Platform Overview

Digital Operational Resilience Act: ICT risk management, incident management, resilience testing, third-party risk.

107 Measures

EU 2022/2555: Scoping assessment, governance, cyber risk management, incident reporting, supply chain.

Minimum requirements for risk management: governance, outsourcing, risk control, internal audit.

ISO/IEC 27001:2022 as international control anchor with 93 Annex A controls and evidence matrix.

12 control objectives for systematic cyber security, aligned with DORA and ISO 27001.

DORA-compliant OSS management: SBOMs, vulnerabilities, patch decisions, supplier requirements.

6 Measures

8 structured playbooks: ICT triage, ransomware, cloud outage, third-party, notification, crisis team, IT outage, supply-chain attack.

9 Human Gates + Decision Log + Governance Dashboard for management, risk acceptance, legal, data protection.

Agent Registry with input/output rules, Human Gates, data classes and review obligations.

10-zone mapping NIS2/DORA/ISO 27001/Cyber Risk with CSV and PDF export.

DORA Art. 11, ISO 22301: BCM policy, BIA, testing, crisis management, evidence.

Audit management: planning, evidence, findings, management review, auditor interaction.

DORA Art. 19: Staged reporting obligation 24h/72h/1M, reporting forms, deadlines, evidence checklist.

CSA CCM v4.0, DORA Art. 11(3): Governance, controls, multi-cloud risk, cloud resilience.

GDPR compliance: data subject rights, processing register Art. 30, GDPR audit.

ISO 27001 A.11: Access control, video & alarm, redundancy, DR site.

ISO 27001 A.9: IAM governance, RBAC, permissions, identity lifecycle (JML).

ITIL, ISO 27001 A.12: Change process, CAB, release management, change audit.

BSI TR-02102, ISO 27001 A.10: Encryption, PKI, key management, HSM.

ISO 27001 A.13: Network segmentation, firewall, VPN, network monitoring, SIEM.

ISO 27001 A.8.12, DORA Art. 9: Data classification, DLP controls, incident response.

Management review generator for DORA, NIS2, Cyber Risk, ISO 27001 and AI Governance with JSON download.

9 digitalization activities × 13 technologies: risk assessment per BSI 200-2/200-3.

API security, OAuth/FAPI, mTLS certificate management for open finance and banking-as-a-service.

RPA and low-code/no-code governance with bot identity management and shadow automation control.

Validated vulnerability workbench with scan/assessment/pentest methodology, resilience priority scoring and OWASP/NIST integration.

DORA Art. 10: Asset-specific SIEM assessment with BSI 200-3, gross/net risk and compensating controls.

6 DORA threat scenarios with decision gates, evidence checklists and interactive simulation.

Translate radar signals into affected frameworks, roles, to-dos and decision log entries automatically.

47 vendor tracking, concentration risk analysis with CSS bars, DORA Art. 28-31 compliance.

468 component inventory, SBOM generator, license/vuln/freshness governance cards.

5-step SDLC pipeline, 8 SDL controls, OWASP Top 10 mapping, DORA Art. 16 compliance.

6 report templates (DORA/NIS2/SIEM/Vuln/Evidence/ICT-TPR) with format badges and export history.

48 audit requirements in 21 control areas. Evidence packs, DORA/MaRisk mapping, SOAR response guides.

9 Human Gates in matrix view, 5 current decisions with status, quick stats.

Air-gap capable code/doc reviewer: OWASP, CSP, PII, DORA control mapping — local, no cloud upload.

Weekly regulatory signals by email. Double opt-in, 7 topics, no tracking.

Central overview with live statistics, compliance score, radar preview and quick actions.

Central object model: 16 requirements × 10 controls × 379 measures networked. JSON export with SHA-256.

Artifact management with SHA-256, classification, review status and retention. No file without manifest.

Continuous monitoring: evidence freshness, overdue reviews, open findings. Traffic light system.

HTML sitemap with 30 groups and 170+ pages. Structured navigation across all modules.

GDPR-compliant data processing agreement per Art. 28 with SCC and sub-processor governance.

All TOM categories per GDPR Art. 32: access, entry, disclosure, input, and availability controls.

Availability, performance, support, and security SLAs with escalation matrix.

Structured contract termination, data return and deletion with transition support.

Dual-gate control framework for artifact procurement, dependency governance, and build security.

Build process controls, artifact integrity, deployment evidence.

Lockfile management, SCA, update governance and risk acceptance.

Central risk register for ICT risks per DORA Art. 5-8 with risk matrix and treatment.

Assessment of ICT third-party providers by security, compliance, availability, support, and innovation.

Compliance reports for DORA, MaRisk, ISO 27001 and NIS2 with templates and export.

Interactive incident response exercises with realistic scenarios, timer and scoring.

Framework comparison: DORA, MaRisk, ISO 27001 and NIS2 — automatically detect gaps.

Business Continuity Management: BIA, risk scenarios, test management and contingency plans.

Practical implementation tool for the 10th MaRisk amendment with gap analysis and action tracking.

Interactive NIS2 compliance check with sector selection, threshold analysis and requirement tracking.

Interactive matrix comparing DORA, MaRisk, ISO 27001, NIS2 and AI Act coverage.

Tailored compliance guides for banks, insurers, payment institutions and ICT providers.

Live monitoring of BaFin, EBA, ESMA, EIOPA and Bundesbank regulatory sources.

Leadership overview: compliance scores, risk register, vendor status, alerts and platform health.

AI-powered compliance scores and prioritized improvement recommendations.

Real-time compliance monitoring with automated metrics from risks, vendors, gaps and alerts.

Integrated live dashboard combining risks, vendors, compliance scores, alerts, and platform health.

Aggregated compliance report with scores, risk summary, vendor overview, alerts and evidence gaps.

CSRD, EU Taxonomy and SFDR compliance tracking with requirements and deadlines.

Regulatory milestones, deadlines and compliance events across all frameworks.

Interactive compliance training modules for DORA, MaRisk, ISO 27001 and NIS2.

Automated vendor risk evaluation with weighted scoring across security, compliance and operations.

Cross-module relationships: how risks connect to measures, evidence and reports.

Tenant model, RBAC matrix, SSO/SAML, SCIM provisioning and MFA overview.

One-click board pack generation with evidence manifest, redaction log and signed exports.

Audit evidence pack with findings tracking, control assessment and integrity verification.

Guided onboarding for CISO, ICT Risk, TPRM, Compliance, Audit and Board roles.

CSV and API import for vendors, contracts, services, regulated activities and identifiers.

Secure NDA-gated document access with watermarking, access logs and expiry tracking.

Complete due diligence document register: DPA, TOM, SLA, subprocessors, backup, retention and more.