How Belgium's national road research institute put EU data sovereignty and continuous, real-time compliance across CyFun, NIS2 and GDPR on one platform with Secrato Enterprise.
Key takeaways
- As a public body, data sovereignty matters: NIS2, CyFun and GDPR run on one EU-hosted platform.
- Real-time monitoring replaced manual, once-a-year compliance.
- A lean team stays audit-ready without the spreadsheet grind.
Industry: Public infrastructure & research · Platform: Secrato Enterprise
The challenge
BRRC is Belgium’s national research institute for road and public-space construction — a critical-infrastructure sector now firmly in scope for NIS2. Alongside NIS2 and CyFun, it handles GDPR across large volumes of public-sector research data, all with a small IT and compliance team. Manual, point-in-time compliance simply didn’t scale, and periodic reviews left blind spots between audits.
Why Secrato
BRRC adopted Secrato Enterprise to replace manual, once-a-year compliance with continuous, real-time monitoring. CyFun, NIS2 and GDPR are unified on one European platform, so a lean team always knows where it stands. As a public body, where that data lives was decisive: an EU-hosted platform from a European provider keeps public-sector data under European data sovereignty — not a nice-to-have, but a requirement.
The result
Continuous oversight across frameworks, European data sovereignty by design, and audit-readiness as a steady state rather than a yearly push — all manageable by a small team.
“We serve the public sector, so where our data lives matters as much as the controls around it. Secrato keeps everything on an EU-hosted platform and gives our small team real-time oversight across CyFun, NIS2 and GDPR — data sovereignty and continuous compliance in one place, without the spreadsheet grind.”
Yannick Dambrain
IT Manager, Belgian Road Research Centre
