Compeas GRC
Controls, policies, risks, incidents and evidence in one platform, with automated tests every day and evidence ready for audit.
See Compeas GRC at work
Automated control tests, policies, risks, incidents, the Cyber Resilience Act, audits and board reporting, shown in the product itself.
Read the transcript
NIS2, ISO 27001, GDPR. Each framework has its own rules, and each one asks for proof. In most companies, that proof is spread across spreadsheets, folders and inboxes.
Compeas GRC brings it together in one place. Every control is mapped across the frameworks, so work done once counts for ISO 27001, NIS2 and GDPR at the same time, including the NIS2 rules of the company’s own country.
Compeas connects to Google Workspace, Microsoft Entra ID and the other systems the company already uses. It brings in staff, devices and the apps they sign in to, and tests the controls automatically every day: two-step verification, encrypted devices, and access that should have ended when someone left. A failing test shows exactly what needs fixing.
A ready-made policy package is written for these frameworks. Policies are adopted with the company’s name and owners filled in, published to staff, and every acknowledgement is tracked.
Risks, suppliers and incidents are managed in the same place. Each incident carries its NIS2 and GDPR reporting deadlines, and the incident team is alerted before each report is due.
For companies that make connected devices or software, Compeas covers the Cyber Resilience Act: every product and version, its vulnerabilities and fix targets, and the reports the Act requires.
Evidence sits with the controls it proves and is flagged before it expires. Auditors review it directly in Compeas, and the board report shows management where the company stands.
Less time proving compliance. More time improving security.
Compeas. Compliance Made Easy.
Platform capabilities
Automated control tests
Connected systems are tested against the controls every day. A failing test shows what needs fixing and who owns it.
- Google Workspace, Microsoft Entra ID and Intune
- Two-step verification, device encryption and leavers
- Remediations with target dates
- Results linked to the controls they test
Six frameworks
Each control is mapped to every framework it supports, so work done once counts for all of them. NIS2 comes in national versions for ten EU countries.
- NIS2
- ISO 27001
- SOC 2
- NIST CSF 2.0
- GDPR
- Cyber Resilience Act
Policy library
A ready-made policy package written for these frameworks, adopted with the organisation’s name and owners filled in.
- Ready-to-go policy templates
- Versions and scheduled reviews
- Distribute across departments
- Acknowledgement tracking
Evidence management
Evidence sits with the controls it proves, counts only once approved and is requested again before it expires.
- Evidence linked to controls and requirements
- Approval before evidence counts
- Renewal requested before expiry
- Evidence requests from auditors
Reminders
Owners are reminded before work falls due, by email, Slack or Microsoft Teams.
- Remediations and risk reviews
- Policy reviews and acknowledgements
- Evidence and contracts about to expire
- Incident and vulnerability report deadlines
Audit and board reporting
Auditors review evidence directly in Compeas, and the board report shows management where the organisation stands.
- Auditor access through Compeas Auditor Tool
- Evidence requests answered in the platform
- Full audit log with export
- Board report for management
Expert support
Compliance specialists support the implementation and the preparation for certification audits.
- Dedicated customer success manager
- Compliance consulting
- Implementation support
- Support in Swedish and English
Single sign-on
Sign-in through the organisation’s existing identity provider, available on request at no extra cost with Microsoft Entra ID or Google Workspace.
- Microsoft Entra ID
- Google Workspace
- Centralised access management
- Access ends with the directory account
EU data residency
Compliance data, evidence and backups are hosted on Ploi Cloud in the EU and stay there.
- Hosted on Ploi Cloud (EU)
- No third-country transfers
- European support team
- Built for GDPR
Report on time, every time
Registers built around the reporting deadlines in NIS2, GDPR and the Cyber Resilience Act. Each one tracks what is due and keeps every report as proof.
Incident register
When an incident is recorded, the deadlines that apply appear at once: NIS2 for the company’s own country, the GDPR breach notification and, for affected products, the Cyber Resilience Act.
- Early warning, notification and final report deadlines
- Alerts before a report falls due
- Files, notes and the full activity history
- A dated register extract saved as evidence
Product register
Every product with digital elements the company places on the EU market: whether the Cyber Resilience Act covers it, its class, where it is sold and how long it is supported.
- Versions and variants, with substantial modifications
- The conformity routes each class allows
- Notified body, EU declaration of conformity and CE marking
- Proof for each product, including an SBOM for each version
Vulnerability register
Each vulnerability is tracked from receipt to advisory. Once it is judged actively exploited, the Cyber Resilience Act’s reporting clocks start on the record.
- CVSS severity from plain-language questions or a pasted vector
- Target times to fix for each severity
- Report drafts in the fields of ENISA’s single reporting platform
- Reports to component maintainers and security advisories
Every supplier and contract in one register
The vendor register keeps each supplier’s contracts, data processing agreements and assurance reports, gives notice before a contract ends and tests every day that nothing has lapsed.
Vendor register
Each supplier with its services, contacts, risk rating and status, from active to terminated. Former suppliers stay on record with their contracts and documents.
- Risk rating from critical to low
- Active, under review, suspended or terminated
- Sub-processors for each vendor
- Where personal data is processed, and how it may leave the EU/EEA
Contracts and documents
Contract start, end and renewal dates for every vendor, with the signed contract and other documents kept beside them.
- Contracts, data processing agreements, SOC 2 reports, ISO certificates and insurance certificates
- A classification on every document; restricted files open only to vendor managers and auditors
- Reminders before a contract ends or comes up for renewal
Vendor tests
Five automated tests check the register every day and link each result to the right ISO 27001 control.
- Every active vendor has a signed contract that has not ended
- Every active vendor has a risk rating
- Critical and high-risk vendors have a current SOC 2 report or ISO certificate
- Processors of personal data have a data processing agreement
- Personal data leaving the EU/EEA has a lawful transfer mechanism
Manage once, comply across frameworks
Most frameworks ask for the same things in different ways. Compeas maps the shared requirements, so one control counts toward every framework it supports.
Access control
Defined, implemented and evidenced once, in one place.
- NIS2
- ISO 27001
- SOC 2
- NIST CSF 2.0
- GDPR
Do the work once. Reuse it everywhere.
Ready to simplify compliance?
Book a walkthrough or start the 14-day free trial.