#01
ISO 27001 in 93 Excel sheets ; no status, no owners
Every control is a separate row in different files. Who is responsible? What is the current status? When was the last review? Nobody knows.
Module / CISO
Cybersecurity and compliance in one system.
ISO 27001, DORA, NIS2, NIST CSF 2.0, ISO 22301 and ISO 31000 ; managed from a single dashboard. Maturity model, SDLC with STRIDE, full BCP module, vulnerability and pen-test registers, cross-regulation mapping and Architecture Mapper. For CISOs who want data, not spreadsheets.
Module scope
Six regulations. One engine. Measurable maturity.
The numbers a CISO must report to the board ; collected from one place, always current.
93
ISO 27001 controls
46
NIST CSF categories
42
DORA requirements
42
Cross-reg mappings
7
NIS2 pillars
0-5
Maturity model
CISO challenges
We recognise your daily reality.
We have spoken with hundreds of CISOs. These problems are universal, regardless of industry or organisation size.
#02
DORA and NIS2 in separate folders ; zero cross-references
ICT risk management under DORA overlaps with ISO controls, but in Excel there are no connections. You duplicate work and waste time.
#03
Maturity assessed by gut feel ; no model, no trends
Are you better than last year? In which area? The board asks, and you have no hard data ; only subjective impressions.
#04
Audit approaching and evidence is scattered everywhere
ISO 27001 certification requires collecting dozens of pieces of evidence. You spend weeks searching through emails, shared drives and private inboxes.
#05
Asset register spread across 3 different tools
CMDB in IT, a spreadsheet with critical assets for ISO, a separate list for DORA. None is current, none is reliable.
#06
An ICT incident requires notifications to 3 authorities ; each in a different format
The Polish DPA, the Polish FSA (KNF) and CSIRT each have different forms and deadlines. During an incident there is no time to look up requirements ; and a mistake costs millions.
#07
The board wants a compliance report ; you spend a week collecting data
An executive summary of compliance status takes a week to assemble from various sources. And it is already out of date by the time it reaches the board.
Regulatory modules
Seven modules. One view. Zero duplication.
Each module is fully functional on its own. Together they form a unified information security management system (ISMS).
01 / ISO 27001
ISO 27001 ; 93 controls, 4 themes.
ISO/IEC 27001:2022
Full implementation of ISO/IEC 27001:2022 requirements. Statement of Applicability generated automatically based on selected controls. Certification preparation with an auditor checklist.
- + Annex A ; 93 controls mapped to Annex B
- + Automatic SoA (Statement of Applicability)
- + Internal audit programme with schedule
- + Checklist for preparing for a certification audit
ISO/IEC 27001:2022
ANNEX A ; DOMAIN PROGRESS live
A.5 Information security policies 8/8
A.6 Organisation of information security 6/7
A.8 Asset management 5/10
A.9 Access control 7/14
02 / DORA
DORA ; 42 requirements, 6 pillars.
DORA Regulation
Digital Operational Resilience Act ; ICT risk management, incident reporting, digital resilience testing and ICT third-party risk management. DORA deadlines met.
- + ICT Risk Management Framework (Pillar 1)
- + ICT incident register with severity classification
- + Resilience testing programme (TLPT, pen-test)
- + Central ICT vendor register with risk assessment
DORA Regulation
DORA ; PILLAR STATUS live
ICT Risk Management 85%
Incident Reporting 60%
Resilience Testing 40%
ICT Vendors 70%
03 / NIS2 / UKSC
NIS2 / UKSC ; 7 directive pillars.
NIS2 Directive / UKSC
Network and Information Security Directive 2 ; requirements for essential and important entities. Cybersecurity risk management, supply chain security, incident reporting to CSIRT.
- + ICT risk management (Art. 21 NIS2)
- + Security supply chain ; vendor assessment
- + Incident reporting to CSIRT (24h/72h/1 month)
- + Notifications to the competent national authority
NIS2 Directive / UKSC
UI preview
Full interface preview available in the live demo.
04 / NIST CSF 2.0
NIST CSF 2.0 ; 6 functions, 46 categories.
NIST CSF 2.0
NIST Cybersecurity Framework 2.0 with full coverage of six functions: Govern, Identify, Protect, Detect, Respond, Recover. Each category with maturity assessment and mapping to ISO 27001.
- + Govern ; new NIST CSF 2.0 function with 14 categories
- + Identify, Protect, Detect, Respond, Recover ; full coverage
- + Maturity assessment per category with gap analysis
- + Automatic mapping to ISO 27001 controls and DORA
NIST CSF 2.0
NIST CSF ; FUNCTIONS live
GV ; Govern (14) 75%
ID ; Identify (8) 88%
PR ; Protect (9) 67%
DE ; Detect (5) 60%
RS ; Respond (5) 80%
RC ; Recover (5) 40%
05 / ISO 22301 ; BCP
ISO 22301 ; business continuity.
ISO 22301:2019
Complete Business Continuity Management module with a full lifecycle: from business impact analysis (BIA), through continuity plans and disruption scenarios, to tests and alternate locations.
- + Business Impact Analysis (BIA) with RTO/RPO metrics
- + Business Continuity Plan (BCP) builder with a step-by-step editor
- + Disruption scenarios and occurrence register
- + Testing and exercise programme with results
- + Alternate locations and emergency contact data
- + BCP dashboard with readiness overview
ISO 22301:2019
UI preview
Full interface preview available in the live demo.
