Your programme,steered live.
Assess, decide, deliver, steer and prove: a security programme from the first assessment to the board pack, in one system, inside your network.
Most security programmes run on five tools: one to assess, one to decide, one to plan, one for the money and one for the board. Works runs all five in one record.
We built it because we needed it. Programme decisions were being made from artefacts that took a fortnight to assemble.
- Assess
- Decide
- Deliver
- Steer
- Prove
Capture where you are.
Start with the current state, such as a framework self-assessment, and see what you've got: every outcome scored against its target, with the evidence attached.
Make the scoping calls, on the record.
Triage the findings into remediate, accept or challenge, and score the work against agreed weightings. The decisions and the reasons are recorded; a proposed change shows its consequences before anyone accepts it.
Plan the work.
The Gantt, the steps, the risks and the benefits in one plan. The baseline moves only through logged change, so the history reads as decisions rather than drift.
See what's drifting before the board does.
Budget against spend, the forecast against contingency, and the schedule and benefits that are slipping, reconciled to finance and flagged as they move.
Produce the board pack, with evidence behind every line.
Generated from live data on the morning of the meeting. Every figure links back to the assessment, the decision or the ledger entry it came from.
Same numbers. Zero curation.
The pack on the wall was generated that morning from the system the team steers by. The board reads the picture the team works from.
Changes wait for a decision, and the framework is part of the plan.
Changes to scope, schedule and baseline can be held for approval, with their consequences shown first, so the history reads as decisions rather than drift. The assessment, the scope, the money and the board pack are one record, not a spreadsheet beside each other.
We run our engagements on Works. You can host it yourself.
Outside The Box uses Works to deliver its consulting engagements, and customers can run it themselves, self-hosted in their own estate. It is one signed container on your infrastructure: no SaaS, no vendor access, no telemetry to us. Nothing leaves your network unless you switch it on, and backups stay yours.
It is in production today: Works runs UK central government programmes, with the NCSC Cyber Assessment Framework built in.
Licensed per instance, per year.
A licence is a signed file, verified inside the application. There is no licence server and no phone-home. If a licence lapses, your data stays visible, read-only and exportable; nothing is ever deleted by licensing.
What central government runs today: plans, work packages and steps; RAID, benefits and outcomes; baselines and change control with hold-until-approved; the derived business case and actuals against it; board-pack templates; roles, permissions, audit log and single sign-on.
Everything in Deliver, plus framework assessments (CAF, ISO 27001, NIST CSF, DORA, custom), findings and the exposure they add to the business case, re-assessment with the movement report, and the evidence library.
Everything in Assure, plus an API with scoped tokens and tracker integration, a longer support window on older release lines, and white-labelling included.
White-labelling · Advisor, AI over the programme on your own model keys · custom declared statuses and threshold tuning · configurable sign-off chain · configurable change-approval path · extra non-production instances · extended support for an older release line.
Direct from Outside The Box; bundled with an engagement; through consultancy partners, each client on its own instance; or on G-Cloud via a reseller. One non-production instance is included with every production licence.
The price card is being finalised. Ask for it below and we will send it when it is signed off; until then, pricing is agreed per deal.
See your programme live.
Ask anything about Works, ask for the price card, or request a demo. A person replies either way.
Prefer email?hello@outsidethebox.io