Integrated GRC for DORA and NIS2

Bring controls, risks, policies and evidence together for DORA, NIS2, GDPR and the EU AI Act. Your team works to consistent standards, stays audit-ready and captures every piece of information only once.

Owners, implementation status and deviations are visible at all times. That speeds up decisions, creates clear accountability and keeps your risk management current, from small institutions to large groups.

Book a meeting 30 minDemo access
  • Developed and hosted in Germany
  • Dedicated instance per customer
  • Data processing agreement under Art. 28 GDPR

Laws and guidelines

  • DORA
  • NIS2
  • GDPR/BDSG
  • EBA Guidelines
  • EU AI Act

Standards and frameworks

  • ISO 27001
  • BSI C5
  • SOC 2
  • NIST CSF 2.0

Inside the platform

ForInformation security officersCISOsICT risk managersOutsourcing officersData protection officersAI officersEUC coordinationSOC analystsManagement board

Connected to

    Founder and advisory board

    More than 20 years of combined audit and implementation experience with MaRisk, BAIT, DORA and ISO 27001. First we audited and advised institutions, then we were responsible for information security ourselves. Both are built into Intertwined.

    1. PwC

      Audited and advised

      Many years as IT auditors and IT advisors for banks and financial service providers: IT audits within statutory financial statement audits, internal control system audits under ISAE 3402 and ISAE 3000 against MaRisk and BAIT, special audits under Section 44 KWG.

    2. BitGo Europe · BaFin-regulated

      Responsible

      Information security at a BaFin-regulated crypto custodian: DORA implementation including the register of information and third-party risk, resilience testing, data protection. Interface to BaFin and Bundesbank, support of the MiCAR licensing procedure.

    3. Intertwined

      Built what we were missing

      Everywhere we saw the same picture: ISMS, service providers and cybersecurity in separate tools and contradictory spreadsheets. In Intertwined everything is integrated: you maintain every piece of information once, from service provider to risk to control, and findings from the platform's own scans land directly on the affected system. Following the principle of proportionality, the platform adapts to your organisation.

    Portrait of Max Ceburkov

    Max Ceburkov

    Founder and Managing Director of c.curity GmbH
    • Founder and Managing Directorc.curity GmbH
    • Deputy CISO and Head of Information Risk ManagementBitGo Europe
    • IT auditor and IT advisorPwC
    CISMISO 27001 PractitionerLinkedIn ↗
    Career in detail
    • Deputy CISO and Head of Information Risk Management at BitGo Europe, a BaFin-regulated crypto custodian: DORA implementation including the register of information, third-party risk and resilience testing, data protection, managing internal and external audits
    • IT auditor and IT advisor at PwC: audits and advisory for banks and financial service providers, internal control systems under ISAE 3402 Type II and ISAE 3000, MaRisk and BAIT, DORA advisory, follow-up of special audits under Section 44 KWG
    Portrait of Antonios Pavlidis

    Antonios Pavlidis

    Advisory board
    • Head of Digital Sales & ProductsBaFin-regulated investment management company
    • CISO and Deputy Managing Director (risk and operations)BaFin-regulated crypto custodian
    • IT auditor and IT advisor, most recently ManagerPwC
    CISALinkedIn ↗
    Career in detail
    • Today Head of Digital Sales & Products at a BaFin-regulated investment management company
    • CISO and Deputy Managing Director (risk and operations) at a BaFin-regulated crypto custodian: led the DORA programme and the MiCAR licensing procedure through to BaFin authorisation, main point of contact for the supervisory authorities
    • Ten years as IT auditor and IT advisor at PwC, most recently as Manager: IT audits within statutory financial statement audits, ISAE 3402 and ISAE 3000, MaRisk and BAIT, support for special audits under Section 44 KWG at banks and IT service providers, DORA implementations

    Laws and guidelines

    • DORA
    • NIS2
    • GDPR and BDSG
    • EBA Guidelines
    • EU AI Act

    Standards and frameworks

    • ISO 27001
    • BSI C5
    • SOC 2
    • NIST CSF 2.0

    Request demo access

    You receive personal access to the Intertwined demo environment: a fictitious institution with consistent sample data and all modules enabled.

