Cybersecurity as a governed process — not a one-off project.

Organisation profile, employees, groups, users, essential services.

• Organisation profile — name, registration and VAT identifiers, address, statutory body, cybersecurity manager, data protection officer; the single source of truth that fills every generated policy and report.
• Onboarding wizard — completes the profile on first run and optionally records the website, email domain and IP ranges, pre-populating the monitoring modules.
• Employees and groups — the people who own assets and attend training, plus user groups.
• Essential services — the junction that links assets, continuity and incidents, and the carrier for the reporting-obligation assessment.
• Users and roles — accounts created with a temporary password and forced change, or invitations for an existing user; membership of several organisations with a switcher.
• Public registration — an organisation can register itself; the record is created suspended and activates only after provider approval.

Asset register, CIA classification, assignment, QR labels, import, agents.

• Governed lifecycle — in stock, assigned, in service, decommissioned — with links to owner, room and essential service.
• CIA classification of confidentiality, integrity and availability plus RTO and RPO recovery parameters — the basis for both risk calculation and continuity planning.
• Handover with proof — assignment to a person carries an eight-character confirmation code, acknowledged publicly from the email without any login.
• QR codes and printed labels generated locally, with no data sent to a third party.
• Bulk import from CSV or XLSX with a template, row-by-row validation, deduplication and a summary report.
• Device agents — a one-way agent reports operating system, antivirus, encryption, backup software and pending updates. The first report creates the asset, marks the controls it detects, and triggers a risk recalculation.

The calculation core — inherent and residual risk, acceptance, expert decisions.

• Methodology as a parameter — scales, weights, control effectiveness coefficients and risk bands belong to the organisation, not to the vendor.
• Inherent risk derived from the highest impact severity and the likelihood of the threat.
• Residual risk accounts for the effectiveness of implemented and planned controls and never exceeds the inherent value; calculated and estimated residual scores are kept distinct.
• Automatic threat assignment by asset type, with risks materialised in the background — idempotently, and respecting manual edits.
• Acceptance and override — the cybersecurity manager may accept or override a final value, always with a mandatory justification written to the professional decision log.
• Above-limit risk beyond a defined band can be configured to require acceptance by the statutory body.

Continuity and disaster recovery plans, testing evidence, impact analysis.

• BCP and DRP plans with a record of every test — result, date, and automatic return to revision when a test fails.
• Backup strategies with verification that the backups are actually restorable.
• RTO and RPO overview across all assets in one view.
• Business impact analysis with scaled impacts per process.

Structured readiness questionnaire tied to specific legal provisions.

• Questions bound to the law — each item references the section of the act or decree it verifies.
• Readiness percentage overall and per area, with non-applicable questions excluded from the calculation rather than scored as failures.
• Identified gaps listed as concrete findings, not as a score alone.
• Direct remediation — where a required policy is missing, the analysis offers to generate it from the template immediately.

Security documentation produced from live data — without manual drafting.

• 19 policy templates (SM-01 to SM-19) — from the security policy through asset, risk, access and supplier management to backup, incident handling and effectiveness review.
• Live content — organisation data is inserted automatically and tables are generated from real records: assets, risks, continuity, backups, incidents, vulnerabilities, obligations and suppliers.
• Versions and states — draft, approved, superseded — with an automatic flag when the underlying template changes and the policy becomes outdated.
• PDF export mirrored into the vault. The statutory signature and effective date appear on the document only after actual approval; drafts carry a prominent marking.
• Approval workflow from cybersecurity manager to statutory body.

Encrypted document storage, credentials, qualified signing, crypto-shred.

• Envelope-encrypted files — AES-256-GCM with a per-file key and an organisation key derived through HKDF; files are stored outside the web root.
• Password vault with a built-in strong generator; every credential encrypted separately and per organisation, and never rendered in a list view.
• Reveal on verification — a sensitive value is decrypted only after a one-time code by email or SMS, for a limited time, with a record of who opened it and when.
• Document locking — opening a protected document requires a one-time code.
• Qualified electronic signature of documents via eID chip card in PAdES format.
• Crypto-shred — destroying the key renders the record permanently unreadable, satisfying the right to erasure.
• Approval workflow and per-document access control.

One score, computed from evidence rather than from self-assessment.

