Customers, insurers and regulators expect solid answers about your security. What is usually missing is the overview, the time and the specialist knowledge to give them. KaitoSec shows what matters for your business, what to do next, and how to evidence progress, without building a compliance department for it.
Evidence captured once
Control · A.5.19
Supplier & third-party due diligence
Mapped where the substance matches
Requirements answered from the same record
Audit pack assembling
Standards your auditors and customers ask about
Before and after
What carries your business
01 Criticality
The impact analysis sets how long each process may be down before it gets expensive. The recovery is rehearsed and the exercise record proves it, so the time back to normal is measured rather than estimated.
Business continuityOperating capability
Exercise passedDisruptionRestored · 2h 40mRTO budget 4h
Critical processes
02 Dependencies
One register for applications, processes, vendors and AI components, classified as it is recorded and owned by a named person. Each row shows which parts of the business hang off it.
Classification split
Restricted 34%Internal 28%Public 24%AI 14%
Inventory · 1,284 records
Classified on discovery| Asset | Owner | Classification | Systems served |
|---|---|---|---|
| Payments APIInternal service | Platform Engineering | Restricted | ISMS · BCMS · DSMS |
| Customer portalPublic web application | Product | Public | ISMS · DSMS |
| Primary databasePostgreSQL cluster | Platform Engineering | Restricted | ISMS · BCMS · DSMS |
| StripeVendor · payment processor | Finance | DPA signed | DSMS · ISMS |
| Support copilotAI component · embeddings | Customer Operations | AI · high risk | AIMS · DSMS |
Every row feeds the risk register, the RoPA and the BIA without being re-entered.
03 Risk
One scoring model for every obligation, so what to treat first stays comparable instead of being judged separately per standard.
Risk managementRisk matrix · 52 tracked
Impact ↑
Likelihood →
Hover a cell to read the band
Treatment pipeline
The next step
Where do we start? What is urgent? Who has to act? And what is actually enough? KaitoSec turns requirements into concrete tasks and walks the team through delivering them.
Open tasks · ordered by impact
| Requirement | What that means you do | Owner | By when |
|---|---|---|---|
| Supplier securityISO 27001 · A.5.19 | Request review reports for the six critical service providers and file them against the contract. | Head of Procurement | This week |
| Incident reporting pathNIS2 · Art. 21 | Name the reporting chain and settle who is reachable outside office hours. | Head of IT | This month |
| Record of processingGDPR · Art. 30 | Add the five new processing activities introduced by the customer portal. | Data Protection Officer | This month |
| Recovery rehearsalISO 22301 | Exercise the payments recovery plan against its four-hour target. | Platform Engineering | This quarter |
| Human oversightEU AI Act · Art. 14 | Decide who reviews the support copilot's output, and how often. | Customer Operations | This quarter |
The order follows the criticality established above, not the numbering in the catalogue.
Answering
Questionnaires, customer reviews and audits ask for the same facts in different shapes. None of them should set off a search through documents, mail threads and responsibilities.
What comes out
The answer, with its evidence attached, straight from the register. No round of emails asking who holds what.
What comes out
Exposure and rehearsed recovery times in business terms, so the file does not need a security glossary.
What comes out
Audit pack, statement of applicability and the Article 30 record, exported from the same dataset.
Overlap
Choose the standard your customer, auditor or insurer is asking about. The controls behind it mostly exist already, because they satisfy an obligation you have met before.
| Requirement | Satisfied by | Also serves |
|---|---|---|
| A.5.7 | Threat intelligenceMITRE ATT&CK, CAPEC, OWASP and BSI catalogues indexed and mapped to assets | NIS2 · DORA |
| A.5.19 | Supplier & third-party due diligenceVendor register with DPAs, criticality rating and evidence of review | NIS2 · DORA · 42001 |
| A.5.30 | ICT readiness for continuityRTO targets from the BIA, rehearsed recovery plans, exercise records | ISO 22301 · DORA |
| A.8.16 | Monitoring activitiesAlerting anchored to the asset inventory, findings routed to named owners | NIS2 · SOC 2 |
Coverage from existing controls
of ISO 27001 requirements met by controls you already run for the other systems.
Full mapping| Requirement | Satisfied by | Also serves |
|---|---|---|
| Art. 21(2)(a) | Risk analysis & security policiesOne risk register across all four systems, policies live and signed | ISO 27001 · DORA |
| Art. 21(2)(c) | Business continuity & crisis managementBIA, recovery plans and exercise outcomes in the same model | ISO 22301 |
| Art. 21(2)(d) | Supply chain securityThird-party risk assessed, treated and re-reviewed on schedule | ISO 27001 · DORA |
| Art. 23 | Incident reporting to the authority24h / 72h / final filings generated from the incident record | DORA · GDPR |
Coverage from existing controls
of NIS2 requirements met by controls you already run for the other systems.
Full mapping| Requirement | Satisfied by | Also serves |
|---|---|---|
| Art. 5 | ICT risk management frameworkBoard-approved framework fed by the same register the ISMS uses | ISO 27001 · NIS2 |
| Art. 9(4) | Protection and preventionControl library mapped once, evidenced per asset and per process | ISO 27001 |
| Art. 11 | Response and recoveryRecovery plans and RTO budgets inherited from the BIA | ISO 22301 · NIS2 |
| Art. 28 | ICT third-party registerRegister of information generated from the vendor inventory | ISO 27001 · GDPR |
Coverage from existing controls
of DORA requirements met by controls you already run for the other systems.
Full mapping| Requirement | Satisfied by | Also serves |
|---|---|---|
| Art. 9 | Risk management systemAI risks scored on the same scale as every other risk you track | ISO 42001 |
| Art. 10 | Data and data governanceTraining and inference data tied to the RoPA the DSMS already holds | GDPR · ISO 42001 |
| Art. 12 | Record-keeping and loggingModel events logged, retained and exportable per system | ISO 27001 |
| Art. 14 | Human oversightNamed owners and review cadence on every registered AI component | ISO 42001 |
Coverage from existing controls
of EU AI Act requirements met by controls you already run for the other systems.
Full mappingThe four areas this covers
Business continuity
BIA, recovery plans, exercises and RTO tracking against a rehearsed plan.
ISO 22301 · DORA
Information security
Controls, risks, threat catalogues and monitoring on one register.
ISO 27001 · BSI · NIS2
Data protection
RoPA, DPIA, subject requests and processor agreements, kept current.
GDPR / DSGVO
AI governance
AI inventory, model risk, logging and human oversight.
ISO 42001 · EU AI Act
Shared records: written once, read by all four
1 record → 4 obligationsWhy KaitoSec
01
Consultants can speed up the start. After that the knowledge belongs in the building. KaitoSec explains each requirement in plain terms, proposes the next step and records why you decided as you did. Your team learns while it delivers.
Decisions stay traceable02
This work usually sits with people who also have another job. So the tool leads through the delivery instead of presenting empty fields, and says for each requirement what is actually enough.
No full-time function needed03
Runs on ISO 27001-certified infrastructure in Germany, under EU law. GDPR requirements are built into the data model rather than a policy PDF, and support works in German or English.
Data stays in the EUThe result
You spot your most important risks earlier.
You know what to do at any point.
You answer customer and auditor questions faster.
You meet several obligations with the same work.
You do not need a compliance department of your own.
Early access feedback
“We replaced three spreadsheets and a shared drive with one system. ISO 27001 and NIS2 finally live in the same place, and the readiness view shows exactly what is still open.”
Get started
Bring one current process. Leave with a clearer path. We will review how your existing registers, frameworks and owners could fit KaitoSec, using one live workflow instead of a generic feature tour.