    • All modulesISMS, DORA, ICT risk, audit and incidents, data protection and cybersecurity in one interface.
    • Connected sample dataThe sample institution's processes, service providers, risks and incidents reference each other, just like in live operation.
    • Set up personallyWe create your access and, if you like, walk you through the platform in a 30-minute call.

    Required field

    The demo environment contains fictitious data only. We use your details exclusively for your request and for setting up your access.

    Areas of the platform

    Nine areas, from ISMS to DORA and third parties to cybersecurity, EUC and AI governance. All of them work with the same processes, systems and service providers, including the findings from scans and vulnerability sources.

    ISMS

    The ISMS is where your inventory is built. You record processes and assets, assess them with a business impact analysis and protection requirements, and link them to domains and service providers.

    • Process inventory with assessment statusClassification as a critical or important function, business impact analysis, protection requirements, RTO and RPO per process.
    • Business impact analysis per processImpact over time, RTO, RPO and MTD per business process, with an availability result and approval.
    • Policies per frameworkThe expected documents per framework: published, in progress or missing. The same policy counts towards several frameworks.
    • Business continuity managementContingency plans, exercises and crisis team.
    • Training with evidenceAssign, deliver and evidence courses for ISO 27001, NIS2, DORA, GDPR and the AI Act.
    • KPIs with thresholdsKPIs with definition, ownership, thresholds and trend. Breaches trigger an alert.
    • Report to the management boardCISO report from live data, as PDF and annual report.

    DORA

    Critical or important functions reference processes; the ICT testing plan references functions, assets and outsourcing arrangements. The register of information holds the related service providers and contracts.

    • Contracts in the register of information under DORA Art. 28Provider, supported function, criticality and term per contract, checked for completeness. Arrangements can be taken over from third-party management. More on the register of information
    • Critical or important functionsClassification under Art. 3(22) DORA with rationale, linked to processes, service providers and the testing plan.
    • ICT testing plan with findingsTests per critical function, asset and outsourcing arrangement in the annual plan. Findings can be taken over as risks.
    • Review of the ICT risk management frameworkThe framework is reviewed, approved and evidenced annually and on specific occasions.

    Third-party risk management

    From onboarding through ongoing monitoring to exit, in line with DORA and the EBA Guidelines. Every arrangement is linked to functions, processes and the register of information.

    • Service provider status pages monitoredThe platform continuously checks your service providers' status pages. You see outages and incidents in one place instead of visiting each page.
    • Availability and incident historyAvailability over the last twelve months and all reported incidents per service provider, as a basis for assessment and exit decisions.
    • Onboarding with questionnaireQuestionnaire depending on criticality and progress of the contractual clauses under Art. 30 DORA through to approval. Classification also under KWG, VAG or ZAG.
    • Risk per arrangementRisk derived from criticality and control gaps. You take conspicuous arrangements over into the risk register.
    • Ongoing monitoringReviews, controls and contract deadlines per arrangement, including evaluation of SOC reports.
    • Concentration and exitConcentration risk by country and supply chain, including AI providers. Exit strategies per critical function under Art. 28(8) DORA.

    ICT risk and compliance

    A risk names the affected processes and assets. You take over findings from tests, audits, incidents and scans as risks, and their origin stays visible on the risk.

