GDPR
RoPA, DPIA, breach notifications, DSAR register, controller/processor model, retention schedules.
About GDPR →
Capabilities
What Atitic does
Every part works on the same records: a policy, a piece of evidence or a control is linked once and counts wherever it applies.
Frameworks out of the box
Pre-loaded catalogues. Adopt in a single click; requirements become trackable rows you can own and link.
NIS2
Cybersecurity risk management, incident reporting timelines, supply-chain due diligence, governance attestations.
About NIS2 →DORA
ICT third-party register (Art. 28), operational resilience, threat-led testing, ICT incident classification.
About DORA →ISO 27001
Clauses 4 to 10 and the 93 Annex A controls, mapped to evidence and policies. Use alongside GDPR/NIS2 to avoid double work.
About ISO 27001 →EU AI Act
Risk classification (unacceptable / high-risk / limited / minimal), high-risk system obligations, GPAI documentation, transparency notices, post-market monitoring.
About EU AI Act →SOC 2
Trust services criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) mapped to your controls, evidence, and continuous monitoring cadence.
About SOC 2 →MiCA
Markets in Crypto-Assets Regulation (EU 2023/1114): CASP authorization, governance and conduct, prudential reserves, ICT resilience deferring to DORA, market-abuse prevention.
About MiCA →HIPAA
US Privacy, Security and Breach Notification Rules: PHI uses and disclosures, individual rights, administrative + physical + technical safeguards, 60-day breach notice.
About HIPAA →EU Cyber Resilience Act
Product cybersecurity (EU 2024/2847): secure-by-design essentials, vulnerability handling with SBOM, 24-hour exploited-vulnerability notice, CE marking and supply-chain duties.
About EU Cyber Resilience Act →ISO 27005
Information security risk management: risk criteria, identification, analysis, treatment and acceptance, carried out in the risk register and mapped to ISO 27001.
About ISO 27005 →ISAE 3402
Service organization controls report: system description, management's assertion, subservice organizations and 12 starter control objectives you word for your own report, mapped to ISO 27001.
About ISAE 3402 →PCI DSS
Payment Card Industry Data Security Standard v4.0.1: the 12 requirements and the service provider appendix, scope, quarterly scans, yearly testing and validation.
About PCI DSS →CER Directive
Critical Entities Resilience Directive (EU 2022/2557): all-hazards risk assessment, resilience measures and plan, staff security and background checks, 24-hour incident notice.
About CER Directive →Custom frameworks
Author your own bespoke framework via YAML upload, the in-app builder, or paste regulation text and let AI draft the domain and requirement structure.
Cross-framework reuse
Crosswalks from ISO 27001 to NIS2, DORA, SOC 2, HIPAA, MiCA, the CRA, ISO 27005, ISAE 3402, PCI DSS and CER. Link a policy, evidence or risk once and see which requirements of your other frameworks it also supports.
Programs and controls
Getting started, and keeping the programs current.
Fasttrack
A guided start: answer questions about your organization, see which frameworks apply and why, and set up the programs, starter policies, controls, registers and a first task plan in one run, after reviewing each item. Consultancies save their choices as presets for the next client.
Control library and testing
Controls based on ISO 27001 Annex A, mapped to the requirements of the frameworks you run. Each control has an owner, a test plan and a history of results; a failed test shows on the requirements it supports.
Statement of Applicability
Every Annex A control with whether it applies, the approved reason when it does not, the controls and evidence behind it, as PDF and Excel. Marking a requirement Not applicable needs a justification and an approver.
Frameworks that change
When a framework gains requirements, running programs show what is new and add it when you choose, so completion figures never change without warning.
Registers, incidents and risks
The records regulators ask for, as structured records rather than documents.
RoPA + DPIA
Records of processing and impact assessments are first-class objects, not Word docs. Reusable processor catalogue, transfer mechanisms, DSR-impact tracking.
Incidents and reporting deadlines
Each incident records what happened and what it affected, and shows the deadlines that apply: GDPR 72 hours to the authority, NIS2 early warning, notification and final report, DORA initial, intermediate and final reports, with reminders to the owner.
Breach + DSAR registers
Clock-aware: a breach record starts a 72-hour timer; a DSAR starts a 30-day timer. Visible at a glance with audit log behind every state change.
