fictional example company

Complass at Kellenbach: a tour in 11 chapters

The pictures show the real portal with the sample data of Kellenbach Maschinenbau. Pick a chapter: the steps move on by themselves, and you can pause at any time. Each step shows how things often work today and what Complass changes.

Start the tour

Chapters

Overview All frameworks in one portal 3 steps Recommended start
From gap to action Gap analysis, applicability, actions 4 steps
Work in Teams and Jira Tasks and deadlines in the tools you already use 2 steps
Incident with a reporting deadline A running NIS2 incident 2 steps
Own product (CRA) KB Connect Gateway and KB Insight 5 steps
Supply chain Assess suppliers, keep track of their evidence 3 steps
Hagen plant (OT) Zones, conduits and security levels 2 steps
Risks Assess, treat, report 3 steps
Management Management duties under NIS2 3 steps
Audit and access Evidence and permissions 2 steps
Automatic evidence Checks from your own systems 3 steps

Family business, 380 employees, two plants in Hagen and Iserlohn
An important entity under NIS2
Manufacturer under the CRA and the Machinery Regulation, with its own KB Connect Gateway

Chapter 1

Overview: All frameworks in one portal

Kellenbach’s dashboard with overall progress, next audit, open tasks, maturity and running reporting deadlines

Overview · 1 of 3

Kellenbach’s status on one page

Often today: Anyone who wants to know where the company stands collects figures from spreadsheets, e-mails and project folders.
With Complass: The dashboard shows overall progress, the next audit, open tasks and maturity across all projects. Below it the reporting deadlines of the current incident keep running, and every tile leads straight to the list behind it.

26 frameworks in the portal

Overall progress across all projects
Running reporting deadlines

Framework overview: shared measures and the projects they count for

Overview · 2 of 3

Implement once, prove it for every framework

Often today: ISO 27001, NIS2 and the CRA ask for much of the same, and every requirement is kept in a list of its own.
With Complass: The framework overview links every shared measure to the projects it counts for. What is implemented and evidenced once counts for every framework that asks for it.

Shared measures
Effect per project

ISO 27001 project for the Hagen and Iserlohn plants with progress, next step and phases

Overview · 3 of 3

One project per framework, step by step to the audit

Often today: The project plan sits with one person, and only they know what comes next.
With Complass: The ISO 27001 project for both plants shows the progress of every phase and the next open step, one click away from working on it. Pre-audit and certification audit are dates in the project.

Your next step
Phases up to the audit

Chapter 2

From gap to action: Gap analysis, applicability, actions

Gap analysis with the maturity scale and the rating per area

From gap to action · 1 of 4

Where does Kellenbach stand today?

Often today: The gap analysis is the outcome of a workshop that nobody updates after a few months.
With Complass: Every shared measure is rated from “not in place” to “effective and reviewed”, with a target and a reason. Complass shows where the largest gaps are and, if you like, moves them straight into the action plan.

Maturity scale
Rating per area

Statement of Applicability for ISO 27001 Annex A with assessment status and export

From gap to action · 2 of 4

The Statement of Applicability as a controlled document

Often today: The Statement of Applicability is an Excel file whose reasons nobody can trace at the next audit.
With Complass: For every control of Annex A the catalogue records whether it applies, why, how far it is implemented and where the evidence is. After review the statement is released as a version and exported as Word, Excel or PDF.

Assessment status of the catalogue
Export as Word, Excel, PDF

Action plan with filters, owners, due dates and priorities

From gap to action · 3 of 4

Every gap becomes a task with a name and a date

Often today: Tasks from the audit and the gap analysis are scattered across e-mails, meeting notes and tickets.
With Complass: The action plan collects every task with owner, due date, priority and the framework that requires it. Owners get an e-mail on assignment and a reminder before the due date; anything overdue stands out at once.

Tasks with owner and due date
Filter by framework, priority and person

Comments with mentions and a resolved question on a task

From gap to action · 4 of 4

Questions where the work is

Often today: The discussion about a measure runs by e-mail and cannot be found at the next audit.
With Complass: Comments with mentions sit right on the task, and a question is marked as resolved. At the audit it is clear who checked and decided what.

