Who it’s for
You are an information security officer, a CISO or head of IT. You implement the requirements, keep operations running and report to management. Complass links frameworks with assets, vulnerabilities, risks and incidents, so that evidence comes out of your daily work.
Requirements, evidence and measures are scattered. Before every audit the search starts again.
NIS2, ISO 27001 and customer requirements ask for much of the same. Without mapping, every measure is documented several times.
Alongside operations and projects there is little time for documentation, management reports and customer questionnaires.
Under NIS2 these are mainly the following duties, for which you are responsible in practice:
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
Data protection officers. Complass covers data protection as a baseline: the GDPR as a framework, technical and organisational measures and data breaches with the 72-hour deadline. This helps above all where data protection and information security use the same measures. Complass is not a complete tool for data protection officers. Art. 33 GDPRArticle 33 GDPR Notification of a personal data breach to the supervisory authority1. In the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than 72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in accordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification to the supervisory …Open original (EUR-Lex – consolidated version incl. corrigenda) ↗
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
Gap analysis, action plan and statement of applicability, with mapping between frameworks so that one measure fulfils several requirements.
More about this featureCapture IT and OT assets agentless, find known vulnerabilities and prioritise them in context.
More about this featureRecord incidents, check the reporting obligation and track the deadlines with a countdown.
More about this featureStatus, risks and open measures presented so that management can approve and supervise.
More about this feature
Start with the framework that is required first in your case. Further frameworks reuse the existing measures and evidence.
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
In most companies both work on the same measures, often it is even the same person. Complass separates the tasks through roles and permissions, not through separate tools.
Yes. You attach existing policies and evidence to the matching requirements instead of rewriting them.
No. You capture assets by import or agentless; Complass assigns vulnerabilities via vendor, product and version.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
