Skip to main content
qorionix

Compliance

Evidence, not badges

Software cannot make an organisation compliant, and any vendor who says otherwise is selling you a problem you will meet during an audit. What software can do is produce the artefacts an audit asks for, from data the platform already holds, so the exercise is a query rather than a quarter.

The phrase you will not find on this site is “NIS2 compliant”. The phrase you will find is “produces the evidence your NIS2 audit asks for”. The difference is not pedantry — one is a claim about you that we are not entitled to make.

The artefact

One bundle, hash-stamped

External auditors do not want a tour of fifteen REST endpoints. They want one signed document covering what your platform looked like during the window they are reviewing.

Two clicks produce a single JSON document containing the framework snapshots you selected, an audit-chain snapshot, and an integrity hash computed over the canonical form of the whole payload.

Stamping writes that hash into the compliance audit chain. A regulator who received the bundle from you by email can later verify it matches the hash we recorded at issue time — even if our service is offline. That property is the point of the design.

Framework selection is opt-in, so a supervisor asking about one directive gets a bundle scoped to it rather than everything we hold.

A section that fails to load is emitted as null rather than omitted, so a reviewer can see the gap instead of concluding the section did not exist. An evidence document that hides its own holes is not evidence.

What is in the bundle, field by field
evidence bundle · nis2 + gdpr · 30-day window
{
  "organization_id": "org_7f3a…",
  "generated_at":    "2026-08-31T09:14:02Z",
  "window_from":     "2026-08-01T00:00:00Z",
  "window_to":       "2026-08-31T00:00:00Z",
  "frameworks":      ["nis2", "gdpr"],

  "nis2": {
    "controls": [
      { "id": "NIS2-A21-10",
        "status": "partial",
        "evidence_count": 41,
        "checked_at": "2026-08-31T09:13:58Z" }
    ]
  },

  "gdpr": {
    "ropa_entries": 12,
    "dpia_entries": 3
  },

  "dora": null,          // not selected — visible, not hidden
  "ai_act": null,

  "audit_chain": {
    "verified": true,
    "head_hash": "9c1e…4b7f"
  },

  "integrity_hash": "sha256:2f8a…c910"
}

By framework

What you get, and who needs it

Each one lists what we produce and who it applies to. Every entry also carries a scoping caveat, because a framework section that says only good things about itself is a section nobody has used in an audit.

NIS2

EU essential and important entities. If you are unsure whether you are in scope, your sector and headcount decide it, not your appetite — and the answer is more often yes than companies expect.

What the platform produces

  • A control report across all ten Article 21(2) measures, each with a status of compliant, partial or missing, an evidence count and a checked-at timestamp.
  • Evidence drawn from queries against the platform's existing tables, so there is no separate data-entry exercise and no spreadsheet to keep in step.
  • An incident record structured to the reporting clock: 24-hour early warning, 72-hour notification, final report within one month.
  • A per-finding record of the decision your management took — including a decision to accept a risk — because Article 20 makes that decision the thing under scrutiny.

The caveat: A control marked partial is genuinely partial. The report is built to be useful in an audit, which means it has to be capable of telling you something you do not want to hear.

GDPR

Every organisation processing personal data of people in the EU or EEA.

What the platform produces

  • Records of processing activities and data protection impact assessment entries, exportable inside the evidence bundle.
  • A one-call data export for a subject access request, streamed as a JSON attachment.
  • A cascading erasure that removes the organisation's records across every module transactionally, rather than leaving orphans in a log table.
  • Article 32 mappings on the posture findings that bear on security of processing, and Article 33 mappings on the ones that bear on breach notification.

The caveat: We are a processor for the data you put into the platform, not your controller. The lawful basis, the retention decision and the response to a subject are yours; we supply the mechanism and the evidence.

DORA

EU financial-sector entities and their ICT third-party providers. If you are not one of those, this section will be thin, and that is correct rather than a gap.

What the platform produces

  • A register of ICT third parties with a concentration view, which is the artefact Articles 28 to 30 ask for.
  • Articles 9, 10 and 12 mappings on the relevant posture findings.
  • The same hash-stamped evidence bundle, scoped to DORA alone if that is what a supervisor asked for.

The caveat: DORA-critical designation is a separate assessment and not something a product can produce for you.

ISO/IEC 27001:2022

Anyone certifying, or answering a customer questionnaire that assumes you are.

What the platform produces

  • Annex A control mappings on every posture finding — eighteen distinct controls across A.5 and A.8 appear across the check pack.
  • A NIS2 to Annex A cross-mapping derived from ENISA's own mapping guide, so one body of evidence answers both.
  • A SOC 2 cross-mapping alongside it, for buyers who ask in that vocabulary instead.

The caveat: A mapping is not a certificate. It shortens the evidence-gathering part of an audit; it does not replace the auditor.

EU AI Act

AI providers and deployers, depending on the system's intended use, deployment context and each party's role.

What the platform produces

  • An AI system card recording the system name, self-assessed risk class, capability list, and the oversight facts: human in the loop, the audit-trail description, that any action step with a high blast radius requires human approval, and that grant-class privileged actions are not exposed to the model at all.
  • AI disclosures and available records of assessments, supporting evidence and operator decisions for later review.
  • Data-handling statements describing the configured provider, retention and whether the platform can substantiate an EU inference-region claim.
  • Decision review, proposal approval and tenant autonomous-response stop controls, with recorded policy changes available for audit.

The caveat: The system card records a self-assessment; it does not establish Annex III classification or certify compliance. Inference-region claims remain unverified without supporting provider evidence. Human review and tenant stop controls support oversight. The stop control blocks new autonomous-response attempts after the server observes the change; actions already started may still complete. It does not undo completed actions or stop every AI feature. Available records and retention depend on the feature and the organisation's configuration.

NIS2, specifically

Ten measures, ten queries

The control report covers all ten Article 21(2) measures. Each is answered by a query against tables the platform already fills, so there is no parallel spreadsheet to keep in step and nothing to re-enter.

Each control resolves to compliant, partial or missing, with an evidence count and a checked-at timestamp. A control marked partial is genuinely partial — the report has to be capable of telling you something you do not want to hear, or it is not useful in an audit.

Article 20 is the one that changes behaviour. It makes your management body directly responsible for approving cybersecurity risk-management measures, and a director who approves a document they do not understand has not met the obligation. That is why every posture finding records the decision taken about it — including a decision to accept the risk — and why an accepted finding stays in the bundle rather than disappearing from it.

What your management is personally responsible for
  1. 21(2)(a)Risk analysis and information system security policy
  2. 21(2)(b)Incident handling
  3. 21(2)(c)Business continuity and crisis management
  4. 21(2)(d)Supply chain security
  5. 21(2)(e)Network and system security
  6. 21(2)(f)Effectiveness assessment
  7. 21(2)(g)Cyber hygiene and training
  8. 21(2)(h)Cryptography
  9. 21(2)(i)Human resources security and access control
  10. 21(2)(j)Multi-factor and continuous authentication

The same evidence answers an ISO 27001 questionnaire through a cross-mapping derived from ENISA's own mapping guide, and a SOC 2 questionnaire through a second one. See the mapping table.

See which obligations your tenant already touches

Every finding in your posture report carries its compliance mappings. Connect Microsoft 365 and you will see which obligations your current configuration touches, before you have bought anything.

Start the free assessmentOur own posture

No card. No sales call before you have read the report.