Achieve Compliance with Any Framework
Streamline your compliance journey with structured controls, evidence collection, and audit preparation for all major security frameworks.
Supported Frameworks
NIS2
Most PopularMeet NIS2 as your own country has written it into law: the EU requirements every country shares, the national obligations on top, and your country’s incident reporting deadlines.
What's Included:
- National versions for ten countries: Sweden, Denmark, Finland, Germany, Austria, Belgium, the Netherlands, Poland, Italy and Bulgaria
- Risk assessment and management
- Policy Library with ready-to-go templates
- Automated control monitoring
- Evidence collection and management
- Incident register with your country’s reporting deadlines
- Continuous compliance monitoring
ISO 27001
International standard for information security management systems (ISMS).
What's Included:
- ISMS implementation guidance
- Risk assessment streamlining
- Policy Library with ready-to-go templates
- Control effectiveness monitoring
- Internal audit preparation
- Certification audit support
SOC 2
The AICPA audit standard that shows your customers, often in the US, how you protect their data against the Trust Services Criteria.
What's Included:
- Its own control catalogue mapped to the Trust Services Criteria
- Support for both Type 1 and Type 2
- Controls linked to ISO 27001, so the same evidence covers both
- Evidence collection across the whole observation period
- Your auditor follows the work in Compeas Auditor Tool
- The evidence base for the auditor who issues the report
NIST CSF 2.0
Align your cybersecurity programme with the NIST Cybersecurity Framework 2.0 — govern, identify, protect, detect, respond, and recover.
What's Included:
- Governance and risk assessment
- Policy Library with ready-to-go templates
- Asset and supply chain management
- Protective controls monitoring
- Detection and response readiness
- Recovery planning and improvement
GDPR
The EU regulation on how organisations process the personal data of people in the EU.
What's Included:
- The GDPR’s requirements in plain language, with the evidence to keep for each
- Where personal data is processed, and by which vendors and sub-processors
- Automated check that transfers outside the EU/EEA are allowed under the GDPR
- A ready-to-go GDPR policy covering consent, data subject rights, impact assessments and records of processing
- Personal data breaches with the 72-hour notification deadline
- Progress that counts only proof: implemented controls, published policies and approved evidence
Cyber Resilience Act
NewThe EU regulation for manufacturers of hardware and software products with digital elements. Its reporting duties already apply, also to products that are already on the market. Every other requirement applies from 11 December 2027. What the CRA requires.
What's Included:
- Product register with coverage, class, markets and support period
- Vulnerability register with CVSS scoring and target times to fix
- 24-hour, 72-hour and final report deadlines for exploited vulnerabilities and severe incidents
- Report drafts that follow the fields of ENISA’s single reporting platform
- Versions, variants, the conformity record and proof for each product
- Policy templates for vulnerability handling, reporting and support periods
One directive, ten national laws
Compeas GRC carries a national version of NIS2 for each of these countries. Each company follows the law of its own country, with its requirements, registration and reporting deadlines.
| Country | National law | In force since | Incident reports go to |
|---|---|---|---|
| Austria | NISG 2026 (Netz- und Informationssystemsicherheitsgesetz 2026) | 1 October 2026 | CERT.at, Austrian HealthCERT or GovCERT, through NIS2-Services on the USP |
| Belgium | NIS2 Law of 26 April 2024 (Loi NIS2 / NIS2-wet) | 18 October 2024 | The Centre for Cybersecurity Belgium (CCB), through notif.safeonweb.be |
| Bulgaria | Cybersecurity Act (Закон за киберсигурност), amended for NIS2 in 2026 | 17 February 2026 | CERT Bulgaria |
| Denmark | NIS 2 Act (NIS 2-loven, lov nr. 434 af 6. maj 2025) | 1 July 2025 | The NIS2 form on Virk.dk, signed with MitID Erhverv |
| Finland | Cybersecurity Act (Kyberturvallisuuslaki 124/2025) | 8 April 2025 | NCSC-FI’s NIS2 form, which reaches both the supervisor and the CSIRT |
| Germany | BSI Act (BSIG), recast by the NIS-2 Implementation Act (NIS2UmsuCG) | 6 December 2025 | The BSI, through the BSI portal |
| Italy | NIS Decree (D.Lgs. 138/2024) | 16 October 2024 | CSIRT Italia, through ACN’s Services Portal |
| Netherlands | Cybersecurity Act (Cyberbeveiligingswet, Cbw) | 15 August 2026 | NCSC or the sector CSIRT, through MijnNCSC |
| Poland | National Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC), amended for NIS2 | 3 April 2026 | The CSIRT named in the entity’s Wykaz KSC entry, through the S46 system |
| Sweden | Cybersecurity Act (Cybersäkerhetslag 2025:1506) | 15 January 2026 | NCSC at FRA, through its cyber portal |
Every national version keeps NIS2’s reporting clock: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Some countries differ: Sweden and Finland count from when the incident is identified as significant, Poland’s reporting duty applies from 3 April 2027 (earlier for former operators of essential services), and Italy’s nine months after ACN’s notice that a company is included.
Built from each country’s official legal texts, as of October 2026.
Manage once, comply across frameworks
Most frameworks ask for the same things in different ways. Compeas maps the shared requirements — so one control contributes to every framework it satisfies.
Access control
Defined, implemented and evidenced once — in one place.
- NIS2
- ISO 27001
- SOC 2
- NIST CSF 2.0
- GDPR
Do the work once. Reuse it everywhere.
Start Your Compliance Journey Today
Get expert guidance and streamlined tools to achieve compliance faster