ISO 27001, NIS2 and GDPR in practice

From the check to implementation

The EU Readiness Check shows where your company stands against the requirements of EU customers. What usually follows is one of three situations. A customer asks for a certificate such as ISO 27001 or ISO 9001. A questionnaire on NIS2 or the GDPR lands on your desk and has to be answered with evidence. Or you want to set up your own IT so that a security incident does not cost you the export contract.

In all three cases you can work with your own staff, local consultants or any provider you choose. Nothing on MercoEU assumes a particular product. The offerings below come from neonotu GmbH in Munich, the company that runs MercoEU. We do not list prices here; you will find them on each product's website, or you can ask for a quote.

Sightadel: GRC platform for standards and frameworks

Sightadel takes your team through a standard step by step. You pick the framework, Sightadel sets up every checkpoint following the chapters of the standard and shows at any time what is done and what comes next. For each requirement there are industry templates drawn from consulting and certification practice. An AI turns the information you have already entered into suggestions that you can accept, edit or discard. Decisions such as how to rate your risks stay with you.

Supported frameworks include ISO/IEC 27001, ISO 9001, ISO/IEC 42001, NIS2, DORA, the GDPR, HACCP, SOC 2 and the EU AI Act. Customer-specific requirements can be set up as a framework of their own. Whatever you have built for one standard, Sightadel reuses for the next. A software company in Montevideo that starts with ISO 27001 will already have a large share of the answers for its Frankfurt customer's NIS2 questionnaire.

Sightadel is developed, operated and hosted in Germany. Data is processed on your behalf under Art. 28 GDPR. For the audit, the auditor gets a separate login without permission to delete anything. You can try the platform free for 14 days.

Sightadel with a consulting package: all the way to certification

Some questions no template can answer. How do you draw the scope when packaging happens in Uruguay and sales are run from Brazil? Will your risk methodology satisfy the auditor? For this there is Sightadel as a package that combines the platform with personal support from consultants who have audit and certification experience, all the way to certification if you want.

The consultants work directly in Sightadel. You ask your question on the control you are working on, and the answer stays documented there. The audit itself is carried out by an independent, accredited certification body. Consultant and auditor are never the same person, and neither neonotu nor the auditors receive commissions for audits. neonotu GmbH is itself certified to ISO 9001 and ISO/IEC 27001, but it does not issue certificates.

If you have nobody in-house for information security, you can also bring in an external information security officer or CISO from neonotu GmbH. That helps when an EU customer's contract requires a named person responsible for information security. Requests for the package go through sightadel.com.

veyrisk: your attack surface, checked from the outside

Many security questionnaires ask how you detect vulnerabilities and how quickly you fix them. veyrisk answers the first half of that question on an ongoing basis. The service looks from the outside for everything that makes your company reachable on the internet: domains, servers, web applications, cloud accounts, and forgotten test systems too. Each finding gets a priority based on severity, known exploitation and how important the system is. Once it is fixed, a new scan confirms that the gap is closed.

veyrisk is a managed service. You do not install anything for the external check. You see the results in a customer portal, where you can also use them as a report for a customer or auditor. Beyond the external attack surface, veyrisk can also cover vulnerability management for internal systems, web applications and APIs, cloud configurations on AWS, Azure and Google Cloud, and identities in Microsoft 365. The service is operated in Germany.

Valar: hardware firewall from Germany

Valar is a hardware firewall made by neonotu GmbH. neonotu maintains the software for all models in Germany and pushes updates directly. Features include zone-based rules by network segment, application and user, intrusion prevention, SSL inspection per zone, VPN for sites and mobile staff, web filtering and its own AI detection for suspicious behavior that has no known signature.

There are four models, from a small branch office with around 25 users up to operators of critical infrastructure. An export office in Antofagasta will usually get by with the smallest unit, while a processing plant with several sites will need a larger one. Licensing depends only on the model and the term; there are no add-on modules.

Who is behind it

Sightadel, veyrisk and Valar are products of neonotu GmbH, based in Munich. neonotu develops solutions for information security and compliance and provides cybersecurity services. The company is certified to ISO 9001 and ISO/IEC 27001.

MercoEU is funded by these offerings. That does not change the fact that all content, the EU Readiness Check and the answers from “Ask us” can be used without buying anything and without any commitment. If you are not sure whether you need to act at all, start with the check.

FAQ