Product
One assessment that ends in a plan. One watch that never assumes.
CuraDefend is two connected products: the Protection Assessment, which turns your real practices into a reviewed score, findings, and a sequenced plan — and CuraDefend Monitor, which keeps that plan alive after the report is issued.
01 — Protection Assessment
48 controls. 8 domains. Zero self-grading.
Your team answers each control in plain English, with honest answer choices — from “formal and documented” to “not established” to “unsure.” The assessment adapts to your intake: bring-your-own-device questions only appear if you use personal devices; AI questions only if your staff use AI tools; vendor questions build from your actual vendor list.
Then a CuraDefend reviewer — a person, with their name on the work — examines every answer, asks follow-up questions, verifies evidence where it matters, and approves the maturity level behind each control. The top maturity level can only be assigned when evidence has actually been verified.
The result is an issued report: your Protection Readiness Score, your open findings ranked by likelihood and impact, and a 30/60/90-day plan where critical work always comes first.
A CuraDefend Protection Readiness Score is not a measurement or certification of legal compliance.
| Code | Domain | Weight |
|---|---|---|
| GOV | Governance and Risk Management | 2000% |
| IAM | Identity and Access | 1500% |
| DEV | Devices and Remote Workforce | 1500% |
| REC | Data Protection and Recovery | 1500% |
| WRK | Workforce Security | 1000% |
| VEN | Vendors and Business Associates | 1000% |
| INC | Incident Readiness | 1000% |
| AI | AI and Shadow Technology | 500% |
02 — Evidence, honestly aged
“Verified” is a date, not a permanent state.
Every claim in CuraDefend carries an evidence state, stamped where you can see it. Verification comes from a reviewer looking at the real thing — typically over a screen share, without retaining your files. And every verification carries a review date: when it passes, the stamp turns stale and the work resurfaces. Protection that was true last year isn’t assumed true today.
By design, CuraDefend does not collect patient information and minimizes what it retains: attestations are text descriptions of organizational practices; document retention is disabled by default platform-wide.
03 — CuraDefend Monitor
The report is a photograph. Monitor is the guard shift.
Your plan becomes a queue
Every action from your 30/60/90-day plan becomes a tracked task with an owner, a due date, and — where it matters — required verification before it closes.
Fixes get re-checked
When a reviewer verifies completed work, a reverification schedule starts. MFA that was on in March gets looked at again on schedule — because someone always turns it off in July.
Aging is automatic
Evidence and verified work move from current to review-due to stale on risk-based schedules you can see. Nothing silently stays green.
$249/month after your report is issued. Cancel anytime — your issued reports remain yours.
See the whole thing on one sample.
Harborlight Home Health is our built-in demonstration organization — a realistic 22-person agency with realistic gaps. Its report shows exactly what you’d receive.