Complass – Navigate compliance Complass – Navigate compliance
Language EN
Deutsch English Français Italiano Español Nederlands Polski Português
Try for free

Maturity check: No more gut feeling.

Short statements, a few minutes, no account. You see where you stand on NIS2, ISO 27001 and CRA and which gaps come first.

Start the check

Choose frameworks

What do you want to see your status for?

Statements marked „NIS2 only“, „ISO 27001 only“, „CRA only“ count for that framework only. Fill in only the statements on your frameworks.

Not sure yet what applies to you? Go to the applicability check

Free and without an account. We do not store your individual answers. For anonymous statistics we count only frameworks, result levels, the biggest gap topics, language, day and country. We briefly derive the country from your IP address without storing it. Details and your right to object are in the privacy policy. Your right to object (opens in a new tab)

Leadership and responsibility

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
Management has set out in writing how your company approaches information security.
It is clearly named who takes care of information security and who reports to management.
Management approves the security measures, oversees them and has been trained on them. NIS2 only

Overview and risks

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
The scope of your information security management system is defined. ISO 27001 only
You have a current overview of your systems, applications and important data.
You assess security risks with a fixed method and decide in a traceable way how to handle them.

People and suppliers

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
All employees are trained on information security regularly.
Important suppliers and service providers have agreed what they do for your security, and you follow up on it.

Incidents

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
In a security incident everyone involved knows what to do, and you review incidents afterward.
You know who reports a significant incident to which body and when. NIS2 only

Emergencies and backups

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
For the failure of important systems there are emergency plans that you have practiced.
You have tried out whether your important data can be recovered from the backup.

Access

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
Employees only have the rights they need for their work, and you check this regularly.
Remote access, email and administrator accounts are protected with a second factor.

Systems and networks

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
Updates and security flaws have fixed responsibilities and time targets at your company.
Important systems and production plants run in separate network zones.
For encrypting data and connections there are fixed rules, and they are followed.

Review and evidence

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
You regularly check whether your security measures work, and you adjust.
You have recorded which measures from Annex A apply to you and why. ISO 27001 only
Internal audit and management review run to plan, and nonconformities are fixed. ISO 27001 only

Product and classification

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
You know which of your products fall under the CRA and whether they count as important or critical products. CRA only
The cybersecurity risks of each product are assessed, and the assessment is documented. CRA only
You check purchased and open-source components before you build them in. CRA only

Secure development

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
Security is firmly anchored in your development process, from requirement to test. CRA only
Your products ship with secure settings. CRA only
Access to your products and their data is protected, for example by sign-in and encryption. CRA only

Vulnerabilities and updates

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
For your products there is a current bill of materials of the software components. CRA only
Reported or discovered vulnerabilities in your products are handled by a fixed process. CRA only
Outsiders can report vulnerabilities to you through a known channel. CRA only
Security updates reach your customers reliably and securely. CRA only

Reporting and informing

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
You test the security of your products regularly, before and after market launch. CRA only
You know who reports severe incidents and actively exploited vulnerabilities to which body and when. CRA only
You have set how long you supply each product with security updates. CRA only

Conformity

What do the levels mean?
0 Not in place
We do not have this.
1 Informal
Done in part, depends on individual people.
2 Partly implemented
There is a rule, but with gaps.
3 Implemented and documented
Defined, implemented and provable.
4 Effective and reviewed
Measured and improved regularly.
Don’t know
Does not count toward the score and appears as an open point.
Technical documentation and security information for users are complete and up to date. CRA only
You know your conformity procedure and have planned the route to CE marking. CRA only

Frequently asked questions about the maturity check

Are my answers stored?

Free and without an account. We do not store your individual answers. For anonymous statistics we count only frameworks, result levels, the biggest gap topics, language, day and country. We briefly derive the country from your IP address without storing it. Details and your right to object are in the privacy policy.

Does the check replace an audit?

No. The check shows your own assessment. It does not verify whether measures work or obligations are met, and it is not legal advice.

Where does the scale come from?

It is the same scale from 0 to 4 as in the gap analysis in the portal. The target is level 3, “Implemented and documented”. Level 4 does not make up for gaps elsewhere.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.

Try for free Request a demo