Frameworks

Achieve Compliance with Any Framework

Streamline your compliance journey with structured controls, evidence collection, and audit preparation for all major security frameworks.

Supported Frameworks

NIS2

Most Popular

Meet NIS2 as your own country has written it into law: the EU requirements every country shares, the national obligations on top, and your country’s incident reporting deadlines.

What's Included:

  • National versions for ten countries: Sweden, Denmark, Finland, Germany, Austria, Belgium, the Netherlands, Poland, Italy and Bulgaria
  • Risk assessment and management
  • Policy Library with ready-to-go templates
  • Automated control monitoring
  • Evidence collection and management
  • Incident register with your country’s reporting deadlines
  • Continuous compliance monitoring
Timeline: 3-6 months to full compliance

ISO 27001

International standard for information security management systems (ISMS).

What's Included:

  • ISMS implementation guidance
  • Risk assessment streamlining
  • Policy Library with ready-to-go templates
  • Control effectiveness monitoring
  • Internal audit preparation
  • Certification audit support
Timeline: 6-9 months to full compliance

SOC 2

New

The AICPA audit standard that shows your customers, often in the US, how you protect their data against the Trust Services Criteria.

What's Included:

  • Its own control catalogue mapped to the Trust Services Criteria
  • Support for both Type 1 and Type 2
  • Controls linked to ISO 27001, so the same evidence covers both
  • Evidence collection across the whole observation period
  • Your auditor follows the work in Compeas Auditor Tool
  • The evidence base for the auditor who issues the report
Timeline: Type 1 covers a point in time, Type 2 an observation period of typically 3–12 months

NIST CSF 2.0

Align your cybersecurity programme with the NIST Cybersecurity Framework 2.0 — govern, identify, protect, detect, respond, and recover.

What's Included:

  • Governance and risk assessment
  • Policy Library with ready-to-go templates
  • Asset and supply chain management
  • Protective controls monitoring
  • Detection and response readiness
  • Recovery planning and improvement
Timeline: 3-6 months to full implementation

GDPR

European data protection regulation for handling personal data of EU residents.

What's Included:

  • Data mapping and inventory
  • Policy Library with ready-to-go templates
  • Privacy impact assessments
  • Consent management
  • Data subject rights management
  • Breach detection and reporting
Timeline: 3-6 months to full compliance
NIS2 by country

One directive, ten national laws

Compeas GRC carries a national version of NIS2 for each of these countries. Each company follows the law of its own country, with its requirements, registration and reporting deadlines.

CountryNational lawIn force sinceIncident reports go to
AustriaNISG 2026 (Netz- und Informationssystemsicherheitsgesetz 2026)1 October 2026CERT.at, Austrian HealthCERT or GovCERT, through NIS2-Services on the USP
BelgiumNIS2 Law of 26 April 2024 (Loi NIS2 / NIS2-wet)18 October 2024The Centre for Cybersecurity Belgium (CCB), through notif.safeonweb.be
BulgariaCybersecurity Act (Закон за киберсигурност), amended for NIS2 in 202617 February 2026CERT Bulgaria
DenmarkNIS 2 Act (NIS 2-loven, lov nr. 434 af 6. maj 2025)1 July 2025The NIS2 form on Virk.dk, signed with MitID Erhverv
FinlandCybersecurity Act (Kyberturvallisuuslaki 124/2025)8 April 2025NCSC-FI’s NIS2 form, which reaches both the supervisor and the CSIRT
GermanyBSI Act (BSIG), recast by the NIS-2 Implementation Act (NIS2UmsuCG)6 December 2025The BSI, through the BSI portal
ItalyNIS Decree (D.Lgs. 138/2024)16 October 2024CSIRT Italia, through ACN’s Services Portal
NetherlandsCybersecurity Act (Cyberbeveiligingswet, Cbw)15 August 2026NCSC or the sector CSIRT, through MijnNCSC
PolandNational Cybersecurity System Act (ustawa o krajowym systemie cyberbezpieczeństwa, KSC), amended for NIS23 April 2026The CSIRT named in the entity’s Wykaz KSC entry, through the S46 system
SwedenCybersecurity Act (Cybersäkerhetslag 2025:1506)15 January 2026NCSC at FRA, through its cyber portal

Every national version keeps NIS2’s reporting clock: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. Some countries differ: Sweden and Finland count from when the incident is identified as significant, Poland’s reporting duty applies from 3 April 2027 (earlier for former operators of essential services), and Italy’s nine months after ACN’s notice that a company is included.

Built from each country’s official legal texts, as of October 2026.

The framework engine

Manage once, comply across frameworks

Most frameworks ask for the same things in different ways. Compeas maps the shared requirements — so one control contributes to every framework it satisfies.

One control

Access control

Defined, implemented and evidenced once — in one place.

  • NIS2
  • ISO 27001
  • SOC 2
  • NIST CSF 2.0
  • GDPR

Do the work once. Reuse it everywhere.

Get started

Start Your Compliance Journey Today

Get expert guidance and streamlined tools to achieve compliance faster

Contact Us Get Started