GRC Hub
Tools for security professionals and consultants in regulated environments.
Free. Offline-capable. Export-ready. No tracking. Built for DORA, NIS2, GDPR, CRA with NIST as backbone.
How to use the GRC hub
Pick what you need to do. Each path lists the tools in order; you can stop after any step.
1. Find out which laws apply to you
- NIS2 Engine: answer the applicability questions (sector, size, services).
- DORA Engine, tab Applicability: for financial entities and their ICT service providers.
- Regulatory calendar: the dates that matter for the laws that apply.
You get: the list of laws in scope and their deadlines.
2. Measure where you stand
- NIST CSF 2.0 self-assessment: a baseline that does not depend on any one law.
- The self-assessment for each law in scope: NIS2 Engine (Article 21 measures) or DORA Engine (tab Requirements self-assessment).
- Crosswalk: see which controls count for several frameworks at once, so you do the work once.
You get: a gap list and a maturity score per area.
3. Track your risks
- Risk register: create an engagement (one per organisation or project).
- Add each risk with its likelihood and impact before and after your controls (inherent and residual).
- Use the Heatmaps tab to see what is still above your tolerance.
You get: a scored risk register you can export to Excel, CSV or PDF.
4. Prepare an audit or a board report
- Evidence request list: the documents to collect for the frameworks in scope.
- Policy templates: fill the policies that are missing.
- Board pack: one PDF built from your saved self-assessments and risks.
You get: an evidence list, draft policies and a board-ready PDF.
Where your work is saved
- Only in this browser. The tools send nothing to our server. The one exception is the benchmark, which sends your CSF scores only if you choose to submit them.
- A browser holds one set of self-assessments (CSF, NIS2, DORA). The risk register can hold several engagements. For several clients, use one browser profile per client, or export and import.
- Clearing your browser data deletes your work. Use Export engagement (JSON) below to keep a copy, and Import engagement to restore it here or on another computer.
Engagement
No engagement saved in this browser yet
Readiness
NIST CSF 2.0 tiers
Risk register
Next steps
Read from this browser only: what the GRC tools saved here. Nothing is sent to our server. Compliance content is informational only and is not legal advice.
How to use the hubAssess
Score where you stand: applicability engines, self-assessment, benchmarking and the risk register.
Applicability checker (essential vs important) plus Article 21 measures self-assessment and Article 23 reporting timeline. Gap report export.
Applicability (Art. 2/4/16), Level 1 + RTS 2024/1774 self-assessment, Register of Information generator (Implementing Reg (EU) 2024/2956), TLPT applicability and incident-classification helper.
Rate your organisation against all six CSF 2.0 Functions at Category level (22 categories, 0–4 scale). Radar chart, gap analysis, PDF / Excel / JSON export. Scores feed the Board Pack.
Compare your CSF 2.0 maturity to anonymous aggregates by sector and size band. Opt-in submission. k-anonymity ≥ 20. The literal payload you’d send is shown before sending — nothing else leaves.
ISO/IEC 27005-aligned client-side register with multi-engagement support, 5×5 inherent vs. residual heatmaps, optional FAIR-lite Monte Carlo (Web Worker, 10k iters). Excel / CSV / Markdown / PDF.
Reference & learning
Look up controls, deadlines and mappings, and practise.
1,200+ controls from NIST, DORA, GDPR, NIS2, CRA. Instant search, maturity tiers, export to CSV, Excel, Markdown.
623+ edges connecting NIST CSF 2.0, SP 800-53 r5, ISO 27001:2022, DORA L1 + RTS, NIS2 Art. 21 + IR 2024/2690, GDPR and CRA. Pivot, framework-pair, "implement once / comply many" coverage.
Key EU cybersecurity regulatory deadlines — DORA, NIS2, CRA, GDPR milestones with official source links.
12 SME-sized policy templates with YAML front-matter and clause-level trace IDs into the Crosswalk. RACI tables, customise-in-browser, Markdown / Word-friendly HTML / traceability matrix exports.
Practice questions on EU regulations and security frameworks — DORA to start — tagged by chapter, each answer cited to a specific article. Quiz and flashcard modes, per-chapter scoring, runs in your browser.
How every dataset and mapping was built. OLIR / ENISA hierarchy, coverage formula, k-anonymity rule, full manifest with sha256 fingerprints. Plus the free, read-only /api/v1/.
Reporting
Turn the work into evidence requests and a board-ready pack.
Pick the frameworks in scope; the generator produces a deduplicated ERL with Excel tracker columns and a client-facing cover letter. Covers NIS2 IR 2024/2690, DORA, GDPR Art 32/28/33, CRA Annex I, ISO 27001 audit list.
One click from your saved GRC state to a board-ready PDF. Auto-drafted executive summary, CSF radar, top-10 risk, regulatory exposure, upcoming deadlines, snapshot trends.
All tools run in your browser. Keyboard shortcuts supported. No account required. Export to CSV, Excel, or Markdown for your workflow.
Every tool produces client-ready exports — PDF checklists, gap analysis reports, maturity assessments. Attribution-free output, ready to brand.
☑ GRC Engagement Checklist
- Identify applicable regulations (DORA / NIS2 / GDPR / CRA)
- Confirm entity classification (essential / important / financial)
- Define assessment scope (systems, processes, third parties)
- Obtain existing policy and procedure documentation
- Identify key stakeholders (CISO, DPO, risk owner, auditor)
- Baseline current controls against target framework
- Map existing policies to regulatory requirements
- Identify missing controls by category and criticality
- Assign maturity tier per CSF Function (T1–T4)
- Prioritise gaps by regulatory risk and effort
- Collect policy documents (IS policy, BCP, IRP, TPRM)
- Gather audit logs and monitoring evidence
- Document incident response history
- Confirm third-party contract clauses (DORA/NIS2 requirements)
- Capture training and awareness records
- Draft findings with regulatory reference per item
- Assign risk rating (High / Medium / Low)
- Write remediation recommendations with timelines
- Prepare executive summary for board/management
- Document residual risks and accepted exceptions
- Deliver report with evidence appendix