GRC & Compliance. ISO 27001, NIS 2, DSGVO, EU AI Act

Frameworks at a glance.

We bring ISO 27001, NIS 2, GDPR, and the EU AI Act together into one consistent program, with shared risks, controls, and evidence.

ISO 27001

ISMS scope · Risk Assessment · Statement of Applicability · Annex A controls · audit preparation.

NIS 2

Scope · Governance · risk management · incident response · supply chain security · notification.

GDPR

Records of processing · DPIA · processors · TOMs · data flow analysis · data subject rights · notification duties.

EU AI Act

Risk classification · use case inventory · transparency · human oversight · conformity assessment.

From baseline assessment to audit-ready operations.

Five phases in which frameworks, risks, controls, evidence, and audit are designed together.

01 · Baseline

Baseline assessment

Clarify frameworks, maturity, gaps, and risks.

02 · Target state

Target state

Define scope, compliance goals, and roadmap.

03 · Measures

Measures

Implement controls, processes, documentation, and technical safeguards.

04 · Evidence

Evidence

Provide risk register, records of processing, Statement of Applicability, and audit trail.

05 · Audit

Audit & operations

Internal audit, certification, and continuous improvement.

For operational delivery, Cybersecurity can be connected as a complement. From the 24/7 SOC to Penetration Testing support.

Explore Cybersecurity →

Typical GRC use cases.

GRC & Compliance helps where legal or contractual requirements need to be made traceable in a structured way.

Use Case 01

Prepare ISO 27001 with structure

Problem: Companies want to pursue ISO 27001 but don’t know which processes, controls, and evidence are missing.
Benefit: Roadmap with Annex A mapping and clear ownership. No surprises before the audit.

Use Case 02

Implement NIS 2 for KRITIS and SMEs

Problem: Tightened requirements for governance, risk management, incident response, and notification.
Benefit: Meet obligations without building a parallel second security system. Aligned to existing structures.

Use Case 03

Demonstrate GDPR compliance

Problem: Records of processing, TOMs, and processor documentation are often incomplete or outdated.
Benefit: Reliable documentation and clear processes, even for inquiries from supervisory authorities.

Use Case 04

Classify AI systems under the EU AI Act

Problem: Companies use AI without knowing which risk class and obligations apply.
Benefit: Use case inventory, risk classification, and governance for high-risk systems.

Governance, Risk & Compliance, set up with structure.