Monitor
At agreed intervals, we check that documents are up to date and that the controls they prescribe pass.
Deliverables- Check of review dates and approvals
- Recurring run of automated controls
- Alerts on gaps between documents and systems
Domain · Documents and compliance as code
Policies that are versioned, tested and always up to date.
We put your policies and procedures under version control, link each requirement to its control and generate the evidence at every change. A policy drifting from reality shows at once.
Situations
You are in the right place if…
- Your policies are PDFs signed three years ago that nobody opens any more.
- Nobody knows which version of a procedure is in force.
- Every audit makes you rebuild the evidence by hand.
- Your policies promise measures your systems do not apply.
- Your development teams work in Git, your security documentation in scattered files.
Our conviction
A versioned, tested policy stays current; a frozen PDF goes stale.
A security document is only worth something if it describes what actually happens. Written once and filed away, it drifts from the systems with every change, and the gap comes to light at the audit.
So we treat documentation as code: versioned, reviewed, linked to the controls it prescribes, and checked automatically. Each change leaves a trace; each requirement has its evidence.
Our approach
From the frozen document to generated evidence.
We start from your existing documents; nothing is rewritten without reason.
- 01Structure the corpusPrinciples, policies, standards and operating procedures: a clear hierarchy, without duplicates or contradictions.
You getA tiered document corpus
- 02VersionDocuments move under version control, with review and approval at every change.
You getA history of versions and approvals
- 03Link requirements and controlsEach requirement in a document points to the control that checks it, automated where possible.
You getA requirements–controls matrix
- 04Generate the evidenceAt every change, the controls run and produce dated evidence; a gap blocks or alerts.
You getEvidence generated and checked
What the texts say
What the texts expect of documentation.
The texts ask for documented policies, reviewed and whose effectiveness is assessed: exactly what version control and automated controls make demonstrable.
- DORADORA art. 6(2) · DORA art. 6(5)
A financial entity’s ICT risk management framework includes strategies, policies, procedures and tools; it is documented, reviewed at least once a year and continuously improved.12
- NIS 2 · ReCyFNIS 2 art. 21(2), point (a) · NIS 2 art. 21(2), point (f) · ReCyF v2.5, objectif 2
The directive asks Member States to require of entities policies on risk analysis and information system security, and policies and procedures to assess the effectiveness of measures; the ReCyF (working version) provides for an information systems security policy within the governance framework.345
- GDPRRGPD art. 24(1) · RGPD art. 24(2) · RGPD art. 32(1), point (d)
The controller implements measures to demonstrate compliance, reviews them, includes data protection policies where proportionate, and provides, as appropriate, a process for regularly testing the effectiveness of security measures.678
- CNIL guideGuide CNIL sécurité, fiche 1, F01-MC-02
The CNIL recommends, as a further measure, recording data protection objectives in a general policy carried by management, then detailed in topic policies and procedures.9
The texts do not apply to every organisation: whether they apply depends on your status, your sector, your size and your contracts. Have it confirmed by your legal counsel or a specialised lawyer.
Our engagementLevel 01 Level 02 Level 03
The same topic, at three levels of engagement.
You choose the level; the scope and deliverables are set by contract.
Advise
We structure the corpus, review the documents and propose the controls that make them checkable.
Deliverables- Map and hierarchy of the corpus
- Review of existing policies and procedures
- Requirements–controls matrix
Drive
We run the move to version control and the upkeep of the corpus with your teams, without making the changes in your systems.
Deliverables- Management of the corpus migration
- Review and approval workflow in place
- Audit-ready evidence file
AcceleratorsStructured document templates Ready-made controls Regulatory mappings
What we bring from day one.
Policies, standards and procedures in a versionable text format, exported to Word or PDF for your readers.
Automated checks for common requirements, to plug into your CI/CD pipeline.
Each requirement in a document can point to the DORA, NIS 2 or GDPR provisions it serves.
Frequently asked questions
Before we start.
Will our non-technical teams still be able to read the documents?
Yes. Documents remain readable text, published as Word, PDF or a web page; only their source is versioned. Reviewers do not need to know Git.
Must everything be rewritten?
No. We take over your documents, remove duplicates and contradictions, and only rewrite what no longer describes reality.
How often should we review our policies?
For a financial entity subject to DORA, the ICT risk management framework is reviewed at least once a year (periodically for microenterprises), and after a major incident. For others, we recommend a similar pace, and a review at each significant change.2
Can every control be automated?
No. A configuration can be checked automatically; a management review or a crisis exercise cannot. We automate what can be, and date the evidence of manual controls.
Start with one document.
Describe your document corpus and your tools. We come back to you with a proposal for a first migration.
Sources
The excerpts quoted.
Exact text, in its original language, from the frameworks extracted from the official text.
