NIS2 / KSC
Reporting clocks
Early warning in 24 hours, notification in 72 hours, final report in a month. The clock starts when you log the incident.
$ compliance --for engineers
Compliance for the people who run the systems.
NIS2, DORA, ISO 27001 and GDPR land on IT and security teams anyway. RealSec maps them onto what you already operate: systems, suppliers, incidents, controls. Then it tells you what is broken, not what is overdue in a spreadsheet.
/app/signalslive
NIS2-001Incident open >24h, no early warningCSIRT deadline 09:3001:58
DORA-003Concentration risk: one cloud provider63% of critical functions02:14
DORA-001RTO mismatch in contractcontract 8h vs BIA 4h03:21
PCI-001ASV scan expiredlast scan 94 days ago, limit 9003:48
GDPR-002Transfer outside EEA without SCCsystem #41 to US vendor02:55
$ cat model.md
One register. Every regulation reads from it.
You describe a system once: owner, data, suppliers, recovery targets. NIS2 incident handling, DORA register of information, ISO 27001 controls and the GDPR record of processing all inherit from the same entry. No copying between five spreadsheets that drift apart by Friday.
DORA
ICT third parties
Contracts, critical functions and concentration risk in one place, ready for the register of information.
ISO 27001
Controls with evidence
Annex A controls tied to the assets and risks they cover. Residual risk recalculates when a control goes live.
GDPR
Processing that knows its systems
Records of processing sit on real systems, so a DPIA or a transfer check starts pre-filled.
$ tail -f signals
Signals, not checklists.
22 signal types across five regulation families. Conditions are re-checked every few minutes, and each signal goes to the person who owns it: the CISO, the DPO, the risk owner.
What you have now
- Status column says "in progress" since March
- Supplier list in one file, contracts in another
- Incident deadlines tracked in someone's calendar
- Audit week means screenshots and archaeology
With RealSec
- A signal fires when a condition is actually broken
- Suppliers, contracts and systems linked once
- Reporting clock runs from the moment of detection
- Evidence collected where the work happens
24 hearly warning to CSIRT
72 hincident notification
1 mofinal report
Built in Poland for the regulated EU market.
RealSec covers GDPR, DORA, NIS2 and the Polish KSC act, AI Act and ISO 27001, with 200+ enterprise documents for the financial sector.