Complass
Implement once, evidence many times
What you have done for ISO 27001 also counts for NIS2 and the CRA. Each framework is a module with guided steps and templates that you can add at any time.
Information security
NIS2 and the German NIS2 Implementation Act
Risk management, registration, reporting obligations and management duties under the German BSI Act.
To the frameworkISO/IEC 27001:2022
From project mandate to a certification-ready ISMS, with Statement of Applicability and all mandatory documents.
To the frameworkTISAX® – preparing for the assessment
For suppliers and service providers of the automotive industry: choose labels and assessment level, self-assessment with maturity levels 0 to 5, prototype protection, data protection and corrective action plan.
To the frameworkBSI IT-Grundschutz
Approach according to BSI Standards 200-1 to 200-3 with Basic, Core or Standard Protection, built on Grundschutz++ and with the identifiers of Edition 2023.
To the frameworkNIST Cybersecurity Framework 2.0
For companies with international customers and insurers: current profile, target profile, tier and action plan under CSF 2.0, built from existing evidence.
To the frameworkNIST SP 800-53 Rev. 5 – Security and privacy controls
For companies working with US agencies, cloud programmes or international customers: all 20 families with enhancements, Low, Moderate, High and Privacy baselines, plan and POA&M.
To the frameworkNIST SP 800-171 Rev. 3 – Protecting CUI
For suppliers to US customers, especially in defence: all 97 requirements for protecting CUI with the SP 800-171A determination statements, SSP and POA&M.
To the frameworkIndustry and products
IEC 62443 – industrial cybersecurity
OT security under IEC 62443 in one package: one booking includes the modules for all three roles.
- Asset owners System under consideration, zones and conduits, security levels
- Integrators and service providers IEC 62443-2-4 and 3-3
- Manufacturers IEC 62443-4-1 and 4-2
Cyber Resilience Act (EU) 2024/2847
Product-related conformity: classification, Annex I, vulnerability handling, reporting obligations and CE marking.
To the frameworkMachinery Regulation (EU) 2023/1230
From scope to CE marking, focusing on the cybersecurity requirements for control systems.
To the frameworkRadio Equipment Directive – cybersecurity
Cybersecurity of connected radio products: scope and roles, requirements under Art. 3(3)(d), (e) and (f), harmonised standards (EN 18031), conformity assessment, documentation and the transition to the Cyber Resilience Act.
To the frameworkCybersecurity for medical devices (MDR/IVDR)
For manufacturers and suppliers in medical technology: secure development across the life cycle, minimum IT environment requirements, technical documentation, post-market surveillance and vulnerabilities.
To the frameworkNIST SSDF and OWASP SAMM
For manufacturers of software and devices: secure development under the 42 tasks of the NIST SSDF, maturity under OWASP SAMM and a bridge to the CRA and IEC 62443-4-1.
To the frameworkProduct safety: GPSR – Regulation (EU) 2023/988
For manufacturers, importers, distributors, web shops and online marketplaces: risk analysis, documentation, mandatory information, accident reporting and recall.
To the frameworkCritical infrastructure and sectors
German KRITIS Umbrella Act (KRITISDachG)
Physical resilience of critical facilities: applicability, registration, risk analysis, resilience plan and incident reporting. Applies in Germany only.
To the frameworkDORA – Digital Operational Resilience Act (EU) 2022/2554
For financial entities and their ICT service providers: ICT risk management, incident reporting, resilience testing, register of information and contractual requirements under Art. 30.
To the frameworkEnergy Industry Act (EnWG) and IT security catalogue
IT security for networks, energy facilities and digital energy services under sections 5c to 5e EnWG: clarify your role, implement the applicable IT security catalogue, report incidents and provide evidence.
To the frameworkIT security in hospitals: Section 391 SGB V and B3S
For hospitals of every size: obligations under Section 391 SGB V and implementation of the sector-specific security standard “Medical care” (B3S), linked with NIS2 and KRITIS.
To the frameworkIT security guideline under Section 390 SGB V (KBV and KZBV)
For medical, psychotherapy and dental practices and medical care centres: all 92 requirements of the KBV and KZBV, graded by practice size, with evidence for the annual review.
To the frameworkEU GMP Annex 11 – Computerised systems
For manufacturers of medicinal products and active substances: validate, operate and evidence computerised systems on a risk basis, ready for inspection.
To the framework21 CFR Part 11 – Electronic records and electronic signatures
For companies with FDA-regulated records: scope, risk-based validation, operational controls, electronic signatures and inspection readiness.
To the frameworkData protection, data and AI
GDPR – General Data Protection Regulation
Accountability in practice: records of processing, legal bases, data subject rights, TOMs, processors, DPIA and data breaches.
To the frameworkFADP – Swiss Federal Act on Data Protection and its ordinance
For companies with customers, users or employees in Switzerland, also with a registered office abroad: records, privacy notice, data security, cross-border disclosure, reports to the FDPIC and data subject rights under the FADP and its ordinance.
To the frameworkAI Act (EU) 2024/1689
Record and classify AI systems, promote AI literacy, implement and evidence obligations as deployer or provider.
To the frameworkData Act (EU) 2023/2854
Data access for connected products: roles and SME exemption, data inventory, design for access, fair contract terms and cloud switching.
To the frameworkGerman Whistleblower Protection Act (HinSchG)
Internal reporting office with an anonymous reporting channel: deadlines for acknowledgement and feedback, confidentiality, protection against reprisals and deletion after three years. Applies in Germany.
To the frameworkIn preparation
In preparation: ISO 9001 – quality management Do you need one of them? Send an enquiry
What these frameworks cover
- ISO 9001 – quality management
- Build or transition a quality management system to the new 2026 edition: context, processes, risks and opportunities, control of documented information, internal audits and management review.
Get in touch and we will tell you how you can start today.
Content is updated when laws or standards change. Legal texts are included in full in the portal, with the retrieval date.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.