Comments on the task

Chapter 3

Work in Teams and Jira: Tasks and deadlines in the tools you already use

Microsoft Teams under Integrations: an active channel with its events

Work in Teams and Jira · 1 of 2

Deadlines and approvals arrive in Microsoft Teams

Often today: Anyone who does not want to miss a deadline or an approval has to keep checking the compliance tool.
With Complass: The “Informationssicherheit” channel gets a card when an incident is recorded, a reporting deadline runs out, a task is assigned or becomes overdue, or an approval is waiting. People open the entry in Complass through the link on the card and handle it there, with their own rights.

Channel with its events

Task with a linked Jira issue, the note “Jira reports done” and the form for the confirmation

Work in Teams and Jira · 2 of 2

The task becomes a Jira issue

Often today: Development works in Jira, compliance in lists, and in the end someone reconciles both by hand.
With Complass: One click turns a task into a Jira issue, one at a time or several at once. Status, comments and assignees flow back. When Jira reports “done”, the owner confirms the task in Complass with a short comment, so the evidence carries a confirmation by a person.

Linked Jira issue
Confirmation in Complass

Chapter 4

Incident with a reporting deadline: A running NIS2 incident

Incident list with the running ransomware incident and its next reporting deadline

Incident with a reporting deadline · 1 of 2

Ransomware on the administration’s file servers

Often today: In an emergency the team first has to work out whether to report, to whom and by when.
With Complass: The running incident is recorded, assessed as reportable under NIS2 and shows its next deadline with the time left. Closed incidents, among them a CRA case on the company’s own gateway, stay traceable with every report.

3 incidents in the example

Open incident with its next deadline
Deadlines at a glance

Reporting stages of the NIS2 incident with deadlines, the submitted early warning and the open notification

Incident with a reporting deadline · 2 of 2

The NIS2 reporting stages with their deadlines

Often today: Someone works the deadlines out by hand under time pressure, and what was submitted is in an e-mail.
With Complass: Complass computes the deadlines from the moment of awareness: early warning, notification, final report. Submitted stages show time and reference number; the report itself goes through the portal of the competent authority, as required.

Next deadline
NIS2 reporting stages

Chapter 5

Own product (CRA): KB Connect Gateway and KB Insight

Vulnerability list with CVSS, KEV, priority, due date and owner

Own product (CRA) · 1 of 5

Vulnerabilities by urgency, not by arrival

Often today: Scanner reports arrive as PDFs, and gut feeling decides which finding is fixed first.
With Complass: All findings are in one list with CVSS, the flag for actively exploited vulnerabilities (KEV), priority, due date and owner. At the top is what is exploited and reachable.

Findings by priority

Finding on the KB Insight customer portal with CVSS, KEV, SSVC decision and the affected asset

Own product (CRA) · 2 of 5

One finding with everything the decision needs

Often today: CVE number, rating and affected system sit in three different tools.
With Complass: The finding on the company’s own customer portal KB Insight shows the rating, the KEV entry and the SSVC decision next to the affected asset and its exposure to the internet. That is the reason it is handled at once.

Rating of the vulnerability
Affected asset

Recommended actions for a finding with source and “Add as action”

Own product (CRA) · 3 of 5

From finding to action

Often today: What to do is scattered across vendor notes, databases and forums.
With Complass: Every finding comes with its recommended actions and their source: the vendor’s update, the CISA requirement, a general measure for the type of weakness. One click turns one of them into a task with a due date.

Recommended actions with source

SBOM of the KB Connect firmware with components, licences and open vulnerabilities

Own product (CRA) · 4 of 5

The SBOM of the KB Connect Gateway

Often today: Development knows which components are in the firmware; product management and support do not.
With Complass: The SBOM shows the firmware with boot loader, kernel and libraries, their licences and open vulnerabilities. It is imported from CycloneDX, matched against new vulnerabilities as they appear and exported in a standard format.

