Microsoft TeamsA new rule arrives
Someone reads a long PDF and hopes the right policy gets updated.
You know right away what it means for you
Saga shows what affects you, and a ready-made change is waiting for your approval.
All your compliance.
In one place.
Saga keeps track of the rules that apply to you, finds what’s missing and suggests what to do. You approve, and you always have proof when the auditor, the board or the regulator asks.
Under continuous review
- ISO 27001
- ISO 9001
- GDPR
- NIS2
- DORA
- EU AI Act
- CSRD
- CSDDD
- AMLR
- MiCA
- PSD2
- Cyber Resilience Act
- Data Act
- eIDAS 2.0
- DSA
- Whistleblowing Directive
- ISO 27701
- ISO 42001
From scattered signals to one record.
Everything comes from every direction.
New requirements, emails, tickets and files across different tools. No one sees the whole picture, and a lot depends on the right person remembering the right thing.
Saga brings it all into one place.
Every requirement, event and file is pulled in and tied to your business, whichever tool it came from.
And sorts it into order.
Every requirement, action and record lands in its place, and every action gets an owner and a status.
And makes everything traceable.
From the requirement, through the action, to the record that shows it is done.
How it looks today
Sound familiar?
Most companies run compliance out of binders, folders and Excel. It works, until something happens.
- Last modified 2021-03-14
Information_Security_Policy_FINAL_v3.docxPolicies live in a binder or a folder.
Nobody knows for sure which version is current.
Suppliers_2023.xlsxSuppliers and contracts in an Excel sheet.
Only one person understands it, and that person is on holiday.
- NIS2_directive_2022-2555.pdf73 pages
A new rule arrives.
Nobody really knows what it means for you.
- ALAnna LindqvistRe: Re: Evidence for the auditHi! A reminder about the evidence for next week’s audit…
The auditor asks for evidence.
Someone spends a week searching emails and folders.
What Saga replaces
Fewer places to look.
Saga brings all of this into one place, and keeps it alive.
Regulatory change records
A person records a rule change with its source and assigns any follow-up work.
Policy folders and version lists
One current version, with changes, review and approval in the same place.
Spreadsheets and task boards
Requirements, gaps, owners and dates stay connected.
Training logs and evidence folders
Completed training and evidence are linked to the requirement they meet.
How Saga worksCompliance isn’t a project.
Compliance isn’t a project.
It’s a cycle.
Saga keeps the cycle going. When something changes, you know what it means for you and what needs to be done. Recognise the thinking from ISO? It’s the same improvement cycle, only it runs every day.
Map risk
Saga starts from what you do, where you operate and which suppliers you have, and works out which rules apply to you and why. It all comes together in Company & scope and Vendors & data.
Company & scopeSet policy
The rules become your policies. They are written, linked to the requirements they meet and kept current, and when a person records a rule change, affected policies can be reviewed and any update approved in Policies.
Company & scopeTrain teams
The work reaches the whole organisation. The right people get the right training, checklists and deadlines, and the compliance calendar shows who has done what.
Compliance workReview controls
The gap analysis shows whether it works in practice by comparing how you actually work with what the requirements say. Anything missing becomes a finding with an owner, and if something happens an incident is opened straight away.
Compliance workDocument
Evidence is collected where the work happens and every decision is approved by a person. Reports for the board, the auditor and the regulator, and the evidence for certification, come straight out of Saga.
Review & proofImprove
Saga re-checks work when business facts, evidence or dates change. A person records regulatory changes and reviews their effect on the work.
See the productSteg 1 av 6
Day to day
Four moments.
Four moments.
Before and after Saga.
The ISO audit is coming up
Weeks of hunting for evidence in folders, emails and binders.
The evidence is already there
Evidence has been collected along the way and linked to every requirement. You know what’s missing long before the auditor arrives.
Something has happened
Nobody knows who should do what, or how long you have to report.
The clock and the next step are visible
Saga opens the case, shows the deadline and who is responsible, and keeps a timestamped history.
The board asks where things stand
Someone builds a presentation on gut feeling, and nobody can answer the follow-up questions.
The answer is there, with proof
You produce a report where every figure can be traced back to the record.
The requirements that take the most timeDifferent rules.
Different rules.
One way of working.
