fictional example company

Complass at Kellenbach: a tour in seven chapters

Kellenbach Maschinenbau is invented; the pictures show the real portal with the company’s sample data. Each step shows how things often work today and what Complass changes. Go through the chapters at your own pace; each one can be started on its own.

Family business, 380 employees, two plants in Hagen and Iserlohn
An important entity under NIS2
Manufacturer under the CRA and the Machinery Regulation, with its own KB Connect Gateway

Start the tour

Chapters

Overview All frameworks in one portal 3 steps Recommended start
From gap to action Gap analysis, applicability, actions 4 steps
Incident with a reporting deadline A running NIS2 incident 2 steps
Own product (CRA) KB Connect Gateway and KB Insight 5 steps
Hagen plant (OT) Zones, conduits and security levels 2 steps
Risks Assess, treat, report 3 steps
Audit and access Evidence and permissions 2 steps

Chapter 1

Overview: All frameworks in one portal

Kellenbach’s dashboard with overall progress, next audit, open tasks, maturity and running reporting deadlines

Overview · 1 of 3

Kellenbach’s status on one page

Often today: Anyone who wants to know where the company stands collects figures from spreadsheets, e-mails and project folders.
With Complass: The dashboard shows overall progress, the next audit, open tasks and maturity across all projects. Below it the reporting deadlines of the current incident keep running, and every tile leads straight to the list behind it.

20 frameworks in the portal

Overall progress across all projects
Running reporting deadlines

Framework overview: shared measures and the projects they count for

Overview · 2 of 3

Implement once, prove it for every framework

Often today: ISO 27001, NIS2 and the CRA ask for much of the same, and every requirement is kept in a list of its own.
With Complass: The framework overview links every shared measure to the projects it counts for. What is implemented and evidenced once counts for every framework that asks for it.

Shared measures
Effect per project

ISO 27001 project for the Hagen and Iserlohn plants with progress, next step and phases

Overview · 3 of 3

One project per framework, step by step to the audit

Often today: The project plan sits with one person, and only they know what comes next.
With Complass: The ISO 27001 project for both plants shows the progress of every phase and the next open step, one click away from working on it. Pre-audit and certification audit are dates in the project.

Your next step
Phases up to the audit

Chapter 2

From gap to action: Gap analysis, applicability, actions

Gap analysis with the maturity scale and the rating per area

From gap to action · 1 of 4

Where does Kellenbach stand today?

Often today: The gap analysis is the outcome of a workshop that nobody updates after a few months.
With Complass: Every shared measure is rated from “not in place” to “effective and reviewed”, with a target and a reason. Complass shows where the largest gaps are and, if you like, moves them straight into the action plan.

Maturity scale
Rating per area

Statement of Applicability for ISO 27001 Annex A with assessment status and export

From gap to action · 2 of 4

The Statement of Applicability as a controlled document

Often today: The Statement of Applicability is an Excel file whose reasons nobody can trace at the next audit.
With Complass: For every control of Annex A the catalogue records whether it applies, why, how far it is implemented and where the evidence is. After review the statement is released as a version and exported as Word, Excel or PDF.

Assessment status of the catalogue
Export as Word, Excel, PDF

Action plan with filters, owners, due dates and priorities

From gap to action · 3 of 4

Every gap becomes a task with a name and a date

Often today: Tasks from the audit and the gap analysis are scattered across e-mails, meeting notes and tickets.
With Complass: The action plan collects every task with owner, due date, priority and the framework that requires it. Owners get an e-mail on assignment and a reminder before the due date; anything overdue stands out at once.

Tasks with owner and due date
Filter by framework, priority and person

Comments with mentions and a resolved question on a task

From gap to action · 4 of 4

Questions where the work is

Often today: The discussion about a measure runs by e-mail and cannot be found at the next audit.
With Complass: Comments with mentions sit right on the task, and a question is marked as resolved. At the audit it is clear who checked and decided what.

Comments on the task

Chapter 3

Incident with a reporting deadline: A running NIS2 incident

Incident list with the running ransomware incident and its next reporting deadline

Incident with a reporting deadline · 1 of 2

Ransomware on the administration’s file servers

Often today: In an emergency the team first has to work out whether to report, to whom and by when.
With Complass: The running incident is recorded, assessed as reportable under NIS2 and shows its next deadline with the time left. Closed incidents, among them a CRA case on the company’s own gateway, stay traceable with every report.

3 incidents in the example

Open incident with its next deadline
Deadlines at a glance

Reporting stages of the NIS2 incident with deadlines, the submitted early warning and the open notification

Incident with a reporting deadline · 2 of 2

The NIS2 reporting stages with their deadlines

Often today: Someone works the deadlines out by hand under time pressure, and what was submitted is in an e-mail.
With Complass: Complass computes the deadlines from the moment of awareness: early warning, notification, final report. Submitted stages show time and reference number; the report itself goes through the portal of the competent authority, as required.

