Free trial

Solutions

The platform is the same. What you must prove is not.

A consultancy bills hours and needs margin. A bank answers to its supervisor. A council must comply with the ENS. The case file is the same object; who reads it is what changes.

Start a proof of concept Talk to the team

By sector

Who will ask you, and under which rule

The regulatory framework sets the level of evidence you owe and the deadlines you notify within. The platform ships with those frameworks already loaded.

Banking and insurance

Who supervises it

  • Banco de España (central bank)
  • DGSFP (insurance supervisor)
  • EBA
  • EIOPA

DORA imposes digital operational resilience, incident reporting to strict deadlines and documented management of ICT third-party risk.

Obligations

  • Register of information on ICT providers and their criticality
  • Reporting of major incidents within the deadline
  • Digital operational resilience testing, advanced testing included
  • A documented exit strategy for every critical provider

Applicable frameworks

  • DORA
  • NIS2
  • ISO 27001
  • PCI DSS

Healthcare

Who supervises it

  • AEPD (Spanish Data Protection Agency)
  • CCN-CERT
  • regional authority

Special category data and essential services under NIS2. Evidence for a control is not paperwork: it is what stands between a breach and a fine.

Obligations

  • Impact assessment on health data
  • Continuity of critical clinical services
  • Traceable access control over medical records
  • Risk from suppliers of connected equipment

Applicable frameworks

  • NIS2
  • GDPR
  • ENS
  • ISO 27001

Industry and energy

Who supervises it

  • CNMC (markets regulator)
  • MITECO (energy ministry)
  • INCIBE-CERT

Essential entities under NIS2, with an OT surface that will not take the same testing as IT and a long supply chain behind it.

Obligations

  • Segmentation and control of the IT/OT boundary
  • Vulnerability management without a shutdown window
  • Security across the industrial supply chain
  • Cyber Resilience Act on connected product

Applicable frameworks

  • NIS2
  • IEC 62443
  • CRA
  • ISO 27001

Public sector

Who supervises it

  • CCN-CERT
  • comptroller
  • public audit

The ENS requires systems to be categorised, conformity to be declared and an audit every two years. And everything bought goes through a tender.

Obligations

  • System categorisation and statement of applicability
  • ENS conformity audit every two years
  • Traceability that stands up to public audit
  • Security requirements carried into the tender documents

Applicable frameworks

  • ENS
  • NIS2
  • GDPR
  • ISO 27001

Telecommunications

Who supervises it

  • SETELECO (Spanish telecoms authority)
  • CNMC
  • ENISA

Critical infrastructure with notification duties of its own and a supplier chain that crosses jurisdictions.

Obligations

  • Notification of network security incidents
  • Risk management over equipment suppliers
  • Service continuity and recovery plans
  • Evidence of controls across distributed infrastructure

Applicable frameworks

  • NIS2
  • ISO 27001
  • ISO 22301
  • GDPR

By role

What changes depending on who opens it

The same case file reads differently from security leadership, from a consultancy billing deliveries, or from internal audit.

CISO and security leadership

The problem

They want your security posture on one slide, and you have four tools that do not talk to each other.

What changes

  • Board position report with the source data one click away
  • Risk ranked by business impact, not by technical severity
  • Exceptions with an owner and an expiry date, not a verbal nod
  • One asset inventory for all five disciplines

MSSPs and consultancies

The problem

Every client has their own template, their own format and their own shared folder. The margin goes into the report.

What changes

  • Natively multi-tenant, with strict isolation between clients
  • Full white-label: your brand, your domain, your template
  • A portal per client with electronic signature and finding disputes
  • Reporting time stops eating the margin on the project

Internal audit

The problem

The annual programme lives in a spreadsheet and last year’s evidence is in the inbox of someone who has left.

What changes

  • An annual programme with schedule, scope and owners
  • Working papers and evidence attached to the finding, not to an email
  • Recommendations tracked through to verification
  • A case file that survives an external review years later

Compliance and data protection

The problem

Proving continuous conformity with one annual snapshot is impossible, and the snapshot is taken by hand.

What changes

  • Conformity measured over assessed controls, with the denominator visible
  • Attestation campaigns signed by the control owner
  • Record of processing activities and evidence tied to the control
  • History that lets you prove the state on a date in the past

Proof of concept

Try it on your own audits

We stand up an environment with your real scope, your findings and your frameworks. No cost, no card, no commitment to continue.

Start a proof of concept Talk to the team
  • Dedicated, isolated environment, ready in 48 hours
  • We import your scanner results and your history
  • Technical support for the whole trial