Every control, policy and piece of evidence is linked to every requirement it meets. You do the work once, and it counts everywhere it is needed.
Health and safety on site.
In construction, AFS 2023:1 and 2023:3 require risk assessments, a work environment plan and the BAS-P and BAS-U coordinators in every project, subcontractors included. In Saga, every project gets its checklist, its owners and its evidence.
Inspections that cannot be missed.
Property owners must have lifts and ventilation (OVK) inspected at set intervals and keep fire protection in order. Miss a lift inspection and the lift may not be used. In Saga, every inspection gets a deadline, an owner and a filed report.
Food safety checks that never stop.
Food producers must work to HACCP and be able to show control points, deviations and traceability to food inspectors and in BRCGS or IFS audits. In Saga, the food safety programme, deviations and audit evidence sit in one place.
Deviations that lead somewhere.
Under SOSFS 2011:9, health and social care providers need a management system for systematic quality work, and serious incidents must be reported to IVO under Lex Maria and Lex Sarah. In Saga, deviations, risk analyses and internal checks are followed up with owners and dates.
Cybersecurity is a management matter.
Since January 2026, energy companies covered by the Cybersecurity Act (NIS2) must register with MCF, take security measures, train their management and report serious incidents. In Saga, measures, incidents and management decisions are linked to the requirements of the law.
Digital resilience, documented.
Since January 2025, DORA requires financial firms to show how they manage ICT risk, incidents and ICT providers. In Saga, the provider register, incidents and exercises are linked to the requirements they meet.
CE marked before it ships.
Manufacturers of home appliances must be able to show that every product is safe, CE marked and meets the energy labelling and ecodesign requirements. Connected products also face new cybersecurity requirements. In Saga the technical documentation and the declaration of conformity are kept together for each product.
The right certificate for every driver.
Haulage firms must follow the driving and rest time rules, and transporting dangerous goods requires a valid ADR certificate for the driver and a safety adviser in the company. In Saga every driver and vehicle has its certificates and checks, and anything about to expire shows up in good time.
Your industry?
Saga works for every industry with rules to follow. See more examples and what Saga looks like for you.
All industries
The platform
Works where you already work.
On the desktop
All your compliance in the browser, with Saga doing the heavy lifting in the background.
Home
Good morning, Maya
Three things need your attention this week.
ISO 27001 readiness95%
Open findings31 high · 2 medium
Awaiting approval2Policies ready for review
Next deadline31 AugSupplier offboarding
What changed
Supply-chain security applies to you2 policies affectedNIS2 Art. 21(2)(d)
Supplier access removalOwner Maya Lind · due 31 AugGap
EDPB guidance updateReviewed by SagaNo impact
Incident Response PlanChecked against NIS2 timelinesCovered
Waiting for you
Supplier Security Policy v3.33 changes · drafted by SagaReview
Access Control Procedure v2.11 changeReview
Q3 board briefReady to exportDraft
Vendor risk: Nordlys ITOffboarding closed · verifyVerify
Upcoming deadlines
Supplier offboarding evidenceMaya Lind31 Aug
Independent access verificationJonas Berg30 Sep
Annual GDPR record of processingData Protection Officer15 Oct
NIS2 incident drillIT Operations4 Nov
Q4 board briefCompliance12 Dec
Evidence collected this week
Access ticket IT-4821Attached to F-112Jira
Risk register38 risks syncedExcel
Policy acknowledgements81 of 86 employeesSharePoint
Signed supplier contractLinked to vendor recordiCloud
Backup restore reportPassed · 2 SepGoogle Drive
On mobile
Pick up where you left off, on your phone or tablet.
Policies
Supplier Security Policy
Draft v3.3 · prepared by Saga · Awaiting review
§ 4.2 Ending a supplier relationship
When a supplier contract ends, the system ownerApproveRequest changes
9:41
Ask SagaApprovals · 2
Our contract with Nordlys IT ended Friday. Are we covered?
Read Supplier Security Policy v3.3
Checked NIS2 Art. 21(2)(d)
Found access ticket IT-4821
Almost. Accounts, keys and shared links are revoked and IT-4821 is attached. One step is open: independent verification by Jonas Berg, due 30 Sep.
Connects to your tools
Saga collects evidence where the work already happens.
