Complass – Navigate compliance Complass – Navigate compliance

Who it’s for

Complass for suppliers and service providers

Your customers fall under NIS2, the CRA or their own security requirements and therefore ask about your information security. Even if you are not covered yourself, you need reliable answers. With Complass you answer requests completely and have your evidence ready at any time.

Why your customers ask

The requirements do not come directly from the legislator but via your customers. Typical reasons:

Frameworks: ISO 27001 · NIS2 · GDPR · IEC 62443 for integrators and service providers · TISAX

  • NIS2 entities must take the security of their supply chain into account and pass requirements on to their suppliers § 30 Abs. 2 BSIG§ 30 BSIG Risikomanagementmaßnahmen besonders wichtiger Einrichtungen und wichtiger Einrichtungen(1) Besonders wichtige Einrichtungen und wichtige Einrichtungen sind verpflichtet, geeignete, verhältnismäßige und wirksame technische und organisatorische Maßnahmen, die in Absatz 2 konkretisiert werden, zu ergreifen, um Störungen der Verfügbarkeit, Integrität und Vertraulichkeit der informationstechnischen Systeme, Komponenten und Prozesse, die sie für die Erbringung ihrer Dienste nutzen, zu vermeiden und …As of: 26.09.2026 · Source: gesetze-im-internet.deOpen original (gesetze-im-internet.de) ↗
  • Under the CRA, manufacturers must exercise due diligence when selecting supplied components Art. 13 CRAArticle 13 Cyber Resilience Act Obligations of manufacturers1. When placing a product with digital elements on the market, manufacturers shall ensure that it has been designed, developed and produced in accordance with the essential cybersecurity requirements set out in Part I of Annex I. 2. For the purpose of complying with paragraph 1, manufacturers shall undertake an assessment of the cybersecurity risks associated with a product with digital elements and take the outcome …As of: 06.10.2026 · Source: EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025Open original (EUR-Lex – OJ L 2024/2847, 20.11.2024, corrigenda incorporated: OJ L 2024/90780, 5.12.2024; OJ L 2025/90555, 2.7.2025; OJ L 2025/90828, 17.10.2025) ↗
  • Operators of OT plants require a security programme per IEC 62443-2-4 from integrators and maintenance service providers
  • Many customers require questionnaires, security clauses in the contract and evidence such as ISO 27001 certification or a TISAX label

Not sure which frameworks apply to you? Start the applicability check

Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator

General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.

Typical companies

IT service providers and agencies

Hosting, software development, support: your customers check whether you handle their data and systems securely.

Maintenance, service and integration

Anyone with remote access to plants is asked about IEC 62443-2-4 and clear access rules.

Logistics, engineering firms and manufacturing partners

Even without providing IT services, customers ask about contingency plans, access protection and reporting channels.

How Complass helps

Free supplier access

You answer self-assessments from your customers who use Complass in a free access, with one account for all customers.

More about this feature

ISO 27001, pragmatically

Build an ISMS without prior knowledge, with templates, Statement of Applicability and all mandatory documents.

More about this feature

Evidence for customers

Export the status report and requirements catalogue as PDF or Excel and hand them to your customers.

More about this feature

Data protection

Document data processing and technical and organisational measures under the GDPR.

Matching offers

available

Framework TISAX / VDA ISA

  • Self-assessment along the VDA ISA with maturity levels
  • Preparation for the TISAX assessment
  • Prototype protection and data protection in their own phases

from €179 per month plus VAT in the Start package, size S, annual payment

All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.

Frequently asked questions

What does the supplier access cost?

The supplier access, in which you answer your customers’ self-assessments, is free of charge.

We are not covered by NIS2. Why should we act anyway?

Because your customers are. They must assess risks in their supply chain and therefore ask for evidence. Answering quickly and completely gives you an advantage in tenders and renewals.

Is a self-assessment enough, or do we need certification?

That is up to your customer. Many start with a self-assessment and later ask for further evidence or certification. With Complass you build your ISMS so that ISO 27001 certification can be the next step.

Try Complass with your own data

Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.