Show the 9 excerpts quoted
- 1DORA art. 6(2)
32022R2554-a6-p2The ICT risk management framework shall include at least strategies, policies, procedures, ICT protocols and tools that are necessary to duly and adequately protect all information assets and ICT assets, including computer software, hardware, servers, as well as to protect all relevant physical components and infrastructures, such as premises, data centres and sensitive designated areas, to ensure that all information assets and ICT assets are adequately protected from risks including damage and unauthorised access or usage.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
- Version
- CELEX 32022R2554 — ELI reg/2022/2554
- 2DORA art. 6(5)
32022R2554-a6-p5The ICT risk management framework shall be documented and reviewed at least once a year, or periodically in the case of microenterprises, as well as upon the occurrence of major ICT-related incidents, and following supervisory instructions or conclusions derived from relevant digital operational resilience testing or audit processes. It shall be continuously improved on the basis of lessons derived from implementation and monitoring. A report on the review of the ICT risk management framework shall be submitted to the competent authority upon its request.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2022/2554 of the European Parliament and of the Council of 14 December 2022 on digital operational resilience for the financial sector
- Version
- CELEX 32022R2554 — ELI reg/2022/2554
- 3NIS 2 art. 21(2), point (a)
32022L2555-a21-p2-1policies on risk analysis and information system security;
- Normative force
- EU law to be transposed (directive): not directly applicable, requires national transposition
- Source
- Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
- Version
- CELEX 32022L2555 — ELI dir/2022/2555
- 4NIS 2 art. 21(2), point (f)
32022L2555-a21-p2-6policies and procedures to assess the effectiveness of cybersecurity risk-management measures;
- Normative force
- EU law to be transposed (directive): not directly applicable, requires national transposition
- Source
- Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
- Version
- CELEX 32022L2555 — ELI dir/2022/2555
- 5ReCyF v2.5, objectif 2
recyf:obj-2Les entités [importantes et essentielles] définissent un cadre de gouvernance de la sécurité numérique placé sous la responsabilité du dirigeant exécutif. Le cadre de gouvernance de la sécurité numérique consiste en la mise en place, au sein des entités [importantes et essentielles] : 1. D’une organisation ; 2. De rôles et responsabilités en matière de sécurité numérique ; 3. De processus de gestion de la conformité ; 4. D’une politique de sécurité des systèmes d’information et des politiques comprenant au minimum des dispositions en matière d’usage du chiffrement, de contrôle d’accès physique et logique et de revue de l’application des mesures de sécurité mises en œuvre. Les entités [importantes et essentielles] : - réalisent une analyse de leur conformité vis-à-vis des dispositions [pointer vers les dispositions du décret correspondant aux objectifs de sécurité], - identifient les éventuels écarts existants par rapport aux objectifs de sécurité et, - établissent et suivent dans la durée un plan d’action pour corriger chacun de ces écarts dans les meilleurs délais. Ce plan d’action est adapté à la structure de l’entité et à son environnement. La responsabilité de ce plan d’action est déterminée au regard du cadre de gouvernance de la sécurité numérique mis en place. Les entités essentielles établissent ce plan d’action en tenant compte de l’analyse de risques qu’elles sont tenues de réaliser en application de [l’objectif 16]. Ce plan d’action ne préjuge pas de l’appréciation du respect de ses obligations légales et règlementaires lors d’un contrôle par l’ANSSI.
- Normative force
- obligation (decree, resilience bill)
- Source
- ReCyF — Référentiel Cyber France (NIS 2, transposition nationale)
- Version
- 2.5 du 17/03/2026 (version de travail)
- Status
- Working version: not binding until the transposition is enacted
- 6RGPD art. 24(1)
32016R0679-a24-p1Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Version
- CELEX 32016R0679 — ELI reg/2016/679
- 7RGPD art. 24(2)
32016R0679-a24-p2Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Version
- CELEX 32016R0679 — ELI reg/2016/679
- 8RGPD art. 32(1), point (d)
32016R0679-a32-p1-4a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
- Normative force
- directly applicable EU law (regulation, level 1)
- Source
- Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
- Version
- CELEX 32016R0679 — ELI reg/2016/679
- 9Guide CNIL sécurité, fiche 1, F01-MC-02
F01-MC-02Les objectifs généraux en matière de protection des données personnelles peuvent être consignés dans une politique générale de protection des données, portée par la direction et diffusée à l’ensemble des acteurs (personnels, sous-traitants, partenaires). Cette politique peut ensuite être précisée à un niveau opérationnel en politiques thématiques et procédures détaillées pour décliner au contexte d’activité de l’organisme les mesures de protection des données personnelles.
- Normative force
- recommendation (soft law)
- Source
- Guide pratique RGPD — Sécurité des données personnelles
- Version
- 2024 (mise à jour 2026)