SharePoint
Google Drive
Slack
Claude
ChatGPT
Illustrative product view with sample data.
Common questions
What you might be wondering.
The questions we get in almost every meeting, with straight answers.
More on security and AI →Is it yet another system to keep track of?
No, fewer. Saga replaces binders, folders and Excel sheets with one place where everything connects.
Will it mean more work?
Less. Saga helps re-check work as facts, evidence or dates change, and suggests next steps. You spend your time on the decisions.
Can we trust the AI?
Saga uses AI that runs entirely inside the EU. Your data never leaves the EU, is never used to train models, and no decision is made without a person approving it.
What does it cost?
It depends on what you need. We’ll go through it on a short call, with no obligation.
Know where you stand.
Know what happens next.
Start with one area, one site or one project. We work from your rules and your day-to-day, and can map the requirements and bring in your policies together with you.
One workspace,
explored.
Saga is organised the way compliance work actually happens. Here is what you’ll find in each part of the workspace.
Home
Your starting point every morning, with what matters now and what has changed. Saga ranks what needs attention: new obligations that apply to you, open gaps, approvals waiting for you and the next deadline, without a dashboard you have to configure.
SAGACOMPLIANCE
Northstar Kapital AB
Saga
Search
Policies, work, evidence…⌘K
How Saga works
HomeWhat matters now and what changed.
Company & scopeFacts, applicable rules, people and durable records.
Compliance workPriorities, deadlines, findings and follow-up.
Review & proofEvidence, decisions, approvals and accountability.
ShareReports, certification and formal submissions.
Sign out
Northstar Kapital AB
Standing review freshness92%
11 of 12 standing reviews within cadence
Review source
Material exposureNo critical findings
1 high and 2 medium findings are open
View exposure
Proof readiness84%
Approved evidence covers 42 of 50 controls
Review evidence
TodayReview the draft
One approval is waiting for you
New guidance under DORA Art. 28 changes what your supplier policy has to cover. Saga has drafted three changes to the Supplier Security Policy and linked each one to its source.
PositionOn track
Next moveApprove Supplier Security Policy v3.3
TimingDue Friday 9 October
Your priorities
What follows today’s recommended action
Remove supplier access for Nordlys ITFinding · Jonas Berg · due 8 Oct
HighCollect the SOC 2 report from CloudBase ABData collection · requested 3 days ago
WaitingQuarterly access reviewChecklist · Sara Ek · due 15 Oct
UpcomingRisk posture
The material exposure Saga is tracking now
View findings
Supplier access remains after the contract endedDORA Art. 28 · Jonas Berg
HighBackup restore test is overdueISO 27001 A.8.13 · Sara Ek
MediumRecord of processing activities is incompleteGDPR Art. 30 · Maya Lind
MediumOperational pressureTwo owners carry most of the open work.
Upcoming
Deadlines and reviews that need attention soon
Open calendar
4
next 30 days9 OctApprove Supplier Security Policy v3.3
15 okt.Quarterly access review
31 OctAnnual information security training
Recent activity
Decisions, evidence and material updates
See what changed
Evidence added · Backup restore report30 sep. 2026 16:42
Decision recorded · NIS2 does not apply29 sep. 2026 10:15
Policy draft created · Supplier Security Policy v3.328 sep. 2026 09:01
Continuous review created · DORA ICT third-party risk22 sep. 2026 08:30
Work with Saga
Research, decide, draft, or take the next step with this company’s context.
You · 09:02
Which suppliers are missing a data processing agreement?
Two: Arkivbolaget and Payfront. I have prepared data collections for both. They go out once you approve.
Ask Saga to research, draft, compare, or take the next step…Edit mode
Illustrative product view with sample data.
Four parts, in the order the work is done.
First what applies to you, then the work, then the proof and finally what you show others. The same four parts as in Saga, and Home brings the most important things from them together every morning.
Company & scope
Company facts, which rules apply and why, your policies and suppliers.
Compliance work
Priorities, deadlines, findings and follow-up in one ordered view.
Review & proof
Evidence, decisions and approvals, where judgment stays human.
Share
Reports for the board, auditor and regulator, with the record behind them.
What you can ask Saga.
Saga answers from your own records and always shows the source. Nothing changes without your explicit approval.
