Complass
Frameworks
Each framework is a module with phases, guided steps, templates and a requirement catalogue. You book what applies to you and can expand at any time.
Information security
NIS2 and the German NIS2 Implementation Act
Risk management, registration, reporting obligations and management duties under the German BSI Act.
To the frameworkISO/IEC 27001:2022
From project mandate to a certification-ready ISMS, with Statement of Applicability and all mandatory documents.
To the frameworkTISAX® – preparing for the assessment
For suppliers and service providers of the automotive industry: choose labels and assessment level, self-assessment with maturity levels 0 to 5, prototype protection, data protection and corrective action plan.
To the frameworkBSI IT-Grundschutz
Approach according to BSI Standards 200-1 to 200-3 with Basic, Core or Standard Protection, built on Grundschutz++ and with the identifiers of Edition 2023.
To the frameworkNIST Cybersecurity Framework 2.0
For companies with international customers and insurers: current profile, target profile, tier and action plan under CSF 2.0, built from existing evidence.
To the frameworkIndustry and products
IEC 62443 – industrial cybersecurity
OT security under IEC 62443 in one package: one booking includes the modules for all three roles.
- Asset owners System under consideration, zones and conduits, security levels
- Integrators and service providers IEC 62443-2-4 and 3-3
- Manufacturers IEC 62443-4-1 and 4-2
Cyber Resilience Act (EU) 2024/2847
Product-related conformity: classification, Annex I, vulnerability handling, reporting obligations and CE marking.
To the frameworkMachinery Regulation (EU) 2023/1230
From scope to CE marking, focusing on the cybersecurity requirements for control systems.
To the frameworkRadio Equipment Directive – cybersecurity
Cybersecurity of connected radio products: scope and roles, requirements under Art. 3(3)(d), (e) and (f), harmonised standards (EN 18031), conformity assessment, documentation and the transition to the Cyber Resilience Act.
To the frameworkCybersecurity for medical devices (MDR/IVDR)
For manufacturers and suppliers in medical technology: secure development across the life cycle, minimum IT environment requirements, technical documentation, post-market surveillance and vulnerabilities.
To the frameworkNIST SSDF and OWASP SAMM
For manufacturers of software and devices: secure development under the 42 tasks of the NIST SSDF, maturity under OWASP SAMM and a bridge to the CRA and IEC 62443-4-1.
To the frameworkProduct safety: GPSR – Regulation (EU) 2023/988
For manufacturers, importers, distributors, web shops and online marketplaces: risk analysis, documentation, mandatory information, accident reporting and recall.
To the frameworkCritical infrastructure and sectors
German KRITIS Umbrella Act (KRITISDachG)
Physical resilience of critical facilities: applicability, registration, risk analysis, resilience plan and incident reporting. Applies in Germany only.
To the frameworkDORA – Digital Operational Resilience Act (EU) 2022/2554
For financial entities and their ICT service providers: ICT risk management, incident reporting, resilience testing, register of information and contractual requirements under Art. 30.
To the frameworkIT security in hospitals: Section 391 SGB V and B3S
For hospitals of every size: obligations under Section 391 SGB V and implementation of the sector-specific security standard “Medical care” (B3S), linked with NIS2 and KRITIS.
To the frameworkIT security guideline under Section 390 SGB V (KBV and KZBV)
For medical, psychotherapy and dental practices and medical care centres: all 92 requirements of the KBV and KZBV, graded by practice size, with evidence for the annual review.
To the frameworkData protection, data and AI
GDPR – General Data Protection Regulation
Accountability in practice: records of processing, legal bases, data subject rights, TOMs, processors, DPIA and data breaches.
To the frameworkAI Act (EU) 2024/1689
Record and classify AI systems, promote AI literacy, implement and evidence obligations as deployer or provider.
To the frameworkData Act (EU) 2023/2854
Data access for connected products: roles and SME exemption, data inventory, design for access, fair contract terms and cloud switching.
To the frameworkGerman Whistleblower Protection Act (HinSchG)
Internal reporting office with an anonymous reporting channel: deadlines for acknowledgement and feedback, confidentiality, protection against reprisals and deletion after three years. Applies in Germany.
To the frameworkContent is updated when laws or standards change. Legal texts are included in full in the portal, with the retrieval date.
In preparation
These frameworks are in preparation or coming soon. Do you need one of them? Get in touch and we will tell you how you can start today.
ISO 9001 – quality management In preparation
Build or transition a quality management system to the new 2026 edition: context, processes, risks and opportunities, control of documented information, internal audits and management review.
To the frameworkEnergy Industry Act (EnWG) and IT security catalogue In preparation
IT security for networks, energy facilities and digital energy services under sections 5c to 5e EnWG: clarify your role, implement the applicable IT security catalogue, report incidents and provide evidence.
To the frameworkEU GMP Annex 11 – Computerised systems Coming soon
For manufacturers of medicinal products and active substances: validate, operate and evidence computerised systems on a risk basis, ready for inspection.
21 CFR Part 11 – Electronic records and electronic signatures Coming soon
For companies with FDA-regulated records: scope, risk-based validation, operational controls, electronic signatures and inspection readiness.
Try Complass with your own data
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.