GRC software for information security:
106 providers with AI classification.

Which tasks does ISMS software take on?

ISMS software maps the information security management system (ISMS): it keeps assets, risks, controls and evidence under frameworks such as ISO/IEC 27001, NIS2, DORA or BSI IT-Grundschutz. Cyber compliance platforms also pull evidence from connected systems, map one control to several frameworks and prepare answers to customers' security questionnaires. After platforms, information security is the second-largest category in the register. It counts 14 providers based in France, more than any other category, and several of them support risk analyses using the French EBIOS Risk Manager method.

• No specific AI function in the sources checked: 16 entries
• Only announced or in-development functions: 1 entry
• Documented AI use cases by topic, an entry can count more than once: Collecting and checking control evidence (36) · Drafting policies (27) · Gap analyses (25) · Answering security questionnaires (24) · Assessing information security risks (24)
• Documented headquarters in Europe: 65 of 106 providers, headquarters not separately checked: 25
• Full entries on 3 alphabetical subpages

Questions for the demo, derived from the five criteria of the comparison:

• Are control evidence, assets and risks kept in one data set or gathered again for every audit?
• For AI-generated answers to security questionnaires, can you still see which evidence they rest on and who approved them?
• Which connections to existing security tools are included in the scope, and who maintains them?

Does BAIT still apply?

Only for institutions that do not have to run ICT risk management under DORA, without the already repealed Chapter 11, and only until 31 December 2026. Institutions that must run ICT risk management under Art. 5 to 15 or Art. 16 DORA have been outside the scope of BAIT since 17 January 2025. Because further institutions must apply DORA from 1 January 2027, BaFin repeals BAIT in full at the end of 31 December 2026.

Is an ISO 27001 certification enough for DORA?

Not on its own. Neither DORA nor Delegated Regulation (EU) 2024/1774 names ISO 27001, and neither provides for a certification as evidence of a financial entity's ICT risk management; DORA takes third-party certifications into account, for example, in the oversight of critical ICT third-party service providers (Art. 40(4)). The Delegated Regulation requires ICT security policies to consider leading practices and, where applicable, standards (Art. 2(2)(h)). It also sets content of its own, such as the date of formal approval by the management body, indicators for monitoring implementation including recorded exceptions, and segregation of duties arrangements under the three lines of defence model or, as applicable, another internal risk management and control model (points (b), (c) and (g)).

Where does a bank record accepted residual ICT risks?

In an inventory of accepted residual ICT risks that also records why each one was accepted (Art. 3(d)(iii) of Delegated Regulation (EU) 2024/1774). These residual risks are reviewed at least once a year for changes, available mitigation measures and whether the reasons for acceptance still hold (point (iv)). The institution also assigns who may accept residual risks above its risk tolerance level (point (ii)).

Which providers of GRC software for information security are headquartered in Germany, Austria or Switzerland?

Of the 106 providers, 20 have a documented headquarters in Germany, Austria or Switzerland: in Germany Compliance Compass, ditis (Voith), fuentis, HiScout GRC Suite, i-doit GRC Suite+, infodas (Airbus), isidaten, Kertos, neonotu, Secani, Secfix, SECJUR, SecTepe, Teddy Technologies, TTS Trusted Technologies and Solutions, verinice and xmera Solutions; in Austria condignum, Intervalid and Telcon. For 25 further providers, the headquarters has not been checked separately; they are not included in this list. Headquarters means the seat of the provider entity named in the entry, documented by the entry's location source (imprint, legal texts, official contact and company pages, occasionally official registers); it says nothing about ownership, hosting or data storage.

Regulatory framework.

• Art. 5 to 16 DORA (Regulation (EU) 2022/2554): ICT risk management framework, including an information security policy (Art. 9(4)(a)) and a classification of ICT-supported business functions and of information and ICT assets, reviewed at least yearly (Art. 8(1)) (Source: EUR-Lex)
• Commission Delegated Regulation (EU) 2024/1774, Art. 2 to 5: minimum content of ICT security policies, an inventory of accepted residual ICT risks and ICT asset management (Source: EUR-Lex)
• BaFin notice on repealing BAIT (January 2025): institutions under DORA excluded from BAIT since 17 January 2025, full repeal at the end of 31 December 2026 (Source: BaFin, in German)
• Section 28(6) no. 1 BSIG (German NIS2 implementation): exempts DORA financial entities and undertakings to which DORA applies via Section 1a(2) and (2a) KWG from, among others, the BSIG duties on risk management measures (Section 30) and incident reporting (Section 32) (Source: gesetze-im-internet.de, in German)

Further reading on t-nex.de: ISO 27001 and IT-Grundschutz compared, NIS2 vs DORA, T-NEX for information security, and DORA for financial entities.