GRC Platform Netherlands — On-Premise ISMS

The iso2700x GRC Platform runs 100% on-premise and is fully EU-Sovereign — zero American data transfer, zero cloud vendor lock-in.

On-Premise — Your Data Stays With You

Unlike cloud-based GRC solutions, the ISO2700X GRC Platform runs as a standalone Docker application locally at each client. No cloud dependency, no vendor lock-in, no sensitive compliance data outside your own network. Complete data sovereignty is not a marketing promise but a technical reality.

The platform is installed and configured by our team, including integrations with your existing infrastructure. Updates are managed via our maintenance contract.

Multi-Framework Compliance

The platform supports simultaneous compliance with four frameworks in one integrated system:

• ISO 27001:2022: 93 Annex A Controls with status tracking, evidence management and Audit Log
• NIS2: 17 security requirements with linkage to your Risk Register and incident management
• DORA: 20 operational resilience requirements for financial entities
• GDPR: Processing Register, DPIA module and data breach management

Controls are automatically linked to relevant requirements across multiple frameworks — so a single control covers multiple compliance requirements and duplicate work is avoided.

Compli AI — policy tailored

Compli AI is the built-in AI assistant that generates policy proposals based on your organisation profile. With 64 policy templates, 113 sections and 398 questions, the system produces draft policy that directly aligns with your company processes, sector and risk appetite — fully bilingual (NL/EN).

Compli AI runs locally on your infrastructure. Your organisation data and policy drafts are never sent to external AI providers.

SOC/SIEM Integration

The platform integrates via pull-based synchronisation with your Security Operations Center. Incidents, vulnerabilities and assets are updated every 15 minutes from your SIEM environment:

• IBM QRadar
• Microsoft Sentinel
• Blumira

This means your compliance status is always current and directly reflects the reality of your security posture — no manual updates.

Asset Discovery & Vulnerability Management

The platform automatically imports assets and vulnerabilities from your existing tooling:

• Asset Discovery: Lansweeper, Intune, CrowdStrike, Jamf, ServiceNow CMDB
• Vulnerability Management: Tenable, Qualys, Rapid7, OpenVAS, CrowdStrike Spotlight, Microsoft Defender
• Incident Management: TOPdesk, Jira, ServiceNow, Zendesk, ClickUp, PagerDuty
• Directory & MFA: Active Directory/LDAP synchronisatie, automatisch rolbeheer

Audit-Ready — Always Prepared

The platform is designed for external audits. All Controls have linked evidence documents, a complete Audit Log and a status overview. The document pipeline — from gap analysis to Statement of Applicability — is built in. On the day of your certification audit you have everything readily available.