Ask SagaSource-led · proof-aware
- What compliance work needs attention first?
- Which suppliers are missing a data processing agreement?
- What has changed since the last audit?
- Prepare the Q3 board report
- Where is our proof chain incomplete?
- Which policies are due for review this year?
- Which DORA requirements apply to us?
- Show the evidence for ISO 27001 A.5.18
- Does the PPWR apply to our packaging?
- Which actions are overdue?
- Does the EU AI Act affect us?
- Who owns the backup?
See it with your own scope.
We walk through Saga with your frameworks, your policies and your questions.
Company & scope
The baseline behind every answer Saga gives: your company facts, which rules apply and why, your policies, suppliers and the people responsible. Always current and traceable.
SAGACOMPLIANCE
Northstar Kapital AB
Saga
Search
Policies, work, evidence…⌘K
How Saga works
HomeWhat matters now and what changed.
Company & scopeFacts, applicable rules, people and durable records.
Compliance workPriorities, deadlines, findings and follow-up.
Review & proofEvidence, decisions, approvals and accountability.
ShareReports, certification and formal submissions.
Sign out
Saga workspace
Company & scope
The reliable facts, decisions, policies, people and records Saga uses for every answer.
Company profile
Northstar Kapital AB
Applicable frameworks5 frameworks
DORAFinancial entity under FI supervisionAppliesGDPRProcesses personal data in the EUAppliesAML ActCovered through its licensed activitiesAppliesISO 27001Voluntary, chosen by youChosenNIS2Question from Maya Lind · todayDORA takes precedence · NIS2 Art. 4To assessDoes not applyAsk SagaSource-led · proof-aware
Ask about anything at Northstar Kapital AB.
You · 09:02
Does NIS2 apply to us?
Saga update
Reading your company profile and NIS2 Articles 2–4.
Next: compare with DORA’s scope.Saga · answer
No, not for ICT risk and incident reporting. As a financial entity you follow DORA, which takes precedence over NIS2.
SourceNIS2 Art. 4Save this assessment to Company & scope?
ApproveNot now
Nothing is saved without your approval.✓ Approved by Maya Lind · saved
Ask Saga to research, draft, compare, or take the next step…
Edit modeIllustrative product view with sample data.
From scattered files to a living library.
Policies, agreements and certificates tend to live in folders, emails and copies with names like v7_FINAL. Saga sorts them where they belong: policies under Policies, and agreements and certificates as evidence under Review & proof. Duplicates become one current version, and everything gets an owner, a link to the requirements and a date for review or renewal.
POLICIES
AGREEMENTS
CERTIFICATES
Northstar Kapital AB
InformationssäkerhetspolicyVersion 2023 · Fastställd av styrelsen1. SyfteSyftet med policyn är att skydda bolagets information och informationssystem mot obehörig åtkomst, förändring och förlust. Policyn gäller alla medarbetare, konsulter och leverantörer som hanterar information för bolagets räkning.
2. OmfattningInformationssäkerhetsarbetet bedrivs i ett ledningssystem enligt ISO/IEC 27001. Ansvaret för att policyn efterlevs ligger hos respektive chef, och säkerhetsansvarig följer upp arbetet minst en gång per år.
PERSONUPPGIFTSBITRÄDESAVTALmellan Northstar Kapital AB och Nordlys IT AS1. Bakgrund och syfte
Personuppgiftsbiträdet får endast behandla personuppgifter enligt dokumenterade instruktioner från den personuppgiftsansvarige och ska vidta lämpliga tekniska och organisatoriska åtgärder enligt artikel 32.
2. BehandlingUnderbiträden får endast anlitas efter skriftligt förhandsgodkännande. Biträdet ska utan onödigt dröjsmål underrätta den personuppgiftsansvarige om en personuppgiftsincident.
Maya Lind
Erik Haugen
CERTIFIKATISO/IEC 27001:2022Härmed intygas att ledningssystemet för informationssäkerhet hosPayfront ABuppfyller kraven i standarden för betaltjänster och tillhörande drift.Certifikat nr 27001-4471 · Giltigt till 15 oktober 2026
Northstar Kapital AB
Riskpolicyv7 SLUTGILTIG · 14 mars 20251. SyfteBolaget ska identifiera, värdera och hantera risker som kan påverka verksamheten. Riskaptiten fastställs av styrelsen och riskerna rapporteras kvartalsvis till ledningsgruppen.
