01 ·
One questionnaire
The questionnaire is based on the SCF (Secure Controls Framework): each answer is given once and counts for every framework that asks for the same control.
Compliance in the platform: one questionnaire, four frameworks, a gap plan reviewed by analysts.
The compliance module of the Fortgale Defence Platform runs a gap analysis for NIS2, DORA, ISO/IEC 27001 and NIST CSF 2.0: a self-assessment reviewed by analysts, evidence in one place, a gap plan ordered by impact. The result is a dashboard in the portal.
Frameworks
NIS2
DORA
ISO/IEC 27001
NIST CSF 2.0
Basis and export
SCF
OSCAL JSON
CSV
The module
What the module does.
A gap analysis inside the Fortgale Defence Platform, with no spreadsheet and no four separate projects: one questionnaire, four frameworks, one shared plan.
02 ·
Four frameworks
NIS2, DORA, ISO/IEC 27001 and NIST CSF 2.0 from the same data, with no four separate surveys and no duplicated evidence.
03 ·
Self-assessment, reviewed
Answers go through a review by Fortgale analysts. The result is a reviewed self-assessment, not an opinion.
Prefilled
Controls covered by Fortgale, already filled in.
When Fortgale services are active, the platform fills in the matching controls itself: what the service actually does does not have to be described again. What stays open is what lives in your organisation, such as policies, roles and processes. The module also works without active services; in that case every control is yours to answer.
Evidence
Documents and nightly evidence from the modules.
For each control you can attach documents up to 10 MB. On top of that come the nightly evidence items produced by the platform's active modules. Answers and proof sit in the same place, and the reviewer can see what an answer rests on.
Result
Score, CSF view and gap plan by impact.
Answers and evidence become three views of the same data.
01 ·
Score
A score for each framework, derived from answers and evidence.
02 ·
CSF view
The same answers laid out in the NIST CSF 2.0 structure, useful when talking to management and oversight bodies.
03 ·
Gap plan by impact
Gaps are ordered by their impact on the overall picture, so the first actions go where they move the most.
Review
An analyst review cycle, included.
Fortgale analysts examine answers and evidence and review the gap plan before it becomes your working baseline. That is the difference between a form and a reviewed self-assessment.
Export
CSV and OSCAL JSON.
Results can be exported as CSV for spreadsheets and reports, and as OSCAL JSON for tools that read the machine-readable NIST format. Your data does not stay locked in the portal.
Regulation
For DORA and NIS2.
DORA and NIS2 are two of the module's four frameworks; whoever is subject to both answers the questionnaire only once. The evidence is technical; the assessment of adequacy remains with the board and the control functions. More on the regulation: DORA at Fortgale.
Limits
What the module does not do.
It does not certify, it does not guarantee compliance and it does not replace an audit. It shows where you stand, where the gaps are and in which order they can be closed. Whether to pursue a certification is a decision you take with the relevant body.
Delivery
A dashboard in the Fortgale Defence Platform.
The result is a dashboard in the portal, available at any time. No periodic reports are included. The platform and all its modules: Fortgale Defence Platform.
FAQ
Frequently asked questions about the compliance platform.
Is this a certification?
No. The module is a self-assessment reviewed by Fortgale analysts. It does not certify anything, does not guarantee compliance and does not replace an audit.
Do I need an MDR service?
No. The compliance module can be activated on its own. If you already use Fortgale services, the matching controls come prefilled.
How long does a gap analysis take?
It depends on the evidence already available and on how quickly the questions are answered. We do not promise a fixed duration: the questionnaire is visible in the portal from the start and can be completed step by step.
Does it apply to NIS2 in Europe?
Yes. NIS2 is one of the module's four frameworks: a self-assessment with analyst review. For how it interacts with DORA, see the DORA page.
Where you stand
A gap analysis starts with one questionnaire.
Talk to us about which frameworks apply to you and which controls Fortgale already covers. Milan SOC, active since 2017, 24·7·365.