Branding

Set the practice's name, colours, logo, contact line, report footer and email signature for everything a client sees, and each partner firm's branding and disclaimer for the assessment reports it issues.

Branding (admins only, under Practice) sets how names and logos appear on what leaves Bedrock GRC. There are two kinds of branding:

• The practice: Foxx Cyber's own branding, used on the board report and its PDF, the client portal, and emails sent from the console.
• Each partner firm: used only on the assessment reports that firm issues. See Issuing an Assessment.

The page opens on the practice. Once partner firms exist, pick one in the selector at the top and choose Switch to edit its branding (or use the firm's Branding link on the Team page). Choose Save branding to keep your changes; the logo has its own Upload. Firms are added on the Team page; see Assigning a Firm.

Identity

• Practice name (required): signs reports and emails, and names the sender ("Jo Smith at Practice name"). For a firm, it is the firm's name on its reports. The practice's name is also one of the words no password may contain; see Password Policy.
• Tagline (optional): sits beside the name on report covers and in email headers.

Colours

• Primary: titles and buttons. Choose one dark enough to read on white.
• Accent: the rule under report covers and on email cards.

Type a hex value (#105e5f or #15f) or use the colour picker. The page previews the result. A value that is not a colour is marked under its field when you save, with the rest of what you typed kept. On the portal and report pages in the browser, the primary colour applies in the light theme, where it contrasts with the page; the accent applies in both themes.

Contact

An email address, phone number and website, shown under the name on reports, in the portal footer and at the foot of emails.

Wording

These two fields are on the practice's branding only:

• Report footer (optional): closes every board report. Write {client} where the client's name should go. Leave it blank for the standard disclaimer: "Prepared by practice for client leadership. This report is advice for your decisions; it is not a certification or a guarantee of security. Confidential."
• Email signature: the lines that follow the sender's name on every email. Without one, emails are signed with the sender's name and the practice name.

Sign-in notice

Also on the practice's branding only, the Sign-in notice is a system use notice shown to everyone above the sign-in form, and on the single sign-on sign-in page, before they sign in. NIST SP 800-171 requirement 3.1.9 asks for one. Leave it blank to show none; a blank line starts a new paragraph. It can be up to 2,000 characters.

Assessment reports

The Disclaimer is printed in full at the end of every assessment report the practice or firm issues. Write {firm} where the name should go, so a partner firm can paste the wording from its own engagement terms. Leave it blank for the standard wording, which says the report is not a certification, attestation, accreditation or authorization of any kind, and not a CMMC certification assessment. The full standard text is on Issuing an Assessment.

Whatever the disclaimer says, every page of an assessment report also carries "Not a certification" in its footer.

Logo

Upload a PNG or JPEG of up to 1 MB, between 16 and 4,000 pixels on each side. A wide logo on a transparent background works best; it prints about 40 points tall on the PDF. Choose Upload to add it. Without a logo, reports show the name. Remove logo takes it off again.

Email status

On the practice's branding, the Email card shows whether email is on and which sending address it uses. Emails go out under the sender's name, and replies go to the sender's own address. See Emailing Clients.

What branding does not change

• A firm's branding never appears on the board report, the client portal or client emails, which always carry the practice's branding.
• The practice's branding never appears on a partner firm's assessment reports.
• The staff console, and the portal's passcode and expired-link screens, use fixed wording. The sign-in page shows the practice's name and the sign-in notice, and nothing else from branding.