2. OmfattningInformationssäkerhetsarbetet bedrivs i ett ledningssystem enligt ISO/IEC 27001. Ansvaret för att policyn efterlevs ligger hos respektive chef, och säkerhetsansvarig följer upp arbetet minst en gång per år.
Jonas BergFrån: jonas.berg@northstar.exampleTill: Maya LindSkickat: 12 september 2026 14:08Ämne: Re: Biträdesavtal PayfrontBifogat: Biträdesavtal_Payfront_signerat.pdf
Hej Maya, här kommer det påskrivna biträdesavtalet från Payfront. De har även bifogat sitt ISO-certifikat, men det går ut i oktober. Kan du lägga in det? Mvh Jonas
NORDIC ASSURANCE
SOC 2 Typ II-rapportCloudBase ABPeriod: 1 januari – 31 december 2025Oberoende revisors rapportVi har granskat beskrivningen av CloudBase AB:s system och utformningen och effektiviteten hos de kontroller som avser säkerhet och tillgänglighet under perioden.
Vi har granskat beskrivningen av CloudBase AB:s system och utformningen och effektiviteten hos de kontroller som avser säkerhet och tillgänglighet under perioden.
Northstar Kapital AB
Policy mot penningtvätt och finansiering av terrorismVersion 4 · Fastställd 2 februari 20261. SyfteBolaget ska motverka att verksamheten utnyttjas för penningtvätt eller finansiering av terrorism. Kundkännedom ska inhämtas innan en affärsförbindelse etableras och följas upp löpande.
2. OmfattningInformationssäkerhetsarbetet bedrivs i ett ledningssystem enligt ISO/IEC 27001. Ansvaret för att policyn efterlevs ligger hos respektive chef, och säkerhetsansvarig följer upp arbetet minst en gång per år.
LEVERANTÖRSAVTALmellan Northstar Kapital AB och CloudBase AB1. Bakgrund och syfte
Leverantören ska tillhandahålla tjänsten i enlighet med bilaga 1 och de servicenivåer som anges i bilaga 2. Avtalet gäller i 36 månader från tecknandet.
2. BehandlingUnderbiträden får endast anlitas efter skriftligt förhandsgodkännande. Biträdet ska utan onödigt dröjsmål underrätta den personuppgiftsansvarige om en personuppgiftsincident.
Maya Lind
Lina Ek
Northstar Kapital AB
Riskpolicyv7 SLUTGILTIG (kopia) · 14 mars 20251. SyfteBolaget ska identifiera, värdera och hantera risker som kan påverka verksamheten. Riskaptiten fastställs av styrelsen och riskerna rapporteras kvartalsvis till ledningsgruppen.
2. OmfattningInformationssäkerhetsarbetet bedrivs i ett ledningssystem enligt ISO/IEC 27001. Ansvaret för att policyn efterlevs ligger hos respektive chef, och säkerhetsansvarig följer upp arbetet minst en gång per år.
SECURA LABS
Penetrationstest 2026Northstar Kapital AB · Extern miljöSammanfattningTestet omfattade externa tjänster och webbportalen. Två brister med medelhög risk identifierades och har åtgärdats.
Leverantören ska tillhandahålla tjänsten i enlighet med bilaga 1 och de servicenivåer som anges i bilaga 2. Avtalet gäller i 36 månader från tecknandet.
Northstar Kapital AB
IT-policyVersion 3 · Inskannad1. SyfteSyftet med policyn är att skydda bolagets information och informationssystem mot obehörig åtkomst, förändring och förlust. Policyn gäller alla medarbetare, konsulter och leverantörer som hanterar information för bolagets räkning.
2. OmfattningInformationssäkerhetsarbetet bedrivs i ett ledningssystem enligt ISO/IEC 27001. Ansvaret för att policyn efterlevs ligger hos respektive chef, och säkerhetsansvarig följer upp arbetet minst en gång per år.