    • Risk register with inherent and residual assessmentThreat, affected processes and assets, treatment and status of measures per risk. The change from inherent to residual risk is shown in the same row.
    • Self-assessment per requirementImplementation status per catalogue and domain, for example for DORA. Legal requirements and voluntary standards are assessed in the same system.
    • Hardening per protection requirementFrom an asset's protection requirements for confidentiality and integrity, the platform derives how deeply it must be hardened and which requirements apply at each level.
    • Maturity under NIST CSF 2.0Self-assessment against the NIST Cybersecurity Framework, with current and target score per function from Govern to Recover. The chart shows where the gap to the target is largest.
    • Controls linked to requirementsControl register with effectiveness and evidence. One control covers several requirements from different frameworks.

    Audit and incidents

    An incident names the affected processes, assets and service providers. The platform calculates the reporting deadlines under DORA from classification and under NIS2 from awareness of the incident.

    • Audit findings with deadline and statusFindings from internal and external audits with severity, due date and progress. Overdue findings are highlighted.
    • Audit programmeThe audits planned for the year with scope, date and status.
    • Incident file with reporting deadlinesSituation overview, classification under DORA or NIS2, reporting with the running deadlines and follow-up in one file.
    • Report to BaFin as a fileInitial, intermediate and final report as a file for upload to the MVP portal, checked for completeness beforehand.
    • Contingency plan from the incidentFrom the incident file you trigger the matching contingency plan; the crisis team works in the same platform.

    Data protection

    Processing activities reference processes and assets. Processors are the service providers from third-party risk management.

    • Data subject requests with deadline and ownerReceipt, assignment and deadline under Art. 12 GDPR per request. Overdue cases are highlighted.
    • Record of processing activitiesProcessing activities under Art. 30 GDPR, linked to processes, assets and processors.
    • Data breaches with 72-hour deadlineCapture, risk assessment and notification under Art. 33 GDPR. The platform monitors the 72-hour deadline.
    • Data map, TOMs, DPIA and deletion conceptData flows across systems and service providers, technical and organisational measures, data protection impact assessment and deletion concept.

    Cybersecurity

    Cybersecurity checks your systems from the outside. Discovered hosts become assets, vulnerabilities are attached to the asset, and the check for data leaks also covers your service providers.

    • Vulnerabilities per system from connected sourcesFindings from SIEM and vulnerability sources, imported read-only and mapped to the systems in your inventory. Actively exploited vulnerabilities are flagged.
    • Hardening test with results overview and findingsFor each test the steps of the playbook with their result, the findings with severity and recommendation, and the overall verdict. Findings can be taken over as risks, and the test can be booked as an ICT test.
    • All cyber featuresAttack surface, data leaks, security advisories, code review, awareness tests and more: Cybersecurity in operation

    EUC management

    End-user computing (EUC) under MaRisk (AT 7.2): every department reports its EUC applications or submits a nil return. AI prepares the documentation and tests; your team reviews and approves.

    • Reporting cycle per departmentHeads of department report their EUC applications or confirm with a nil return that there are none. The status per department is visible at any time.
    • EUC inventory with mandatory detailsEvery EUC application with owners, criticality and links to processes and systems, managed by EUC coordination.
    • File analysisFrom the uploaded Excel, Access or Power BI file, the platform reads sheets, formulas, defined names and macros.
    • Documentation with AIDrafts of user, functional and technical documentation via your connected AI provider. Subject-matter questions add what the file does not reveal: purpose, users and the consequences of an outage.
    • Functional and technical testsTake over test cases from your existing test workbook instead of retyping them, supplemented by test suggestions from AI.
    • Approval with a frozen versionEvery approval locks the documentation and evidence of that version. Your team reviews and approves instead of writing everything itself.

    AI governance

    All AI systems in your organisation in one place, assessed under the EU AI Act and linked to the information domain.

    • AI inventoryEvery AI system with its own AI file, fed from the information domain.
    • Prohibitions under Art. 5 AI ActBefore every assessment, 9 exclusion questions, for example on social scoring or emotion recognition in the workplace. If one applies, the system must not be used.
    • Risk class with scoreClassification as high-risk under Annex III, with transparency obligations under Art. 50, or as minimal risk.
    • Obligations and controls10 binding obligations with their effective dates, for example AI literacy under Art. 4, and 36 controls, 6 of them required by law.
    • AI security analysisThreat analysis for the AI system, derived from its classification, with references to matching controls.
    • Approval, versions and reportAssessment with approval note, version history and report as PDF. You take residual risks over into the risk register.