Next deadline
NIS2 reporting stages

Chapter 4

Own product (CRA): KB Connect Gateway and KB Insight

Vulnerability list with CVSS, KEV, priority, due date and owner

Own product (CRA) · 1 of 5

Vulnerabilities by urgency, not by arrival

Often today: Scanner reports arrive as PDFs, and gut feeling decides which finding is fixed first.
With Complass: All findings are in one list with CVSS, the flag for actively exploited vulnerabilities (KEV), priority, due date and owner. At the top is what is exploited and reachable.

Findings by priority

Finding on the KB Insight customer portal with CVSS, KEV, SSVC decision and the affected asset

Own product (CRA) · 2 of 5

One finding with everything the decision needs

Often today: CVE number, rating and affected system sit in three different tools.
With Complass: The finding on the company’s own customer portal KB Insight shows the rating, the KEV entry and the SSVC decision next to the affected asset and its exposure to the internet. That is the reason it is handled at once.

Rating of the vulnerability
Affected asset

Recommended actions for a finding with source and “Add as action”

Own product (CRA) · 3 of 5

From finding to action

Often today: What to do is scattered across vendor notes, databases and forums.
With Complass: Every finding comes with its recommended actions and their source: the vendor’s update, the CISA requirement, a general measure for the type of weakness. One click turns one of them into a task with a due date.

Recommended actions with source

SBOM of the KB Connect firmware with components, licences and open vulnerabilities

Own product (CRA) · 4 of 5

The SBOM of the KB Connect Gateway

Often today: Development knows which components are in the firmware; product management and support do not.
With Complass: The SBOM shows the firmware with boot loader, kernel and libraries, their licences and open vulnerabilities. It is imported from CycloneDX, matched against new vulnerabilities as they appear and exported in a standard format.

Components of the firmware
Export in a standard format

Security advisory of a sample vendor with the company’s own affected assets

Own product (CRA) · 5 of 5

Matching vendor advisories to your own devices

Often today: Security advisories from suppliers arrive by e-mail, and someone checks by hand whether the company’s own devices are affected.
With Complass: Advisories in the CSAF format are imported and matched to the company’s own assets by model and version. The list shows at once which device is affected and which one is still being investigated.

Your affected assets
Export

Chapter 5

Hagen plant (OT): Zones, conduits and security levels

Zones and conduits of the Hagen plant with figures and the network plan by Purdue level

Hagen plant (OT) · 1 of 2

Zones and conduits with target and achieved level

Often today: The zone model is a drawing from the last project that is wrong after the next rebuild.
With Complass: The Hagen plant is divided into zones and conduits according to IEC 62443. Complass shows the gaps between target and achieved security level and observed traffic without an approved conduit, also in the network plan by Purdue level.

Zones, conduits and SL gaps
Network plan by Purdue level

Asset inventory with zone, owner and protection need

Hagen plant (OT) · 2 of 2

One inventory for IT and OT

Often today: IT keeps the servers, and each plant keeps its own list of machines and controllers.
With Complass: Servers, workstations, controllers and operator panels are in one inventory with zone, protection need and owner. Open and visible: the assets at the Iserlohn plant have no zone yet, the OT project there follows in 2027.

38 assets recorded

Inventory with zone and protection need

Chapter 6

Risks: Assess, treat, report

Risks · 1 of 3

One risk register for the whole company

Often today: Risks are in a list that is refreshed once a year for the audit.
With Complass: Every risk has a rating, a treatment, a risk owner and the date of its next review, linked to assets, vulnerabilities and actions. Register, heat map and method are on one page.

12 risks assessed

Risk register
Register, heat map and method

Heat map with inherent and residual risk side by side

Risks · 2 of 3

Before and after at a glance

Often today: For management the heat map is rebuilt in a slide deck every quarter.
With Complass: The heat map comes from the register: inherent risk on the left, residual risk after the implemented measures on the right. A click on a number opens the risks behind it.

Inherent and residual risk

Assessment of a risk with a non-binding suggestion and its reasons

Risks · 3 of 3

A suggested rating, the decision stays in-house

Often today: Every assessment starts from scratch, and every department rates by its own yardstick.
With Complass: Complass derives a suggestion from the protection need and exposure of the linked assets and the open vulnerabilities, and names the reasons. The suggestion is not binding; the company’s own experts take it over or adjust it.

Suggestion with reasons

Chapter 7

Audit and access: Evidence and permissions

Audit export with the scope of the package

Audit and access · 1 of 2

The audit package on request

Often today: Before the audit someone spends days collecting documents, lists and evidence from folders.
With Complass: The audit export puts documents, catalogues, registers, evidence and logs into one ZIP file, with a start page and a checksum list. It holds only what the requesting person may read; every export is recorded in the customer log.

Scope of the export

Permissions per person and area with filter

Audit and access · 2 of 2

Who may do what, evidenced for the audit

Often today: Who may access what is spread across systems and e-mails, and the overview for the audit is rebuilt every time.
With Complass: For every person and area it is set: no access, read or write, plus special rights such as export or approval. The overview can be filtered and exported as evidence.

Who may do what?
Rights per area

Your next step: See Complass with your example

In the demo we show you Complass with a sample project tailored to your frameworks. Or check first which frameworks apply to you.

Request a demo Check applicability Pricing