Company & scopePolicies
1 duplicate merged
DORA · ISO 27001 · AML Act1 duplicate mergedReview & proof · ProofAgreements
3 signed
GDPR Art. 28 · DORA Art. 303 signedReview & proof · ProofCertificates and reports
ISO 27001 · SOC 2SE1 expires in 14 days
Duplicate merged
Suppliers hand over the evidence. Nobody has to chase.
Saga knows which suppliers handle your data and which documents your policy requires from them. Requests go out through Data collections, the answers land in the right place and you see at once what is missing or about to expire.
Vendors & data
Collect documents from suppliers and track who the company depends on, what data they share, which DPA proves it and when contracts renew.
Vendors (4)Processing register (6)
Third parties, data shared, DPA status, renewals and vendor risk.
RequestsAsk suppliers for a policy document by secure link, then review what comes back against ours.
View allCloudBase ABSOC 2 Type II report
Requested 3 days agoReceived todayPayfrontISO 27001 certificate
Link openedArkivbolagetData processing agreement
OverdueSupplierData sharedDPARenewsRisk
Nordlys ITPersonal dataSignedDec 2027Low
CloudBase ABCustomer dataSignedMar 2027Medium
PayfrontPayment dataSignedJan 2027Medium
ArkivbolagetArchived recordsMissingNov 2026High
Illustrative product view with sample data.
Everything in Company & scope.
What describes the company and what applies to you, gathered in one place.
- Company & scopeReview company facts and which requirements apply.
- PoliciesDraft, approve, publish and maintain company policies.
- Vendors & dataCollect documents from suppliers and track who handles your data, agreements and renewals.
- Data collectionsAsk suppliers for the documents your policy requires.
- Privacy requestsHandle access, correction and deletion requests from customers, employees or anyone else.
- ActivityA high-level timeline of what happens in the company.
- Audit logSee who changed what, and when.
- Regulatory wikiRead the requirements and sources Saga relies on.
- Compliance contactsMaintain the people responsible for compliance.
What you can ask Saga.
Saga answers from your own records and always shows the source. Nothing changes without your explicit approval.
Ask SagaSource-led · proof-aware
- Which frameworks apply to us, and why?
- Which policies are due for review this year?
- Which suppliers handle personal data?
- Which requirements does our supplier policy meet?
- Which privacy requests are open?
- Which agreements expire this autumn?
- Does NIS2 apply to us?
- Which suppliers are missing a data processing agreement?
- Who is responsible for information security?
- Who changed the risk policy, and when?
- Show the source of the incident reporting requirement
- Does the EU AI Act affect us?
See it with your own scope.
We walk through Saga with your frameworks, your policies and your questions.
Compliance work
Every priority, question and deadline in one ordered view, without configuring the machinery behind it. Saga finds the gaps, proposes the fix and keeps the evidence together until it is done.
SAGACOMPLIANCE
Northstar Kapital AB
Saga
Search
Policies, work, evidence…⌘K
How Saga works
HomeWhat matters now and what changed.
Company & scopeFacts, applicable rules, people and durable records.
Compliance workPriorities, deadlines, findings and follow-up.
Review & proofEvidence, decisions, approvals and accountability.
ShareReports, certification and formal submissions.
Sign out
Saga workspace
Compliance work
Every priority, question and deadline in one ordered view.
Your work, in order4 open6 open
Add an exit clause to the CloudBase agreementFinding · DORA Art. 30 · Jonas Berg
NewDocument an exit plan for critical ICT suppliersFinding · DORA Art. 28(8) · Maya Lind
NewApprove Supplier Security Policy v3.3Approval · due Fri 9 Oct
To approveRemove supplier access for Nordlys ITFinding · Jonas Berg · due 8 Oct
HighCollect the SOC 2 report from CloudBase ABData collection · requested 3 days ago
WaitingQuarterly access reviewChecklist · Sara Ek · due 15 Oct
UpcomingAsk SagaSource-led · proof-aware
Ask about anything at Northstar Kapital AB.
You · 09:02
Run a gap analysis against DORA Art. 28
Saga update
Comparing your supplier agreements and routines with DORA Articles 28 and 30.
Next: reading 4 agreements and the supplier policy.Saga · answer
Two gaps. The CloudBase agreement has no exit clause, and there is no documented exit plan for critical ICT suppliers.
SourceDORA Art. 28(8) · Art. 30Create two actions with suggested owners?