Components of the firmware
Export in a standard format

Security advisory of a sample vendor with the company’s own affected assets

Own product (CRA) · 5 of 5

Matching vendor advisories to your own devices

Often today: Security advisories from suppliers arrive by e-mail, and someone checks by hand whether the company’s own devices are affected.
With Complass: Advisories in the CSAF format are imported and matched to the company’s own assets by model and version. The list shows at once which device is affected and which one is still being investigated.

Your affected assets
Export

Chapter 6

Supply chain: Assess suppliers, keep track of their evidence

Supplier cockpit with supply chain figures and the list “Needs attention”

Supply chain · 1 of 3

Where the supply chain needs attention

Often today: Which supplier is critical and whose certificate is expiring is scattered across purchasing lists and e-mails.
With Complass: The supplier cockpit counts critical suppliers, assessments due, expiring evidence and missing data processing agreements. Below it is who needs attention first: the highest risk from tiering and the last assessment at the top.

State of the supply chain
Needs attention

Assessments of a supplier: external self-assessment with progress, automatic re-invitation and reminders

Supply chain · 2 of 3

The supplier answers the questionnaire itself

Often today: Questionnaires go back and forth as Excel files, and nobody knows for sure which version is the valid one.
With Complass: Druck & Service Hagen answers the basic security requirements in its own access to the supplier portal. Kellenbach sees the progress and reviews the answers once they are submitted. Before the due date Complass reminds the supplier, and if you like a new assessment goes out automatically for the next review.

Self-assessment of the supplier
Automatic re-invitation

Evidence of a hosting provider with validity, the note “Expires soon” and the check of the scope

Supply chain · 3 of 3

Certificates and audit reports with an expiry date

Often today: That a service provider’s certificate has expired often only shows at the audit.
With Complass: For every supplier there are certificates, audit reports and insurance policies with their validity and the question whether their scope covers the service. Whatever expires soon is flagged and shows in the cockpit before a gap opens.

Evidence with expiry

Chapter 7

Hagen plant (OT): Zones, conduits and security levels

Zones and conduits of the Hagen plant with figures and the network plan by Purdue level

Hagen plant (OT) · 1 of 2

Zones and conduits with target and achieved level

Often today: The zone model is a drawing from the last project that is wrong after the next rebuild.
With Complass: The Hagen plant is divided into zones and conduits according to IEC 62443. Complass shows the gaps between target and achieved security level and observed traffic without an approved conduit, also in the network plan by Purdue level.

Zones, conduits and SL gaps
Network plan by Purdue level

Asset inventory with zone, owner and protection need

Hagen plant (OT) · 2 of 2

One inventory for IT and OT

Often today: IT keeps the servers, and each plant keeps its own list of machines and controllers.
With Complass: Servers, workstations, controllers and operator panels are in one inventory with zone, protection need and owner. Open and visible: the assets at the Iserlohn plant have no zone yet, the OT project there follows in 2027.

38 assets recorded

Inventory with zone and protection need

Chapter 8

Risks: Assess, treat, report

Risks · 1 of 3

One risk register for the whole company

Often today: Risks are in a list that is refreshed once a year for the audit.
With Complass: Every risk has a rating, a treatment, a risk owner and the date of its next review, linked to assets, vulnerabilities and actions. Register, heat map and method are on one page.

12 risks assessed

Risk register
Register, heat map and method

Heat map with inherent and residual risk side by side

Risks · 2 of 3

Before and after at a glance

Often today: For management the heat map is rebuilt in a slide deck every quarter.
With Complass: The heat map comes from the register: inherent risk on the left, residual risk after the implemented measures on the right. A click on a number opens the risks behind it.

Inherent and residual risk

Assessment of a risk with a non-binding suggestion and its reasons

Risks · 3 of 3

A suggested rating, the decision stays in-house

Often today: Every assessment starts from scratch, and every department rates by its own yardstick.
With Complass: Complass derives a suggestion from the protection need and exposure of the linked assets and the open vulnerabilities, and names the reasons. The suggestion is not binding; the company’s own experts take it over or adjust it.

