Compliance Automation for NIS2, ISO 27001 and SOC 2
Audits ask for evidence. We map the findings and evidence from our reviews to the controls of NIS2, ISO 27001 and SOC 2, so your auditor receives them sorted by control. Your auditor audits, we deliver the evidence.
What compliance automation means here
Each framework lists controls: rules your company has to meet and show proof for. Our reviews produce technical facts about your software and systems. Compliance automation connects the two. Every finding and every piece of evidence carries the control it belongs to, so the proof is ready when the audit starts.
Compliance automation is part of the Managed SOC, and it works as an add-on to the audit reports described on the other pages.
The frameworks
We map to three frameworks:
- NIS2, in Austria the NISG 2026: risk management, cryptography, access control and supply-chain security.
- ISO/IEC 27001: the standard for an information security management system.
- SOC 2: an audit standard for service providers. It has no connection to the Managed SOC, which is a service we run for you.
Who does what
Your auditor audits and issues the certificate or the report. We deliver the technical evidence in the form the auditor works with. A certificate is not part of our service.
Evidence from audited software
The public ledger lists 387+ audited apps and 262+ critical findings. These full reports show how we document what we find:
- SAP: A Chinese push SDK in a field-service app, and Firebase keys hardcoded across five apps.
- Nike: Development and production push credentials hardcoded in the shipped build.
- Strava: A hardcoded key and a security configuration that protects nothing.
- Revolut: The largest third-party SDK in the series and what it sends to a US company.
Every other investigation is in the full evidence ledger.
Start with the Domain Security Test
The Domain Security Test examines one domain from the outside: read-only, from a European IP address, with no login and no payloads. A researcher reviews your request and replies within one business day.
Compliance automation is part of the Managed SOC. Plans and prices are on the Access page.
Plans and prices are on Access, the agents behind every review on The Squad and the frameworks we measure against on Standards.
Put your domain to the test. Submit it for an initial external security assessment of your publicly accessible attack surface.
No login, no payloads and no changes to your systems.
A researcher reviews your request before testing begins and responds within one business day. You'll receive a short written report covering our findings, likely attack scenarios, potential financial impact and recommended next steps, alongside an exportable security intelligence graph connecting the findings.
Questions about compliance automation
Do you certify us for ISO 27001 or SOC 2?
Your auditor certifies. We deliver the technical evidence that the auditor needs.
Which frameworks do you cover?
NIS2 (NISG 2026 in Austria), ISO/IEC 27001 and SOC 2.
Is compliance automation a separate product?
It is part of the Managed SOC.
Does NIS2 apply to our company?
That depends on sector, size and role in a supply chain. The national authority's information at nis.gv.at is the reference.
Related pages
More on the pages App Security Audit, GDPR App Audit, NIS2 for Software Vendors, Tracker & SDK Check, AI App Privacy Audit, Outsourced SOC, Domain Security Test, Penetration Testing, API Security Testing, Cloud Security Assessment and Secure Code Review.
