instXinstX
Contact us

Compliance & governance

Compliance & Governance

Evidence-led governance for TISAX, NIS2, DORA, GDPR, ISO 27001, SOC 2, the EU AI Act and the Cyber Resilience Act

Map controls once and apply across frameworks. Automate evidence. Continuously monitor risk. Stay audit-ready, all year.

Discuss this serviceAll services
Frameworks we help you meet
ISO/IEC 27001SOC 2TISAXNIS2DORAEU AI ActCRA

Feature comparison

Select the right compliance operating model

Move from targeted readiness to continuous evidence operations and enterprise governance across frameworks, suppliers and risk owners.

CapabilityFramework Readiness AssessmentRecommendedContinuous Compliance OperationsEnterprise GRC Programme
Framework mapping (ISO 27001, SOC 2, NIS2, DORA, GDPR, EU AI Act, CRA)
Control library and policy templates
Evidence collection from integrationsLimited
Continuous control monitoring
Third-party risk managementBasic

Compliance packages

Defined scope. Clear ownership. Audit-ready outcomes.

Framework Readiness Assessment

Assess control gaps, define audit priorities and establish a practical remediation plan for the target framework.

  • Framework or TISAX/VDA ISA gap assessment
  • Control design and policy baseline
  • Prioritised remediation ownership
Recommended

Continuous Compliance Operations

Automate evidence collection, monitor control health and keep audit materials current throughout the year.

  • Evidence automation from core systems
  • Continuous control monitoring
  • Compliance dashboards and exception reporting

Enterprise GRC Programme

Run an integrated governance programme across frameworks, suppliers, risk registers and executive reporting.

  • Continuous compliance operating model
  • Cross-framework and TISAX control mapping
  • Risk register and treatment governance
Map once, apply across

A single control system for the regulations buyers now ask about

NIS2, DORA, GDPR, the EU AI Act, the Cyber Resilience Act and TISAX all push teams toward provable risk management, evidence, supplier oversight and leadership visibility. We map controls once so the same work supports every framework in scope.

Control coverage across mapped standards and regulators
ISO 27001: Full coverageSOC 2: Full coverageTISAX: Full coverageNIS2: Full coverageDORA: Full coverageGDPR: Full coverageEU AI Act: Full coverageCyber Resilience Act: Full coverage
ISO 27001: Full coverageSOC 2: Full coverageTISAX: Not coveredNIS2: Full coverageDORA: Full coverageGDPR: Not coveredEU AI Act: Full coverageCyber Resilience Act: Full coverage
ISO 27001: Partial coverageSOC 2: Partial coverageTISAX: Partial coverageNIS2: Not coveredDORA: Full coverageGDPR: Full coverageEU AI Act: Full coverageCyber Resilience Act: Full coverage
ISO 27001: Full coverageSOC 2: Not coveredTISAX: Partial coverageNIS2: Full coverageDORA: Full coverageGDPR: Full coverageEU AI Act: Full coverageCyber Resilience Act: Not covered
ISO 27001: Full coverageSOC 2: Full coverageTISAX: Partial coverageNIS2: Full coverageDORA: Partial coverageGDPR: Full coverageEU AI Act: Full coverageCyber Resilience Act: Full coverage
Feature comparison

What each compliance package includes

Select the operating model that matches your compliance maturity: establish readiness, operationalise continuous evidence, then govern risk and controls across frameworks and suppliers.

Framework Readiness AssessmentContinuous Compliance OperationsEnterprise GRC Programme
Regulatory readiness
NIS2 risk-management and incident-readiness mapping
DORA ICT risk, resilience testing and third-party register supportGap onlyCore controlsFull programme
GDPR accountability, privacy-by-design and breach evidence
EU AI Act and Cyber Resilience Act control mappingScopingControlsLifecycle governance
Control and evidence operations
Cross-framework control libraryTarget frameworkISO/SOC/NIS2/DORA/GDPRMulti-framework
Automated evidence collection from cloud, identity, code and tickets
Continuous control monitoring and exception ownership
Policy, procedure and control-owner workflows
Governance and reporting
Board and leadership compliance dashboardReadiness reportLive dashboardExecutive GRC view
Vendor and third-party risk managementLightweight
Audit liaison and evidence packaging
Risk register, treatment plans and remediation governanceRoadmapTracked exceptions
Outcomes

What connected compliance gives you

Map once, apply across

A single connected control set maps across ISO 27001, SOC 2, TISAX, NIS2, DORA, GDPR and the EU AI Act, so overlapping requirements are satisfied once instead of project by project.

Continuous evidence automation

Evidence is collected automatically from your cloud, identity and ticketing systems, replacing screenshot-and-spreadsheet rituals with a live, always-current control record.

Always audit-ready

Continuous monitoring keeps controls in a known state year-round, so audits become a confirmation rather than a fire drill. Positioning support, not a binding legal guarantee.

A unified GRC view

Risk, controls, policies and third parties live in one place, giving leadership a single dashboard of compliance posture across every framework in scope.

FAQ

Common questions

  • Most frameworks share a large set of underlying controls. We map each control to every framework it satisfies, so implementing it once provides evidence for ISO 27001, SOC 2, TISAX, NIS2, DORA, GDPR and the EU AI Act simultaneously instead of repeating work.

  • We connect to your cloud, identity, code and ticketing systems and collect control evidence automatically on a schedule. Instead of gathering screenshots before an audit, your control state stays current and exceptions are flagged as they happen.

  • We commonly cover ISO 27001, SOC 2, TISAX, NIS2, DORA, GDPR and the EU AI Act. The connected control model means adding a new framework reuses much of the evidence you already maintain.

  • We help automotive suppliers and service providers prepare for the ENX-governed TISAX process: define the assessment scope, select the relevant objectives such as Confidential, Strictly confidential, availability, prototype protection or data protection, complete the VDA ISA self-assessment, organise evidence, prepare corrective actions and coordinate with an approved audit provider. TISAX labels are issued through the formal assessment process, not by us.

  • Yes. We help you inventory AI systems, classify risk, and map governance, documentation and oversight controls to EU AI Act expectations, reusing your existing ISO 27001 and GDPR work where it overlaps. This is positioning support, not a binding legal guarantee.

  • No one can guarantee an audit outcome, which is decided by an independent auditor. What we do is maximise readiness - strong controls, clean evidence and a clear remediation history - so you enter the audit well prepared. We provide positioning support, not a binding compliance guarantee.

Ready to make compliance provable?

We will help you turn frameworks, regulators and customer questionnaires into one operating model with clean evidence.

Contact us