    From cyber finding to measure

    Vulnerability scans, leak alerts and test results usually sit in separate tools or with a service provider. In Intertwined, every finding lands on the affected system, and you track it as a risk through to an evidenced measure.

    1. 1

      A finding comes in

      In this example, the cyber feed reports CVE-2024-4577.

      Cyber feed · attack surface scan · SIEM · vulnerability scanner · leaks · hardening tests

    2. 2

      System affected

      Match in the inventory: customer onboarding portal.

    3. 3

      Process at risk

      It supports customer onboarding & KYC, a critical function.

    4. 4

      Risk assessed

      Leak of KYC and customer data, gross rating high.

    5. 5

      Measure takes effect

      Two measures bring the risk down to medium. The red peaks disappear, the landscape turns flat and green.

    Cyber feed showing CVE-2024-4577 among the findings that affect us now
    2 · AssetCustomer onboarding portalopen finding · CVSS 9.8
    3 · Process P-03Customer onboarding & KYCcritical function under DORA
    Risk landscape before measures: high red peaks Risk landscape after measures: flat green terrain

    In this example: leak of KYC and customer data High · 12Medium · 6

    Where the findings come from

    Ten features in three groups. All are included in every licence and feed their findings into the same chain.

    Attack surface and leaks

    What attackers can find out about you from the outside.

    • Attack surface monitoring

      Domains, subdomains, open services, TLS and email security, checked continuously from the outside.

    • Leaked credentials

      Leak and dark web intelligence from specialised providers: for employees, customers and specifically the management board.

    • Secrets in public code

      Keys and passwords accidentally published in public code repositories.

    • Wi-Fi exposure

      Checks whether non-public sites or data centres can be located through Wi-Fi network names.

    Vulnerabilities and threat landscape

    Where your systems are vulnerable and what is currently being reported.

    • SIEM and vulnerability integration

      Vulnerabilities per system via API from your SIEM or scanner.

    • Cyber feed

      Security and supervisory advisories in one place, including BaFin and CERT-Bund. Named vulnerabilities (CVEs) are matched against your systems.

    • AI code review

      Check code and dependencies with your own AI and a vulnerability database.

    • OWASP Top 10

      Assess applications against the OWASP Top 10 (2025), with a report for the audit.

    Tests and awareness

    Whether systems and employees withstand an attack.

    • Attack and hardening tests

      Playbooks for simulated attacks per system, for example a database or laptop, booked as an ICT test under DORA.

    • USB drop and QR quishing

      Place prepared USB sticks and QR codes and evaluate who takes the bait.

    Content and features at a glance

    1,785

    Requirements from 9 laws and standards (GDPR and BDSG counted separately), prepared article by article as a requirements catalogue. For each requirement you assess the implementation status and map your controls.

    • DORA 630
    • NIS2 307
    • GDPR/BDSG 320
    • EBA Guidelines 94
    • BSI C5 174
    • NIST CSF 2.0 106
    • ISO 27001 93
    • SOC 2 61
    70
    policy templateswith approval and versions
    15/15
    sheets of the register of informationchecked against the EBA validation rules, export as XBRL-CSV
    67/67
    fields of the BaFin incident reportdeadlines for initial, intermediate and final report calculated from classification
    47
    BSI elementary threatsstored for risk analysis
    21
    predefined roles, checked for segregation of dutiesAuthorisation concept as PDF for your auditors, unlimited users

    Data protection and security

    Data protection

    • Data residency

      Data and application in data centres in Germany. Data leaves the EU only for add-on services that you switch on.

    • Data processing

      Agreement under Art. 28 GDPR. We disclose the sub-processors before you sign.

