NIS2 · DORA · GDPR

NIS2 asks for evidence.Comply is where you keep it.

Auris Comply keeps frameworks, controls, evidence, audits and the incident clock in one workspace. Auris controls who gets in and records what they do. It supports your obligations; it does not make you compliant.

Configure your solution See the pieces

Explore the architecture

Frameworks, evidence, audits

Architecture illustration. Select a component to explore its role.

IN THE PRODUCT

Four things you can check.

FRAMEWORKS: 22
Seeded in Comply, including NIS2, DORA, GDPR, the EU AI Act, ISO 27001 and SOC 2, with cross-mappings between them.
INCIDENT CLOCK: 24 h · 72 h · 1 month
The NIS2 article 23 deadlines, tracked per incident with reminders. You send the notice; Comply records that you did.
EVIDENCE: Reviewed
Files up to 25 MB, links and versions, each with a validity date, go through submit and review.
AUDIT LOG: CSV · JSON
Auris exports its audit log, filtered, up to 50,000 rows at a time.

THE SITUATION

What the directive asks of you.

Three things that decide whether an audit goes well.

Ten areas of measures: Article 21 lists ten: risk analysis, incident handling, continuity, supply chain, secure development, effectiveness checks, hygiene and training, cryptography, access control and multi-factor authentication.
Reporting runs on a clock: An early warning within 24 hours, a notification within 72 hours, and a final report within one month of that notification.
Auditors ask for proof, not intent: A policy nobody can show was applied counts for little. The record of what was done, when and by whom is the deliverable.

THE PIECES

Three pieces, each with its own page.

Comply holds the work. Auris controls access. Vanguard tests from the outside.

01 COMPLIANCE

Auris Comply

Frameworks, evidence, audits

Adopt a framework, produce the statement of applicability, run the gap analysis, attach evidence to controls, plan audits with checklists and findings, and export reports as PDF.

Open Auris Comply

02 IDENTITY

Auris

Access that leaves a record

Passkeys and magic links, SSO through SAML or OIDC, roles you can stack, and an audit log you can export or stream. It supports the access-control and authentication measures.

Open Auris

03 TESTING

Vanguard

Authorised security testing, as an engagement

Altovar runs reconnaissance and scanning inside a signed scope, refuses anything outside it, keeps an append-only audit log and hands back a prioritised report. You get the report; there is no login.

Open Vanguard

Capabilities at a glance

Each component has a clear role.

Compare the pieces and what each one covers before defining your project.

Each component has a clear role.
Component	Role	What it covers
Auris Comply	Frameworks, evidence, audits	Adopt a framework, produce the statement of applicability, run the gap analysis, attach evidence to controls, plan audits with checklists and findings, and export reports as PDF.
Auris	Access that leaves a record	Passkeys and magic links, SSO through SAML or OIDC, roles you can stack, and an audit log you can export or stream. It supports the access-control and authentication measures.
Vanguard	Authorised security testing, as an engagement	Altovar runs reconnaissance and scanning inside a signed scope, refuses anything outside it, keeps an append-only audit log and hands back a prioritised report. You get the report; there is no login.

Your project

Define your starting point.

Choose the components you want to discuss. The summary follows your selection.

HOW IT STARTS

From zero to a first audit.

01
Adopt the frameworks that apply

Pick NIS2, DORA, GDPR or ISO 27001. Comply loads the controls and the mappings between them.
02
Run the gap analysis

Mark each control, then see what is missing and where maturity stands.
03
Attach evidence

Upload files or link to them, give each a validity date, and send it for review.
04
Prepare the audit

Build the audit programme, work through the checklists, record findings, invite the external auditor and export the report.

QUESTIONS

Questions we get.

Does Comply make us NIS2 compliant?

No. It helps you organise the work and keep the evidence. Whether you meet the directive is for you and your authority to decide.

Does it report to the authority?

No. It tracks the deadlines and records when you sent each notice. You file with your national authority; in Italy that is ACN.

Are the framework texts complete?

The NIS2 and DORA catalogues are condensed lists of twelve controls each, GDPR thirteen. ISO 27001 carries all 93. Read them against the source text.

Which other standards are in?

GDPR, the EU AI Act, the Cyber Resilience Act, ISO 27001, 9001, 22301 and 27701, SOC 2, PCI DSS, TISAX and more: 22 in all.

Who can see the evidence?

Evidence files are private and served through short-lived links. External auditors come in by invitation or a share link that you create.

WHAT THIS PAGE DOES NOT PROMISE

Read this before you plan around it.

These are the limits, stated before you ask.

No certification

We hold none, and Comply does not certify you. It helps you prepare for one.

No filing with the authority

Comply tracks deadlines and records that you sent a notice. It does not submit anything.

Condensed catalogues

NIS2 and DORA are summaries of twelve controls each, not the legal text.

Automatic evidence needs a human check

Automatically collected evidence still needs a person to check it before an audit.

Start with the framework you owe first.

Tell us which obligations apply and when the audit is. We will show Comply on your controls and say what it does not cover.

Talk to us All solutions

From the newsroom All articles →