Four plain questions give you an answer you can show. After that it is 93 duties, each with an owner, a verdict and the evidence behind it.
Your sector, your headcount, your turnover and your place in a group all decide it, and the answer moves when any of them do. Most firms guess, or buy an opinion that then sits in a PDF.
The duties start either way
One letter asks for business continuity, backup management, disaster recovery and crisis management as a single item. Nobody can mark that done, and nobody can prove it.
Nine artefacts behind one tick
The policy is with the CISO, the contracts with procurement, the background checks with HR, and the certificate with your supplier. Chasing all of it by email loses the thread.
Weeks of chasing per audit
Where you operate, what you do, how big you are, and how you sit in a group. One question at a time, in plain words.
NIS2 applies, does not currently apply, or is replaced by DORA. The twelve-step legal test and its articles are one click away.
93 requirements in 17 article groups. Each one gets an owner, a due date and one of four verdicts.
It quotes the passage that answers a requirement, names the document and the page, and lists what is still open.
The open points become the questions. Each ask goes to the colleague or the supplier who holds that document.
The documents you hand to an auditor, a regulator or your board.
Scope determination
The answer, its reasons and the rule version.
Requirements list
93 duties, with an owner and a verdict each.
Evidence trail
The quoted passage, its document and page.
Evidence request
Sent to the holder, listing what is open.
Regulatory mapping
| Obligation | Reference | What Covenance gives you |
|---|---|---|
| Management body duties | Art. 20 | Six requirements, each owned by the board. |
| Risk-management measures | Art. 21(1) | Three requirements on the measures themselves. |
| The ten measure areas | Art. 21(2)(a)-(j) | Sixty-five requirements across the ten letters. |
| Supplier security | Art. 21(3) | One requirement, answered by the supplier. |
| Corrective measures | Art. 21(4) | One requirement on acting when a measure falls short. |
| Incident reporting | Art. 23 | Eight requirements, including the 24-hour and 72-hour deadlines. |
| Registration | Art. 3, 26, 27, 29 | Six requirements on registering and keeping it current. |
| Technical measures | IR (EU) 2024/2690 | Three requirements from the implementing regulation. |
The requirements come from the directive, Commission Implementing Regulation (EU) 2024/2690 and ENISA's technical implementation guidance. Where a number or a date could not be read from the Official Journal, the requirement says so and nothing scores it.
DORA
Register of information, IT incidents, resilience tests and supplier oversight.
ISO 27001 & SOC 2
Shared controls across frameworks, access reviews, and evidence that holds up.
Assess vendors & third parties
One supplier list feeding every framework that asks for one.
In-house compliance & risk
One programme across GDPR, the AI Act and DORA, not three spreadsheets.
Leave your email and we’ll arrange a time. Bringing the register or spreadsheet you use today makes the session far more useful.
Long enough to be useful, short enough to fit your day
Someone who knows the regulations, not a script
Pick whatever time suits you
No obligation. We'll get back to you within one business day.
A walkthrough of the platform, and time to ask questions.