    • Data return

      Export of your data as XBRL-CSV, CSV, XLSX or PDF, including at the end of the contract.

    • AI features

      AI is off by default. AI features such as the assistant, EUC documentation or code review only run once your administrator connects your own AI provider via API, for example ChatGPT, Claude, Gemini, Mistral or Grok. You pay for usage directly to the provider.

    Security

    • Encryption

      Data and backups are stored encrypted and transmitted encrypted.

    • Dedicated instance per customer

      Every institution gets its own instance. Your data does not share a database with other customers.

    • Secure development

      Automated tests, vulnerability and secret scans on every change, infrastructure as code and penetration tests of the platform.

    Access and users

    • Authorisation concept

      21 roles, checked for segregation of duties. The database checks every access, and you export the concept as PDF.

    • Sign-in

      Two-factor sign-in via app, with optional single sign-on via Microsoft Entra ID or Google.

    Traceability

    • Logging

      Changes and sign-ins are logged immutably and retained for at least 12 months.

    • Approvals and point-in-time snapshots

      Four-eyes approval and frozen point-in-time snapshots for internal and external audits.

    Market comparison

    Other solutions cover some of these capabilities. The difference lies in the connection: in Intertwined, every area works with the same processes, systems and service providers instead of maintaining the same data in separate tools.

    FeatureDocumentsExcel, Word, PDFPoint solutionsone tool per areaLarge GRC suitescross-functionalIntertwined
    DORA and NIS2 article by article as requirementspartlylargelylargelyfully
    One data model for all areasusually not includedusually not includedlargelyfully
    Deadlines monitored by the systemusually not includedpartlylargelyfully
    Attack surface and data leaks integratedusually not includedlargelyusually not includedfully
    Price independent of the number of userspartlypartlyusually not includedfully
    Developed and hosted in Germanypartlylargelypartlyfully

    fully largely partly usually not includedTypical characteristics per approach. Assessment by c.curity GmbH, as of September 2026.

    One platform instead of ten specialist vendors

    Covering the same scope with point solutions would take around ten specialist vendors, including ISMS, third-party management, attack surface monitoring and EUC. Combined annual costs typically amount to:

    Employees
    Ten specialist vendorstypical combined annual costaround €281,000
    Intertwinedeverything in one licence€36,000in the first year · then €45,000Offer until 31 Dec 2026

    Point solutions cost around 6 times as much.

    Show typical specialist vendor prices per area
    Specialist vendor forup to 100101–500501–1,500
    GRC and ISMS software€20,000€45,000€70,000
    Third-party risk management€18,000€35,000€70,000
    Attack surface monitoring€18,000€40,000€65,000
    Leaked credential monitoring€22,000€30,000€56,000
    Awareness training€4,000€9,000€25,000
    EUC management€18,000€25,000€40,000
    AI governance€15,000€35,000€60,000
    Security review of code (staff share)*€17,000€34,000€67,000
    Data protection management€1,000€3,000€10,000
    Business continuity management with BIA€10,000€25,000€45,000
    Totalaround €143,000around €281,000around €508,000

    Typical annual prices based on list prices and market data, as of October 2026. * The customer bears the AI provider's API costs.

    Pricing by company size

    One annual licence with the full feature set. The price depends on the number of employees, not the number of users.

    −20%

    valid until 31 December 2026*

    −20 %

    Intertwined S

    up to 100 employees
    instead of €22,500€18,000€22,500per yearIntroductory offer in the first year for contracts signed by 31 Dec 2026, then €22,500
    −20 %

    Intertwined M

    101 to 500 employees
    instead of €45,000€36,000€45,000per yearIntroductory offer in the first year for contracts signed by 31 Dec 2026, then €45,000
    −20 %

    Intertwined L

    501 to 1,500 employees
    instead of €90,000€72,000€90,000per yearIntroductory offer in the first year for contracts signed by 31 Dec 2026, then €90,000

