Who it’s for
You are responsible for cybersecurity. Complass shows you the state clearly, without you having to know every requirement.
The duties lie with management itself and cannot be fully handed over to IT or service providers.
Reports from IT and departments are technical, scattered and hard to compare. Where does the company really stand?
Who approved which measure when, and which risk is knowingly accepted, has to be provable later.
For entities that fall under NIS2, the law names management explicitly:
Frameworks: NIS2 · ISO 27001 · KRITIS Umbrella Act · DORA
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Progress per framework, open measures and deadlines in one overview, understandable without specialist knowledge.
More about this featureDocument resolutions on measures, the supervision of their implementation and the training of management, with deadlines and reminders.
More about this featureSee risks with assessment and risk appetite, record treatment or acceptance, with date and person.
More about this featureThe free check shows in a few minutes whether NIS2 and other frameworks apply to your company.
To the applicability check
If your company falls under NIS2, this selection covers the obligations in Complass. The free applicability check shows whether it does.
minimum selection management
€199 net per month
Recommended
€590 net per month
More impact with Asset management and zones, Supplier Management and Business continuity management (BCM), room for 10 users and 2 frameworks.
Prices for businesses, net plus VAT, with annual payment and a 12-month minimum term. Monthly payment with a 15 % surcharge. As of 6 November 2026. Enterprise and groups of companies on request. All packages in the price overview
You can also meet the obligations without Complass. Complass supports implementation and evidence and does not replace legal advice. Legal information
You need to be able to assess risks and measures, which is why the law requires regular training. Information security and IT handle the detailed implementation; Complass presents the status to you in plain terms.
The duties under Section 38 BSIG apply to entities under NIS2. Regardless of this, customers, insurers and banks increasingly ask for evidence. The free check shows whether NIS2 applies to you.
Complass offers consulting itself, from the assessment to the first action plan. Get in touch with us.
White papers: The management body is liable: what § 38 BSIG requires from managing directors NIS2 for companies in every sector: directly in scope or via your customers
Other job roles and sectors: Information security and IT Procurement and supplier management Critical infrastructure All audiences at a glance
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
