Prove to your clients that you manage your cyber risks
Your clients (banks, hospitals, public sector, large corporates) fall under NIS2 or DORA and send you questionnaires and evidence requests. NIS2YOU gives you an up-to-date NIS2, CyberFundamentals, ISO 27001 and GDPR risk register, documented controls and a share-ready PDF — without a full-time CISO.
Download a sample register — no signup required
14-day free trial · No credit card · Data hosted in Europe
See exactly what you'll show your auditor
Three sample risk registers generated with NIS2YOU. Download them to see the exact format, level of detail and layout you'll get.
Grazulex SCA
Belgian dev studio · 11-50 people · NIS2 + ISO 27001 + GDPR
39 risks · 30 controls · 50 plans · 25 incidents
Acme NV
Flemish MSP (Antwerp) · 11-50 people · NIS2 + ISO 27001 + GDPR
28 risks · 19 controls · 25 plans · 13 incidents
Demo Studio Ltd
Dublin SaaS startup · 11-50 people · NIS2 + ISO 27001 + GDPR
29 risks · 20 controls · 25 plans · 14 incidents
Direct download, no signup or email required.
Your regulated clients want evidence. You have no CISO and no consultant budget.
NIS2 already applies in Belgium (since October 2024), Luxembourg (May 2026) and the Netherlands (August 2026); DORA has applied to banks and insurers since January 2025. These companies must manage their suppliers — that means you. In practice you are asked for:
- Security questionnaires, often a different one for every client
- An up-to-date risk register and documented controls (MFA, backups, access, suppliers)
- Evidence of regular reviews and an incident notification procedure (24h / 72h)
- Increasingly, an attestation: CyberFundamentals or ISO 27001
Compliance platforms cost several thousand euros a year, a consultant €5,000 to €15,000, and a spreadsheet does not hold up in front of an auditor.
A living risk register that keeps itself up to date
Built for you
Plain language, real examples for tech SMEs, in-app help. No consultant jargon.
Trilingual from day one
EN, FR, NL. Pick the language for your team — your reports come out in the right one.
Auditable by default
Every change tracked: who, when, old value, new value. One-click PDF export for your auditors.
Smart notifications
Overdue plans, upcoming reviews, critical incidents — we tell you before you forget.
From zero to an operational register in 4 weeks
Inventory your assets
List the 10-30 things your business cannot live without: business apps, servers, customer data, key suppliers.
Identify your risks
Cyber, operational, compliance, HR... Score probability × impact. Our heatmap helps you prioritise.
Document your controls
You already do MFA, backups, encryption? Document them and link them to the risks they cover.
Export your compliance
Audit-ready risk register PDF, complete audit log, scheduled reviews.
Everything you need, nothing you don't
Asset inventory
7 categories, 1-5 criticality, multi-criteria search.
Risk register
5×5 heatmap, inherent / residual scoring, lifecycle states.
Controls
4 types (preventive / detective / corrective / compensating), design + operating effectiveness.
Action plans
Assignment, due dates, segregation of duties (Completed / Verified), evidence.
Scheduled reviews
Automatic notifications, every decision tracked.
Incidents
NIS2 24h / 72h / 1 month deadlines surfaced. Auto-linking to relevant risks.
Full audit trail
Who changed what, when. Filterable, exportable.
Team and roles
5 levels (Owner / Admin / Risk Manager / Contributor / Auditor) with email invitations.
PDF export
Auditor-ready register, one click, in the language of your choice.
Client proof
26 standard questionnaire questions, reusable answers, CSV export and a shareable trust page.
CRA module
Register of your software, SBOM, support period and 24h / 72h ENISA reports.
DORA & CyberFundamentals
DORA Art. 30 clauses for suppliers of banks, CyFun BASIC recommended by the CCB.
Partner space
IT providers and consultants: follow your clients' indicators, with their consent.
Built for tech SMEs and freelancers
Studios & consultancies (5-100 people)
You work for clients under NIS2 or DORA. Meet their security requirements without burning your weekends.
Tech freelancers
Outsourced DPO, freelance dev/sec: structure your client engagements without starting from scratch.
Small security teams
1-3 people, no enterprise GRC budget. NIS2YOU gives you 80% of the value for 5% of the price.
Not a fit if:
- × You're looking for a pentest, vuln scanner or SIEM (other tools exist and are better)
- × You're a large enterprise with a mature GRC programme (ServiceNow / Archer territory)
- × You want automated evidence collection from your systems (V2 on the roadmap)
Simple pricing, no lock-in
14-day free trial with every feature, no credit card. Then pick the plan that fits the size of your team.
Freelancers and teams of 1 to 5 people.
- 3 users
- Up to 50 risks
- Every feature: NIS2, ISO 27001, GDPR, PDF exports
Tech SMEs of 6 to 30 people.
- Up to 15 users
- Unlimited risks
- Every feature: NIS2, ISO 27001, GDPR, PDF exports
Organisations of 30 to 50 people.
- Up to 50 users
- Unlimited risks
- Every feature: NIS2, ISO 27001, GDPR, PDF exports
Organisations of 50 to 100 people.
- Unlimited users
- Unlimited risks
- Every feature: NIS2, ISO 27001, GDPR, PDF exports
Prices exclude VAT. Payments processed securely by Creem, cancel anytime. More than 100 people, need SSO or an API? Contact us.
Ready to see for yourself?
Create your account in 30 seconds. 14-day free trial, no credit card. Your data stays in Europe.