Question 1

What is Secrato?

Accepted Answer

Secrato is the sovereign GRC (Governance, Risk and Compliance) platform built in Belgium for European enterprises. It automates compliance management across GDPR, NIS2, DORA, ISO 27001, CyFun (Belgian Cyber Fundamentals), TISAX, PCI DSS, and 20+ European compliance frameworks with full EU data sovereignty and residency. Secrato launches on March 31, 2026.

Question 2

What compliance frameworks does Secrato support?

Accepted Answer

Secrato supports all major European and international compliance frameworks including: GDPR, NIS2 Directive, DORA (Digital Operational Resilience Act), EU CRA (Cyber Resilience Act), EU AI Act, ISO/IEC 27001, ISO 9001, ISO 14001, ISO 22301, ISO/IEC 42001, PCI DSS, TISAX, ANSSI, CyFun (Belgian Cyber Fundamentals from the Centre for Cybersecurity Belgium), BSI (German Cybersecurity), ENS (Spanish National Security Framework), SOC 2, NIST CSF, IEC 62443, and eIDAS 2.0. All frameworks are pre-mapped with cross-framework evidence reuse to eliminate duplicate work.

Question 3

What is CyFun and how does Secrato support it?

Accepted Answer

CyFun (Cyber Fundamentals) is the Belgian cybersecurity framework developed by the Centre for Cybersecurity Belgium (CCB). It provides a structured, risk-based approach to improving cybersecurity posture for Belgian organisations, aligned with NIS2 requirements. Secrato provides full CyFun compliance automation with pre-mapped controls, automated evidence collection, gap analysis, and continuous monitoring — making it the leading GRC platform for CyFun compliance in Belgium.

Question 4

What is NIS2 and who does it apply to?

Accepted Answer

NIS2 (Network and Information Security Directive 2) is the EU-wide cybersecurity legislation that entered into force in January 2023 and required transposition into national law by October 2024. It applies to essential entities (energy, transport, banking, healthcare, digital infrastructure) and important entities (postal services, waste management, manufacturing, food, chemicals, digital providers) across the EU. NIS2 imposes strict security requirements, incident reporting obligations, and management accountability. Secrato automates NIS2 compliance with pre-mapped controls, risk assessments, and continuous monitoring.

Question 5

What is DORA and who must comply?

Accepted Answer

DORA (Digital Operational Resilience Act) is an EU regulation that became applicable on January 17, 2025. It applies to financial entities including banks, insurance companies, investment firms, payment institutions, crypto-asset service providers, and their critical ICT third-party service providers. DORA requires ICT risk management, digital operational resilience testing, ICT-related incident reporting, and third-party risk management. Secrato provides automated DORA compliance management with pre-mapped controls and ICT risk management workflows.

Question 6

What is ISO 27001 and how does Secrato help achieve certification?

Accepted Answer

ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It provides a systematic approach to managing sensitive company information, covering risk assessment, security controls, policies, and continual improvement. Secrato accelerates ISO 27001 certification with pre-built control frameworks, automated evidence collection, risk register management, policy templates, internal audit workflows, and continuous compliance monitoring — reducing certification timelines by up to 60%.

Question 7

How does Secrato ensure EU data sovereignty?

Accepted Answer

Secrato stores all compliance data exclusively in EU-based data centres located within the European Union. The platform is GDPR-compliant by design and fully protected from US extraterritorial legal frameworks such as the CLOUD Act and FISA Section 702. All data processing agreements comply with EU data protection law. This ensures complete EU data sovereignty for European enterprises managing sensitive compliance, risk, and audit information.

Question 8

What is a GRC platform and why do European companies need one?

Accepted Answer

A GRC platform (Governance, Risk and Compliance platform) is software that helps organisations manage their governance frameworks, identify and mitigate risks, and maintain compliance with regulations and standards in a unified, automated way. European companies face an increasingly complex regulatory landscape — GDPR, NIS2, DORA, EU CRA, ISO certifications, and national frameworks like CyFun, ANSSI, and BSI. A dedicated European GRC platform like Secrato eliminates compliance silos, automates evidence collection, maps controls across frameworks, and provides real-time compliance visibility — all with EU data sovereignty.

Question 9

What is the EU Cyber Resilience Act (CRA)?

Accepted Answer

The EU Cyber Resilience Act (CRA) is a regulation that establishes mandatory cybersecurity requirements for products with digital elements sold in the EU market. It covers hardware and software products, requiring manufacturers to ensure security throughout the product lifecycle, report actively exploited vulnerabilities, and provide security updates. Secrato supports EU CRA compliance with pre-mapped controls, vulnerability management workflows, and product security documentation.

Question 10

When does Secrato launch?

Accepted Answer

Secrato officially launches on March 31, 2026 at 9:00 AM CEST. The platform is built in Belgium and designed specifically for European enterprises to automate compliance across all major EU and international compliance frameworks including GDPR, NIS2, DORA, ISO 27001, CyFun, and more.

Question 11

What makes Secrato different from other GRC platforms?

Accepted Answer

Secrato is the only GRC platform built exclusively in Europe, for Europe. Unlike US-based GRC vendors, Secrato offers: (1) Full EU data sovereignty with EU-only data residency; (2) Native support for European-specific frameworks like CyFun, ANSSI, BSI, ENS, and NIS2; (3) Pre-mapped cross-framework controls to eliminate duplicate compliance work; (4) GDPR-by-design architecture; (5) Deep expertise in EU regulatory requirements including DORA, NIS2, EU CRA, and EU AI Act; and (6) Belgian engineering with a European-first product philosophy.

Secrato — The Sovereign GRC Platform for Europe

Supported Compliance Frameworks

Key Features

About Secrato