06 / ISO 31000
ISO 31000 ; risk management.
ISO 31000:2018
Enterprise Risk Management following ISO 31000. Central risk register, likelihood x impact matrix, key risk indicators (KRI) on the dashboard, board-ready reports.
- + Risk register with categorisation and owners
- + LxI matrix (5x5) with heat map
- + KRI Dashboard ; key risk indicators
- + Executive reports ; ready for a board meeting
ISO 31000:2018
UI preview
Full interface preview available in the live demo.
07 / CMM ; Maturity Model
CMM ; maturity model, 6 levels.
Maturity model
The only element of the platform you will not find in competing products. A 0-5 maturity model for each control, with a roadmap to the next level. Gap analysis, weakness heatmap, priority roadmap.
- + Levels 0-5 with definitions per control
- + Gap analysis ; where you are vs. where you want to be
- + Improvement roadmap with priorities and deadlines
- + Maturity heatmap ; visualisation of the entire ISMS
Maturity model
MATURITY MODEL ; LEVELS 0-5 live
0 ; Non-existent L0
1 ; Initial L1
2 ; Repeatable L2
3 ; Defined L3
4 ; Managed L4
5 ; Optimised L5
Advanced capabilities
The complete CISO toolkit ; not just checklists.
Beyond the regulatory modules, the platform provides specialist tools for operational security management, testing and documentation.
SDLC with STRIDE threat modelling
Secure software development lifecycle. Each SDLC phase includes built-in STRIDE threat modelling ; Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
Vulnerability register (CVE/CVSS)
Central vulnerability register with automatic classification by CVSS. Remediation status tracking, linkage to assets and ISO 27001 controls.
Penetration test register
Plan, commission and track penetration test results. Finding register with prioritisation, remediation status and linkage to the vulnerability register.
Security policy library
Central register of security policies, procedures and standards. Document versioning, periodic review, approval and distribution to staff.
Audit finding management
Register of findings from internal and external audits. Tracking of corrective action status, closure deadlines, owners and evidence of completion.
Evidence management
Central repository for compliance evidence. Linking evidence to controls, requirements and audit findings. Ready for a certification audit.
Three Lines of Defence model
Three Lines of Defence dashboard following the IIA model. Visualisation of control coverage across the operational, supervisory and audit lines with gap identification.
Cross-regulation mapping (42 mappings)
Automatic mapping between regulations: ISO 27001 ; DORA ; NIS2 ; NIST CSF 2.0. 42 ready-made mappings eliminate duplicated work and show real coverage.
Architecture Mapper
Visualisation of IT architecture from a security perspective. Mapping of systems, dependencies, data flows and integration points with per-component risk assessment.
Advantage
One risk register. Multiple regulations at once.
Identify a risk once and see it through the lens of ISO 27001, DORA, NIS2 and NIST CSF 2.0 simultaneously. Cross-regulation mapping with 42 ready-made links eliminates duplication and shows real coverage.
01
Unified Risk View
One ICT risk mapped automatically to ISO controls, DORA requirements, NIS2 pillars and NIST CSF categories without any manual work.
02
Shared Asset Inventory
Assets defined once for CMDB, DORA ICT inventory, ISO Asset Management and Architecture Mapper. Always current, always consistent.
03
Cross-regulation Dashboard
One screen shows compliance status across all applicable regulations. 42 mappings, Three Lines of Defence and a board-ready report with a single click.
Full scope
Everything a CISO needs in one place.
NIST CSF 2.0
46 functions across 5 categories: Govern, Protect, Detect, Respond, Recover
Full BCP module
BIA + RTO/RPO, plans, scenarios, tests, disruptions, locations, contacts
SDLC + STRIDE
6 phases, security gates, threat modelling, SAST/DAST/SCA findings
Vulnerability register
CVE/CVSS tracking, severity, fix status, mapping to assets
Penetration tests
Campaigns, findings, remediation, feed into maturity model
Security policies
Library, versioning, approval workflow, acknowledgment
Audit findings
Major/Minor NC, Observation, Opportunity ; closure workflow
Evidence management
Lifecycle tracking, linking to controls, completeness gauge
3 Lines of Defence
Matrix: operations, compliance/risk, internal audit
Architecture Mapper
Visualisation of system dependencies and data flows
KRI Monitoring
10 templates, alert thresholds, trend tracking, per line of defence
SPR-PF-18 Golden Record
Full Polish FSA (KNF) report in 15 sheets, XLSX import/export
FAQ
Frequently asked questions
It is the CISO's workbench on a single dashboard: information security management system (ISMS), controls, risk, business continuity management (BCM) and cross-regulation, without switching between separate tools.
Yes. Everything runs on a shared data core (processes, systems, vendors, assets), so you do not maintain the same information in multiple places.
For CISOs, security managers and GRC teams responsible for information security and compliance across multiple regulations simultaneously.
One control is mapped to multiple standards (ISO 27001, DORA, NIS2), so you implement once and report across several regimes.
Ready for unified compliance?
Show us your current compliance status and our expert will demonstrate how the CISO Module can structure it in 30 minutes.