available
Framework GDPR
- Records of processing, TOMs and processing on behalf
- Data breaches with the 72-hour deadline
from €79 per month plus VAT in the Practice package, size S, annual payment
Who it’s for
For procurement: Assess suppliers without questionnaire ping-pong
Complass helps you classify suppliers and request and review evidence, without questionnaires by email.
The challenge
Many suppliers, little time
Not every supplier is equally critical. Without classification, all of them get the same long questionnaire, or none.
Evidence by email
Certificates and self-assessments arrive as attachments, expire and cannot be found at the next audit.
Requirements from several laws
NIS2, the GDPR and DORA each set their own supply chain requirements, and the departments expect an answer from procurement.
What concerns the supply chain
Depending on the company, one or more of these requirements apply:
- Supply chain security as part of risk management, including relationships with direct suppliers and service providers Section 30 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …Open original (gesetze-im-internet.de) ↗
- Only use processors that provide sufficient guarantees and bind them by contract Art. 28 GDPRArticle 28 GDPR Processor1. Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject. 2. The processor shall not engage another processor without prior specific …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
- In the financial sector: manage ICT third-party risk, with a register of information and contract requirements Art. 28 DORAArticle 28 DORA General principles1. Financial entities shall manage ICT third-party risk as an integral component of ICT risk within their ICT risk management framework as referred to in Article 6(1), and in accordance with the following principles: - (a) financial entities that have in place contractual arrangements for the use of ICT services to run their business operations shall, at all times, remain fully responsible for compliance with, and …Open original (EUR-Lex) ↗
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
How Complass helps
Classify suppliers
Classify suppliers by criticality and set the appropriate scope of evidence.
More about this featureRequest evidence directly
Request self-assessments and evidence directly from the supplier, review them and ask for more where needed. With questionnaires for NIS2, GDPR, ISO 27001, the CRA and IEC 62443-2-4.
More about this featureSupply chain risks
Assess supplier risks in the risk register and follow up measures, together with information security.
More about this featureMatching offers
Supplier requirements usually arise from NIS2, the GDPR or ISO 27001. You can use supplier management with each of these frameworks.
available
Framework ISO/IEC 27001
- From project mandate to a certification-ready ISMS
- Statement of Applicability and all mandatory documents
- Document measures once, use them for several frameworks
from €199 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 6 November 2026. Enterprise and groups of companies on request.
Frequently asked questions
Do our suppliers have to buy Complass?
No. Suppliers receive an invitation and answer the request in a supplier access of their own.
We are a supplier ourselves. Does this help us too?
Yes. For companies that provide evidence to their customers there is a separate page for suppliers and service providers.
White papers: NIS2 for companies in every sector: directly in scope or via your customers
Other job roles and sectors: Suppliers and service providers Information security and IT Finance and insurance All audiences at a glance
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.