Compliance
Compliance for NIS2, DORA and ISO 27001 from day-to-day operations
Regulation requires you to know your risks, treat them and prove that your measures are effective. This is exactly the data XMfortress produces continuously.
FIGNIS2 · DORA · ISO/IEC 27001
NIS2
Risk management measures under Art. 21 of the NIS2 Directive and the national implementing laws (in Germany: the NIS2 Implementation Act), including vulnerability handling, effectiveness assessment and supply chain security.
- Up-to-date asset inventory
- Risk-based vulnerability handling
- Regular effectiveness testing
DORA
ICT risk management for financial entities under Chapter II of Regulation (EU) 2022/2554: identification of ICT assets and risks, protection, detection and testing.
- Identification and classification of ICT assets
- Continuous vulnerability assessment
- Evidence of resilience testing
ISO/IEC 27001
Information security management system under ISO/IEC 27001:2022, including inventory of information and other associated assets (A 5.9) and management of technical vulnerabilities (A 8.8).
- Inventory with owners
- Traceable handling of technical vulnerabilities
- Metrics for management review
XMfortress supports the technical implementation and provides evidence. Responsibility for compliance remains with the company; the platform does not replace a legal assessment.
02FAQ
Frequently asked questions
Does XMfortress make us NIS2-compliant?
No software alone makes a company compliant. However, XMfortress covers key technical requirements – inventory, vulnerability handling, effectiveness testing – and provides the evidence for them.
Which reports are available?
Reports on the attack surface, open risks, remediation deadlines and validation results, each with history. They are suitable for audits, regulators and management.
Know your exposure.
Control your risk.
Contact
Talk to us about your attack surface, your priorities and the right way to get started with XMfortress.