Compliance
24 articles in this category.
New Assessment Report in SecTepe.Core: Complete Gap Analysis & Consistent Multi-Format Exports
SecTepe.Core has a reworked compliance assessment report. The gap analysis lists every requirement and adds an action plan by type. CSV, XML, PowerPoint, Word and Excel now share the same structure.
Bilingual Trust Center & Automated DE/EN Release Notes in SecTepe.Core
The public white-label trust center of SecTepe.Core is now bilingual (DE/EN), with accessibility fixes. Release notes are now written in both languages automatically. Branch names no longer appear in the published text.
BSI C5 Audit Readiness: Signed Evidence Bundles & Data-Residency Attestation
The SecTepe platform generates monthly C5 evidence bundles signed with Cosign and stores them in an Object-Lock bucket. A written data-residency attestation proves where customer data physically resides.
Unified Audit Management in SecTepe.Core With a Drag-&-Drop Timeline
Supplier audits now live in the central audit management of SecTepe.Core. You can reschedule the audit timeline with the mouse. A framework/chapter scope picker makes ISMS audit planning precise.
From Threat News to Auditable Governance Evidence
SecTepe.CTI.Compliance turns ~62 sources into classified compliance reports and carries them into SecTepe.Core as evidence. It uses a four-axis classification. Framework mapping covers NIS2, DORA, ISO 27001, BSI, GDPR, TISAX, PCI-DSS, and HIPAA.
Director Liability under §43 GmbHG and NIS-2: Why 'Cyber is IT's Job' Can Lead to Personal Bankruptcy in 2026
§43 GmbHG, §93 AktG, and NIS-2 Art. 20 cement personal management liability for cyber security. Learn which evidence every director should have on the desk.
Cyber Insurance 2026: Why Insurers Increasingly Decline – And How to Prepare
Cyber policies are getting more expensive, narrower, and more demanding. Learn which technical minimums insurers expect in 2026 and how to prove them cleanly.
Hospitals & Critical Infrastructure: B3S, NIS-2 Extension, and Smart Use of KHZG Funds
German hospitals face combined pressure in 2026. B3S obligation, NIS-2 extension to all hospitals, ePA connection and a ransomware wave hit at once. Here is how to prioritize KHZG funds wisely.
NIS-2 Ready: Health Monitoring, Audit Log, and Alert Rules in the Mail Security Platform
These are the operational building blocks a mail security platform must ship. They let it meet the NIS-2 requirements on detection, reporting, and response technically.
DORA for SaaS Providers and Bank Suppliers: What 'Critical ICT Third-Party Providers' Must Deliver in 2026
DORA doesn't only apply to banks. Any SaaS provider, IT service provider, or FinTech with financial customers gets pulled in. Learn what 'critical ICT third-party providers' must deliver technically and contractually.
Four-Eyes Principle and Forensic Archive: Two Building Blocks Almost Every Audit Asks About
A four-eyes approval workflow for mail releases works together with a WORM-capable forensic archive. Both proactively cover typical findings from ISO 27001 and NIS-2 audits.
M&A Cyber Due Diligence: What Buyers Probe in 4 Weeks – And Where Deals Break
Cyber due diligence is a workstream of its own in 2026 M&A processes. Learn which findings depress purchase price or kill deals, and which platform evidence builds trust quickly.
German Mid-Market Machinery: NIS-2 Extension, IEC 62443, and Industrial Espionage Risk
The German machinery mid-market faces double pressure in 2026. The NIS-2 extension hits many unexpectedly, while industrial espionage grows. Here is how to tackle OT security and IEC 62443 in a structured way.
Outbound DLP: Effectively Preventing Data Loss in Email
A modern mail security gateway detects PII, credit card numbers, IBANs, and API keys in outbound emails. A four-eyes release reduces the error rate.
Law Firms, Tax Advisors, Audit Practices: Client Confidentiality, BORA/StBerG and Cyber Security 2026
German professional confidentiality holders are personally liable for breaches, including through cyber incidents. Learn which minimums BORA, StBerG, and WPO demand in 2026.
IVDB Integration for German Statutory Health Insurance: B3S-Compliant ISMS Without CSV Pain
Direct IVDB integration (CSV import plus a future API) dramatically speeds up a B3S-compliant ISMS build for German health insurers. Conflict detection and a progress display are included.
Supplier & Vendor Portal: Structured Third-Party Risk Management
An integrated supplier portal drastically reduces supplier onboarding effort. It offers self-service questionnaires, evidence collection, and a risk score.
Framework Change Management: Detect Standard Updates Automatically and Reassess
A GRC platform can proactively detect updates to ISO 27001, NIS-2, and BSI IT-Grundschutz. It analyzes the impact and coordinates reassessments. No more manual newsletter shifts.
DORA + NIS-2 + ISO 27001: How a CISO Manages Three Mandates Without Burnout
Three regulatory mandates in parallel, one CISO with two hands. A multi-framework platform eliminates duplicate work and prevents CISO burnout.
Multi-Framework Compliance: ISO 27001, NIS-2, and BSI IT-Grundschutz From One Platform
An integrated GRC platform maintains multiple frameworks in parallel and computes cross-mappings automatically. This avoids duplicate work in assessments.
SecTepe.Core: The EU-Native GRC Platform for Compliance, Risk, and ISMS
Learn what SecTepe.Core is and which frameworks the platform covers. We explain why an EU-native GRC solution becomes the strategic answer to Vanta, Drata & co. in 2026.
Benefits of an External Information Security Officer
For many organizations, an external ISO is the better choice. Learn the advantages of outsourcing this critical role.
ISO 27001: The Guide to Information Security
Everything you need to know about ISO 27001 certification. From the basics to a successful ISMS implementation.
Responsible Disclosure: The BSI's CVD Guideline
The BSI's CVD guideline sets out a structured process for coordinated vulnerability disclosure. Through collaboration, it protects end users.