all access into the CDE
subsetBawin reviewBawin analysisReviewed 2026-07-22
Cyber Essentials & CE+Access control
User access control theme
intersectsDerivedNCSC scheme requirements (OGL)Reviewed 2026-07-20
NCSC CAF v4B2.c
Privileged user management
intersectsBawin reviewBawin analysisReviewed 2026-07-26

Illustrative. Live resolution runs against your connected evidence.

§03 Challenge

How this fails, before how to fix.

Every control carries both readings — the sympathetic one you present in the room, and the sceptical one that will be tested against it. Argue it down builds the strongest available case that your score is too high. Argue it up ranks what moves it, by hours-to-evidence rather than by control count.

Illustrative. Interact with the cards.

ISO 27001 · A.5.23

Evidence: Azure conditional-access export. Last verified 41 days ago.

Stale

The bear case against your posture

PCI DSS · 8.3 — MFA on CDE access
Three of five admin accounts uncovered. This alone would fail Stage 2 sampling on the first day.
ISO 27001 · A.5.23 — Cloud services
Evidence 41 days old and post-dates a config change. State at sampling date unknown.
DORA · Art. 28 — ICT third-party register
Two suppliers missing residency evidence. Concentration analysis therefore incomplete.

Then it drills you. Pick a framework — the clock starts.

An assessor samples pseudo-randomly, weighted toward what you refresh least. Bawin does the same. It asks for the evidence, times you, scores the response, and logs it. Every drill entry is dated, owned and reviewable.

Audit Drill · Illustrative

The platform samples the way an assessor does. It times you.

Pick a framework. A clause appears. The timer starts.

§04 Ledger

Every open control has a price. Here it is.

Compliance is a gate on your revenue, a drag on your margin and a discount at exit. The Ledger prices all three against what you can actually evidence today.

Cost to closeMODELLED

—

Illustrative: 9 open controls and 296 sample hours-to-evidence. In an account, connected sources produce the hours; the money is your day rates applied to them.

Revenue gatedMODELLED

—

Annual contract value on deals that require a certification you cannot currently evidence. Enter the pipeline in the full Ledger to see it cross-referenced deal by deal.

Value at exitMODELLED

—

EBITDA delta multiplied by the exit multiple you supply. Not a valuation.

Bawin measures the compliance state. You supply the day rate, the contract values and the multiple. We show the arithmetic and you can change every input. A number you cannot recompute is a number someone is using on you.

Open the full Ledger →

Preparing for a sale? Run your own diligence first.

Every open control in the Ledger is something a buyer's assessor will find. Close what you can before they do, and know the number behind what you can't.

See what a buyer would find →

§05 Who this is for

Two doors. The same evidence, read for two different decisions.

Operators

Keep your platform. We argue with it.

Your existing tool collects the evidence and agrees with you. Bawin reads the same evidence read-only, states the case against it, shows which clause the argument lands on, and prices what is still open in the Ledger.

The operator view →

Investors

Mandate the scope, earn the comparison — across a portfolio, or one target before you sign.

Self-selected scope makes cross-company comparison invalid. Impose the same connectors, framework and boundary across the portfolio, and the comparison becomes defensible — inside that cohort, and stated on the artefact.

Enterprise tier · The same mandate that makes a portfolio comparable makes a single acquisition defensible. Before signature, impose the connectors, framework and boundary on the target the way you would across a book — and get a reading that holds up when your IC asks how it was scoped, not just what it says.

The investor view →

§06 Signal

Every regulatory item becomes a question your assessor can now ask you.

The regulatory feed is not a newsletter. It exists to generate tomorrow's challenges against evidence you have already connected.

2h ago
Incident-reporting thresholds clarified for essential-entity sectors.
Your assessor can now askwhich of your services fall inside the clarified thresholds — and you cannot yet answer that from your connected evidence.
Will be challenged
6h ago
New critical-severity class disclosed in a widely-used identity library.
Your assessor can now askwhich of your systems import this library and how long they were exposed — you cannot yet answer that from your connected evidence.
Will be challenged
1d ago
Guidance on documenting AI model provenance has been updated.
Your assessor can now askfor provenance on the models running in production. Your current ISO 42001 evidence does not include that field.
Will be challenged
2d ago
Boundary firewall configuration baseline guidance refreshed.
Your assessor can now askfor your firewall configuration compared against the refreshed baseline — three of your rules currently diverge.
Will be challenged

Illustrative. Live items are drawn from primary sources, each dated and cited.

§07 Access

Five minutes to first signal.

Connect one source, see one real index factor, no sales call. The commitment is on the record: 5 minutes from source connect to first real signal, or write to us and tell us why it took longer.

The index is not a certification, an audit opinion, consulting, or legal advice — stated in full, once, under what the index cannot tell you.

Prefer email? Write to contact@bawin.co.

BWNv2.1UK/EU2026-07-28

MakerMethodologyResidencyEvidence

Compliance is a cost centre in your accounts.It is a margin line in ours.