• Compliance score calculated continuously from real artefacts — generated policies, implemented controls, approved documents and resolved incidents.
• Live security posture scored 0–100 with an A–E grade, weighting compliance, risks above threshold, vulnerabilities, incidents, education, operational hygiene and backups.
• Catalogue of provisions mapped directly to the decree, so a score can always be traced back to the requirement behind it.

Cyber events, reporting-obligation assessment, submissions to the authorities.

• Event register covering incidents, critical threats, averted events and vulnerabilities, each linked to the affected assets and essential services.
• Reporting-obligation assessment under § 24 — a deterministic rule (event type, affected essential service, severity) combined with an expert assessment that applies the precautionary principle and escalates serious events. The output is a plain-language justification, not technical jargon.
• Tracked statutory deadlines — initial, interim and final reports, counted from the moment of detection.
• Generated submissions — a report for the national cybersecurity authority in the prescribed A–H structure, and a personal data breach notification for the data protection authority within 72 hours, rendered to PDF and mirrored into the vault; a preview is available without saving.
• Irreversible dispatch — the report is sent by email with its attachment, protected against duplicate submission, and the incident is marked as reported.
• Remediation tasks raised from incidents and vulnerabilities close automatically when the underlying finding is resolved.

Vulnerability register, automatic remediation, public threat intelligence.

• Register with CVE identifier, severity and a link to the specific affected asset.
• Automatic response on a severe finding — a remediation task with a deadline is created and the risk of the affected asset is recalculated.
• Public intelligence in-module — the catalogue of vulnerabilities known to be actively exploited, together with advisories from national authorities.

Courses, tests, certificates, completion overview.

• Courses with slides and a test — the system can generate course content for a chosen topic; publication remains exclusively with the provider.
• Assignment to individuals or to all employees at once, with test evaluation by score, a pass threshold and a limited number of attempts.
• PDF certificate with a serial number, issued on successful completion and stored in the vault.
• Completion overview for the whole organisation, while every employee sees their own training without needing any special rights.

Training campaigns that measure real employee resilience.

• Two channels — simulated phishing by email and smishing by SMS, launched from scenarios and templates.
• Masked link and interaction tracking — opening, clicking and submission of the training form are all recorded.
• Nothing sensitive is retained. A password typed into a simulated form is never stored; only the fact that the action occurred.
• Resilience evaluation — open, click and submission rates, with a clear outcome per person: those who clicked failed, those who did not resisted.

Third parties with access to systems and data.

• Third-party register recording criticality, the scope of access granted, and an automatically derived risk score.
• Security questionnaires that a supplier completes publicly through a link, without needing an account.
• Agreed commitments captured with PDF evidence stored in the vault.
• Supply-chain governance structured to the expectations of NIS2.

Recorded expert dialogue between the roles that decide.

• Threaded discussion between the cybersecurity manager, the statutory body and internal IT, with tree-structured replies and explicit states.
• Approved conclusions — the statutory body can formally approve the outcome of a thread.
• Fully audited — every action in a consultation is written to the audit trail, so the reasoning behind a decision survives staff turnover.

Recurring legal duties with a legal basis and a reminder schedule.

• Pre-filled obligations — the statutory duties arrive with their period and legal basis already recorded, rather than being typed in by hand.
• Drift-free recalculation of due dates, so a recurring duty does not slide out of alignment over years.
• Reminders at 30, 7 and 1 day before, on the day itself, and daily after the deadline passes — to the cybersecurity manager and the responsible person.

Planning and evidencing security activities.

• Planned activities — courses, exercises, audits and reviews scheduled ahead of time.
• Status tracking from planned through in progress to completed.
• Linked to deadlines and compliance evidence, so a completed activity counts towards the score rather than sitting in a separate calendar.

Support tickets and a transparent record of system changes.

• Support tickets with priority and status, visible according to the requester's role.
• Changelog giving every organisation a clear view of what changed in each release.

Field service management for the organisation delivering the platform.

• Service cases with a state workflow, assigned to technicians and teams.
• Appointment calendar and deployment map across all served organisations.
• Handover protocols generated to PDF at the close of a case.
• Administrator credentials handled safely — encrypted at rest, released to the technician through a verified one-time code, and never visible to the person who sent them.