Use cases

Who uses Atitic, and for what

Companies that run their own compliance, and consultancies that run it for several clients. The same product, set up for each.

For companies under EU regulation

Stop running compliance out of shared drives.

You have GDPR. NIS2 is next. Your auditor wants a coherent answer, and the spreadsheet a colleague kept left with them. Atitic gives you one workspace where every requirement points to the policy, evidence, control and risk that prove it, and the dashboard shows what is still missing.

  • Start with Fasttrack.

    Answer questions about your organization; Fasttrack shows which frameworks apply and sets up the programs, starter policies, controls and a task plan.

  • Map evidence once, satisfy many.

    Your access review record can be linked to GDPR Art. 32 and ISO 27001 A.5.18 in one step. No duplication.

  • Survive staff turnover.

    Every change is recorded with actor and timestamp. The new compliance lead inherits a working dataset, not a graveyard of dead documents.

  • Give the auditor and the board something they can check.

    The Statement of Applicability, reports and a board pack, a tamper-evident audit trail, and auditor access limited to their own audit.

For vCISO + consultancy practices

One login, every client.

You deliver compliance to several companies, often in different sectors and under different frameworks. Your consultancy has its own workspace and one for each client, each isolated from the others, all reachable from one switcher.

  • Start each client from your presets.

    Save a Fasttrack run as a preset and start the next client from it: frameworks, policies, controls, registers and tasks. Share your own frameworks with the clients that need them.

  • See every client at once.

    One calendar with every client's deadlines, and a portfolio with each client's completion, overdue work, risks above appetite and scores.

  • One subscription for the practice.

    Clients are covered by your plan, with every framework and no seat limit; the plan sets only how many client companies you run. Clients never see your billing or each other.

  • White-label the brand.

    Per-client logo, colors, product name. The end-customer sees their brand, not yours – unless you want them to.

By situation

Where companies usually start.

Financial entities

A DORA program, the ICT third-party register, major ICT incident reporting and resilience testing, often with ISO 27001 alongside, crosswalked to DORA.

ICT providers to financial entities

Your financial customers must put DORA's contract terms in place and check you. An ISAE 3402 report or an ISO 27001 certificate answers much of what they ask.

Software companies selling to enterprises

ISO 27001 with the risk method of ISO 27005, and a SOC 2 or ISAE 3402 report where customers ask for one. Cloud posture checks attach to access-control and encryption requirements.

Makers of connected products

The Cyber Resilience Act: secure-by-design requirements, vulnerability handling with an SBOM, and the 24-hour notice of actively exploited vulnerabilities.

Organizations using AI

The EU AI Act: an inventory of AI systems and your role for each, the high-risk check, AI literacy of staff and transparency to the people concerned.

Health providers

Health data is a special category under GDPR, and many health providers fall under NIS2. Keep DPIAs, the breach register with its 72-hour clock and the NIS2 incident deadlines in one place.

Recognize yourself?

Spin up a workspace – your shape, your data.

Start a free trial