Suggestion with reasons

Chapter 9

Management: Management duties under NIS2

Management cockpit with the duties of an important entity and their legal provisions

Management · 1 of 3

What management owes under NIS2

Often today: Management is liable but sees the status only once a year in a slide deck.
With Complass: The management cockpit shows Katharina Kellenbach and Dr. Martin Oberholz what applies to an important entity: implement risk management, report significant incidents, register, oversee the implementation and take training. Every duty comes with its legal provision.

What applies to you

Resolution on the risk management measures with the state of the confirmations, quarterly oversight and training status per member

Management · 2 of 3

Resolve, oversee, train, each one confirmed

Often today: That management approved the measures is shown at best by one sentence in the minutes of a meeting.
With Complass: Sabine Hartwig prepares the resolution on the risk management measures, and every member of management confirms it after signing in again. Oversight runs every quarter with a deadline, and the last training of every member is shown with its validity. Whatever is overdue or due soon stands out at once.

Resolution on the measures
Quarterly oversight
Training per member

Management duties record as a sealed PDF and as a working version

Management · 3 of 3

A management duties record that holds

Often today: What management decided and learned when has to be dug out of folders first when it really matters.
With Complass: The management duties record brings the resolutions, oversight, training and acknowledgements of management for a period together in one sealed PDF. Recipients check its authenticity on the verification page without signing in.

Management duties record

Chapter 10

Audit and access: Evidence and permissions

Audit export with the scope of the package

Audit and access · 1 of 2

The audit package on request

Often today: Before the audit someone spends days collecting documents, lists and evidence from folders.
With Complass: The audit export puts documents, catalogues, registers, evidence and logs into one ZIP file, with a start page and a checksum list. It holds only what the requesting person may read; every export is recorded in the customer log.

Scope of the export

Permissions per person and area with filter

Audit and access · 2 of 2

Who may do what, evidenced for the audit

Often today: Who may access what is spread across systems and e-mails, and the overview for the audit is rebuilt every time.
With Complass: For every person and area it is set: no access, read or write, plus special rights such as export or approval. The overview can be filtered and exported as evidence.

Who may do what?
Rights per area

Chapter 11

Automatic evidence: Checks from your own systems

Connection to Microsoft Entra ID and Microsoft 365 with the results of the checks and the last and next run

Automatic evidence · 1 of 3

Complass reads the settings every day

Often today: For the audit someone takes screenshots of the admin console, which may be out of date the next day.
With Complass: The connection to Microsoft Entra ID and Microsoft 365 reads settings such as the MFA requirement, strong sign-in for administrators or the number of global administrators once a day, read-only. Every check gets a traffic light; numbers and results are stored, not names of people. A GitHub organisation can be connected the same way.

Checks with a traffic light
Daily run

Requirement of the Statement of Applicability with a status suggestion from a failed automatic check and the automatic evidence from Microsoft Entra ID

Automatic evidence · 2 of 3

The evidence sits at the requirement

Often today: Whether a requirement is still met is checked again only shortly before the next audit.
With Complass: In the Statement of Applicability the access control requirement shows which automatic checks evidence it, with result, age and history. Because one check fails, Complass suggests “partially implemented” here and names the reason; the suggestion is only taken over by hand.

Status suggestion with its reason
Automatic evidence at the requirement

Overview of automatic evidence with the state of all checks and the evidence sources

Automatic evidence · 3 of 3

All checks at a glance

Often today: Which evidence is out of date usually only shows when the auditor asks for it.
With Complass: The overview shows how many checks are fine, expire soon or have failed, and which source they come from. Besides the connectors, your own systems such as backup or the build pipeline deliver results through the API.

State of all checks
Evidence sources

Your next step: Complass with your own data

Set up your trial yourself, 14 days free of charge and without payment details. Or we show you Complass in a demo tailored to your frameworks.

Try for free Request a demo

Check applicability Packages and prices