    Intertwined XL

    over 1,500 employees or group
    Price on request

    Included in every licence

    • ISMS
    • DORA register of information
    • Third-party risk management
    • ICT risk management
    • Requirements and controls
    • Policies and training
    • Audits, incidents and reporting
    • Data protection
    • Cybersecurity in operation
    • EUC management
    • AI governance
    • AI features with your own AI provider*
    Unlimited usersat no extra cost
    Implementation and data migrationone-off flat fee depending on scope, on request
    Integrationsset up on a time-and-materials basis, on request

    * The customer bears the AI provider's API costs.

    Book a meeting30 minutes, straight in the calendarRequest demo access

    Frequently asked questions

    What is Intertwined GRC?

    Intertwined is software for governance, risk management and compliance (GRC). It brings together ISMS, DORA, third-party risk management, ICT risk management, audit and incidents, data protection, cybersecurity, EUC and AI governance in one platform. You record processes, systems and service providers once, and every area works with the same records.

    Which companies is Intertwined for?

    For two groups of companies. Financial institutions of every size under DORA: banks, payment and investment firms, insurers, asset managers and investment management companies. Companies in all sectors under NIS2: for example energy, healthcare, transport and digital infrastructure, as well as ICT service providers. For both, the requirements are stored article by article, reporting deadlines included. The platform supports information security and the CISO, outsourcing and risk management, data protection and compliance.

    Which frameworks does the platform cover?

    DORA with its technical standards, NIS2, the GDPR and the German Federal Data Protection Act (BDSG) are stored article by article as requirements catalogues. In addition, there are the EBA Guidelines, ISO 27001, BSI C5, SOC 2 and NIST CSF 2.0. The EU AI Act is covered by the AI governance module: 9 exclusion questions under Art. 5, 10 binding obligations and 36 controls per AI system. Implementation status is tracked per catalogue and domain, and the same policy counts towards several frameworks.

    Does Intertwined support the DORA register of information?

    Yes. The register of information under DORA Art. 28 records the provider, the supported function, the criticality and the term for each contract, and checks the details for completeness. Arrangements can be taken over from third-party risk management, and critical functions reference the processes in the inventory. Import, validation and export are described on the page DORA register of information software.

    How does it differ from Excel lists and point solutions?

    In the connections between the modules: what one area captures is available to the others without re-entry. For example, a risk names the affected processes and assets, an incident names the affected service providers, and a test finding can be taken over as a risk while its origin stays visible. In separate spreadsheets and tools, these links have to be maintained by hand.

    Can Intertwined support an ISMS under ISO 27001?

    Yes. In the ISMS area, processes and assets are inventoried and assessed with a business impact analysis and protection requirements. The risk register, controls, policies per framework and the ISO 27001 requirements catalogue build on this.

    Where is the data stored?

    Your data is stored in data centres in Germany, and the application also runs in Germany. Data leaves the EU only if you yourself switch on cybersecurity queries to external services or an AI provider; which services these are is set out in the list of sub-processors.

    How do I get to know the platform?

    In a 30-minute call we show you Intertwined based on your regulatory requirements. You book the meeting straight in the calendar; alternatively, send your request via the form on this page and we will get back to you personally.

    Through personal demo access: a fictitious institution with consistent sample data and all modules enabled. Alternatively, we show you Intertwined in a 30-minute call based on your regulatory requirements; send your request via the form on this page.

    Book a meeting directly

    Show available slotsThe calendar is loaded from Microsoft Bookings. Data is only transferred to Microsoft once you click (privacy policy).

    Prefer to write?

    Briefly describe what you need and we will get back to you personally.

    In 30 minutes we show you the platform against your requirements and discuss which areas to start the implementation with. Write to us using the form and we will get back to you personally.

    Direct contact:
    intertwined@ccurity-consulting.com

    Required field

    We use your details exclusively to process your request.