Compeas GRC now supports the national NIS2 laws of ten European countries. Each company follows the law of its own country, with the national requirements, deadlines and reporting duties that come with it. The October 2026 release also adds an incident register built around NIS2 reporting deadlines, NIST CSF 2.0 profiles, and group-wide oversight in the Auditor Tool.
The right NIS2 for every country
NIS2 is one EU directive, but companies comply with national laws. Those laws differ in who is covered, how to register, which authority supervises and how incidents are reported. A group with companies across Europe faces a different set of obligations in every country.
Compeas GRC now carries a national version of NIS2 for Sweden, Denmark, Finland, Germany, Austria, Belgium, the Netherlands, Poland, Italy and Bulgaria. Each company sets its legal jurisdiction, and the platform installs that country’s version: the requirements every EU country shares, the national obligations on top, and the date each one falls due. Every national version is built from the country’s official legal texts and written for companies in every sector.
Each national obligation says what proves it. Key dates, such as registration and recurring filings, are reminded to the people responsible before they fall due.
Incident reporting on your country’s clock
The new incident register tracks the NIS2 reporting deadlines of the company’s own country from the moment an incident is reported: the early warning, the incident notification and the final report. Files, documents and the full activity history stay with the incident, and the register counts as evidence for the controls it supports.
NIST CSF 2.0 profiles
Organisations working with the NIST Cybersecurity Framework can now build Current and Target Profiles with organisation tiers, turn the gaps into an action plan, and export the profiles in NIST’s own template. Guidance shows what each outcome takes and which ISO 27001 work already counts towards it.
Oversight across the group
In the Auditor Tool, groups and their auditors follow incident registers and NIST CSF profiles across every company in one view, and can set group targets for the companies to take on. Auditors’ comments appear on the relevant control in Compeas GRC, where the team can reply.
“NIS2 is one directive, but no company complies with a directive. They comply with the law of the country they operate in. With this release a group can run every company on one platform and still meet each country’s own requirements, deadlines and reporting duties.”
Martin Karlsson, Founder & CEO, Compeas
Availability
The October 2026 release is available now to all Compeas customers, with no upgrade needed. To use a country’s NIS2 version, set the legal jurisdiction under Administration → Organisation and switch on NIS2 under Frameworks.
Release notes
Every change in the October 2026 release, in Compeas GRC and the Auditor Tool.
Compliance and NIS2
| Type | Change |
|---|---|
| New | NIS2 for each country. Every company follows the NIS2 law of its own country, set by its legal jurisdiction: Sweden, Denmark, Finland, Germany, Austria, Belgium, the Netherlands, Poland, Italy and Bulgaria. Built from each country’s official legal texts and written for companies in every sector. |
| New | Key dates and reminders for national obligations. Registration, reporting and filing deadlines appear on each requirement and are reminded to the right people before they fall due. |
| New | Requirements marked not applicable, with a reason. Exclusions are recorded once, with the justification your auditor needs to see. |
| Improved | Clear proof for every requirement. NIS2, GDPR and NIST CSF requirements say what proves them and which ISO 27001 work already counts towards them. |
Incident management
| Type | Change |
|---|---|
| New | Incident register with NIS2 reporting deadlines. The early warning, the notification and the final report are tracked against your country’s deadlines from the moment an incident is reported. |
| New | Everything about an incident in one place. Attach files, read documents in the browser and follow each incident’s full activity history. |
| New | Incidents on the overview, and as evidence. Open incidents are shown on the overview, and the register counts as evidence for the controls it supports. |
Risk and governance
| Type | Change |
|---|---|
| New | NIST CSF 2.0 profiles. Current and Target Profiles with organisation tiers, a gap analysis that becomes an action plan, and export in NIST’s own template. |
| Improved | A board report built for decisions. The report lists the decisions the board needs to take and keeps a history of every report issued to a meeting. |
Everyday use
| Type | Change |
|---|---|
| Improved | An overview that starts with what needs attention. The most important actions come first, and every number opens a list of exactly what it counts. |
| Improved | Faster across the board. The busiest pages load noticeably faster, and filters respond instantly. |
| New | Software discovery. Find the software your company uses in Microsoft Entra ID, Intune and Google Workspace, or import a list from Excel. |
| Improved | Employee import where you manage people. Import employees from Google Workspace or Microsoft Entra ID directly on the Employees page. |
| New | Service accounts and quicker assignment. Shared mailboxes are never offered as owners or asked to accept policies, and owners can be assigned straight from more lists. |
Your data and accessibility
| Type | Change |
|---|---|
| New | Export all, on every list. Download any register in full as a spreadsheet. |
| New | Full data export. Every register, the audit log, the Statements of Applicability and every stored file in one archive, with a checksum for each file. You are notified when it is ready, and it is stored privately for seven days. |
| Improved | Accessible and consistent. Every page is checked against accessibility standards, the wording is consistent throughout, and error pages explain what to do next. |
Auditor Tool
| Type | Change |
|---|---|
| New | Group views. Incident registers and NIST CSF profiles across every company in the group, with group targets the companies can take on. |
| New | Comments where the work happens. Auditors’ comments name what they concern and appear on the control in Compeas GRC, where your team can reply. |
| Improved | Read documents in the browser. Policies, evidence and vendor documents open in place instead of downloading. |
| Improved | A complete picture of each company. Frameworks and NIS2 version at a glance, why a requirement is not met yet, the evidence to keep, exclusions with their reasons, and national key dates. |
New to Compeas? Book a demo and see the national NIS2 versions in your own setup.