Vendors and the ICT register
Vendors with tier, the functions they support and review dates; due-diligence questionnaires about a vendor from ready templates (general, DORA, NIS2) or your own, with a due date, a reviewer and a weighted score; the DORA Art. 28 register with criticality, exit strategy, sub-contractor chain and contractual safeguards.
Risk register
Inherent and residual scores against the risk appetite you set, owners, treatment plans and reviews scheduled by severity. Accepting a risk is a formal decision with a reason and an end date.
Assets and continuity
An inventory of systems and data with owners, business continuity plans and recovery exercises with their logs.
Policies, training and the calendar
The recurring work of a compliance program, with reminders.
Policy lifecycle
Draft, review and publish, with an optional second approver. Each acknowledgement records the exact version. Exceptions are approved by someone else and end on a set date.
Training + acknowledgements
Assign training and track completion per employee; attach a completion record as evidence for the awareness and training requirements.
Governance calendar
A timeline and an agenda of everything with a date: reviews, control tests, policy renewals, tasks, evidence expiry and legal reporting clocks. Recurring activities such as the access review or the management review, a year plan, and a feed for Outlook or Google Calendar.
Reminders
Owners are reminded before a date and again when it is missed, by email or as a daily digest, with the timing set per company.
Evidence, audits and reports
The output side of compliance: proof that holds up, and reports people read.
Evidence library
Upload once and link to any requirement, risk or task. Each file keeps its versions and a SHA-256 fingerprint, states the period it covers, and is reviewed by someone other than the person who added it.
Audit readiness
Request lists per audit, imported from the auditor's spreadsheet. External auditors sign in with two-factor authentication, see only their audit and download an evidence pack with an index of every file.
Reports and the board pack
Compliance posture, gaps, risks, policies, training, vendors, findings, incidents, the year plan, the scores profile and a board pack, as PDF or spreadsheet, sent on a schedule if you want.
Scores profile
A radar of each area from 0 to 10 against the target you set: per framework, and across frameworks in about thirty security areas. On the dashboard, in reports and per client for consultancies.
Audit-evidence chain
Every change – to a requirement status, a policy version, a risk score, an evidence file – is recorded with actor, timestamp, before/after. Survives staff turnover.
Program roll-up
A live dashboard showing what's Implemented, what's In progress, what has no linked artifacts, and what's overdue. Filter by framework, owner, deadline.
AI, when you turn it on
Off until your company turns it on. It reads what the person asking may see, and anything it suggests waits for a person to accept it.
Ask Atitic
Ask about your programs, incidents, deadlines or vendors in plain language and get answers from your own records, in your language.
AI connections (MCP)
Connect the AI assistant you already use through the Model Context Protocol. It reads your compliance data with your own access rights, read-only, with a personal token you can revoke; it can suggest a task or an evidence link for you to accept.
Suggestions
Evidence proposed from the documents you connect, frameworks drafted from pasted regulation text, and plain-language explanations in Fasttrack. When a requirement has published policy + evidence, the system suggests marking it Implemented. The suggestion is never auto-applied – you decide.
Connects to what you already run
Point Atitic at your existing tools. Native adapters, no custom middleware.
Document sources for AI evidence ingest
- Amazon S3
- Azure Blob Storage
- Google Cloud Storage
- Microsoft SharePoint
- Atlassian Confluence Cloud
- Azure DevOps Wiki
Cloud posture
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
Tickets and workflow
- Atlassian Jira (bidirectional)
- ServiceNow (bidirectional)
Identity
- OIDC – Microsoft Entra ID
- OIDC – Google Workspace
- SAML 2.0
Calendars and AI assistants
- Outlook and Google Calendar (calendar feed)
- AI assistants that support MCP
Don't see your source? Tell us what you use.
For consultancies, and for security
Consultancy workspace
One login for every client company, each isolated from the others. Fasttrack presets for new clients, one calendar across clients, a portfolio with each client's completion, overdue work and scores, custom frameworks shared with the clients you choose, and each client's own branding.
Security and hosting
Data hosted in the EU. Each company's data isolated by row-level security in the database. Single sign-on (OIDC, SAML), SCIM provisioning, two-factor sign-in, roles per module, and a tamper-evident audit log.
How Atitic protects your records →Want to see it on your own data?
Spin up a trial workspace in two minutes.
Start a free trial