Five frameworks, one unified dashboard.

The regulatory information on Tekmerion is provided for general orientation only. Final applicability depends on each organization's sector, size, classification, and national transposition, and it is not legal advice — please consult qualified counsel for your specific situation.

• 01 · GDPR

  General Data Protection Regulation

  Regulation (EU) 2016/679

  Establishes rules for the protection of natural persons with regard to the processing of personal data; it requires a lawful basis, documented security measures, and breach notification within 72 hours. It applies to any business that processes the data of EU residents, regardless of size.

  Tekmerion surfaces:

  • Alerts·Evidence·Remediation

  Core obligations

  • Maintain an up-to-date Record of Processing Activities (ROPA) as activities change.
  • Appoint a Data Protection Officer (DPO) where required, with published contact details.
  • A documented breach notification procedure to the supervisory authority without undue delay and within 72 hours of becoming aware of the incident.
  • Respond to Data Subject Access Requests (DSAR) without undue delay and within one month, with extensions where required — for access, erasure, and portability.
  • Sign and periodically review Data Processing Agreements (DPA) with every processor.

  Applies to any business in the EU/EEA — regardless of size — that processes the data of EU residents.

  GDPR assessment
• 02 · ISO 27001

  Information Security Management System (ISMS)

  International standard ISO/IEC 27001:2022

  Defines requirements for an Information Security Management System (ISMS) — risk assessment, access control, encryption, and periodic audits. It applies to organizations of any size seeking certification or needing to demonstrate a mature ISMS.

  Tekmerion surfaces:

  • Alerts·Evidence·Remediation

  Core obligations

  • A documented information security risk assessment with periodic re-evaluation.
  • Apply Annex A — 93 controls (access control, cryptography, event logging).
  • Statement of Applicability (SoA) with clear justification of exclusions and revisions.
  • Internal audits and management review at least once per year.
  • Continuous improvement via corrective actions and measurable security KPIs.

  Applies to organizations of any size seeking certification or needing to demonstrate a mature ISMS to customers and partners within the EU/EEA.

  ISO 27001 assessment
• 03 · SOC 2

  AICPA Trust Services Criteria

  Audit framework for B2B service systems

  An audit framework for B2B service systems — security, availability, processing integrity, confidentiality, and privacy, with an emphasis on monitoring and evidence. Widely adopted by European SaaS companies serving US customers.

  Tekmerion surfaces:

  • Alerts·Evidence·Remediation

  Core obligations

  • Select the applicable Trust Services Criteria (Security as a base, the remainder optional).
  • System Description with boundaries, data flows, and third-party dependencies.
  • Operational controls for each selected criterion with documented execution.
  • Continuous monitoring with ongoing evidence collection.
  • Independent auditor report (Type I or Type II) with a coverage period and sampled testing.

  Applies to European SaaS companies and B2B services that serve customers in the US or in international markets.

  SOC 2 assessment
• 04 · NIS 2

  Network and Information Security Directive

  Directive (EU) 2022/2555

  Strengthens network and information security obligations for essential and important entities — risk management, rapid incident reporting, and personal accountability of management. Transposed into national law by member states by October 2024.

  Tekmerion surfaces:

  • Alerts·Evidence·Remediation

  Core obligations

  • Risk-management measures (organizational and technical) scaled to size and sector.
  • Mandatory incident reporting to the relevant CSIRT or national competent authority — early warning within 24 hours, notification within 72 hours, with national variations in exact deadlines.
  • A designated security officer and management accountability for approvals and oversight.
  • ICT supply-chain risk management, including third-party providers.
  • Ongoing staff training and incident-response exercises.

  Applicability depends on sector (Annex I/II), entity classification (essential or important), the relevant size thresholds, and national transposition by October 2024 — with member-state variations and sectoral exceptions. Do not infer scope from company size alone; confirm local applicability before relying on this guidance.

  NIS 2 assessment
• 05 · DORA

  Digital Operational Resilience for the Financial Sector

  Regulation (EU) 2022/2554

  Sets digital operational resilience requirements for financial entities and their third-party ICT service providers — resilience testing, major-incident reporting, and third-party risk management. Applicable from January 2025.

  Tekmerion surfaces:

  • Alerts·Evidence·Remediation

  Core obligations

  • An ICT risk-management framework covering the entire service lifecycle.
  • Report major ICT incidents to the competent authority within strict time limits.
  • An annual resilience-testing program with periodic penetration tests for critical services.
  • Identify and monitor third-party ICT contracts (contract register).
  • Business continuity plan and tested disaster-recovery procedures.

  Applies to three distinct groups: financial entities (banks, insurers, investment firms, payment providers, and fund managers); third-party ICT service providers — who are subject to direct obligations under Chapter V when serving those financial entities; and critical third-party ICT providers (CTPPs) designated and jointly overseen by the European Supervisory Authorities (ESAs).

  DORA assessment