ApproveNot now
Nothing is created without your approval.✓ Approved by Maya Lind · 2 actions created
Ask Saga to research, draft, compare, or take the next step…
Edit modeIllustrative product view with sample data.
Every deadline in one place.
The calendar gathers everything that has a date: recurring reviews, training, agreements and certificates that expire and actions that need to be done. Saga reminds the owner in good time, and you see at once what is at risk of slipping.
Compliance Calendar
One dated view of regulatory changes, training, incidents, submissions, certification, policies, acknowledgments, deadlines and recurring reviews.
All5Overdue1Next 7 days2Next 30 days4
All work5Continuous reviews2Policy reviews1Incident remediation1Vendor documents1Training due0Regulator submissions0
Scheduled work5 of 5 entries
Overdue1
30SEP. 2026
Backup restore testContinuous review · ISO 27001 A.8.13
Internal1d overdueThis week2
06OKT. 2026
EU AI Act continuous revieweu_ai_act
StatutoryIn 5d08OKT. 2026
Remove supplier access for Nordlys ITIncident remediation · Jonas Berg
InternalIn 7dLater this month2
09OKT. 2026
Approve Supplier Security Policy v3.3Policy review · Maya Lind
InternalIn 8d15OKT. 2026
Payfront ISO 27001 certificate expiresVendor document · Payfront
ContractualIn 14dIllustrative product view with sample data.
From gap to evidence, with an owner all the way.
Every gap gets an owner, a deadline and a proposed fix. Each step is saved in an append-only event history, and once the gap is resolved the evidence is linked to the requirement. You can show it is done, not just say it.
Findings & remediation
Issues that need a recorded outcome in the selected company.
RemediationRisk lensChange impact
All 4Open 3In progress 1Resolved 0Accepted 0
Finding register4 of 4Export CSV
FindingsSeverityStatusOwnerDue
Supplier access remains after the contract endedHighOpenIn progressResolvedJonas Berg8 OctStart workResolve✓
CloudBase agreement has no exit clauseHighOpenJonas Berg30 OctStart work
Backup restore test is overdueMediumOpenSara Ek9 OctStart work
Record of processing activities is incompleteMediumIn progressMaya Lind31 OctResolve
Complete event historyAppend-only
RaisedSaga · automatic check28 sep. 2026 09:12
Owner assignedmaya.lind@northstar.example28 sep. 2026 09:40
Work startedjonas.berg@northstar.example30 sep. 2026 08:15
Evidence attachedokta-access-export.csv1 okt. 2026 14:02
Resolvedmaya.lind@northstar.example1 okt. 2026 16:30
Illustrative product view with sample data.
Everything in Compliance work.
The ongoing work, gathered in one place.
- CalendarSee deadlines, recurring reviews and upcoming work.
- Findings & remediationInvestigate issues, assign owners and track resolution.
- Gap analysisCompare current practice with applicable requirements.
- ChecklistsRun repeatable procedures and retain completion history.
- TrainingAssign learning and track completion.
- IncidentsCoordinate response, decisions, notifications and evidence.
- Whistleblower reportsManage protected reports and case follow-up.
- Health metricsReview compliance indicators and trends.
What you can ask Saga.
Saga answers from your own records and always shows the source. Nothing changes without your explicit approval.
Ask SagaSource-led · proof-aware
- What compliance work needs attention first?
- Run a gap analysis against ISO 27001
- Which recurring reviews are overdue?
- Which checklists are due this month?
- Who owns the backup?
- Which actions are overdue?
- Who hasn’t completed this year’s training?
- Open an incident for yesterday’s outage
- How has our compliance developed this year?
- What deadlines do we have in November?
See it with your own scope.
We walk through Saga with your frameworks, your policies and your questions.
Review & proof
This is where judgment stays human. Inspect the sources, test the evidence and make the decisions that matter, with the reasoning and owner saved for each one.
SAGACOMPLIANCE
Northstar Kapital AB
Saga
Search
Policies, work, evidence…⌘K
How Saga works
HomeWhat matters now and what changed.
Company & scopeFacts, applicable rules, people and durable records.
Compliance workPriorities, deadlines, findings and follow-up.
Review & proofEvidence, decisions, approvals and accountability.
ShareReports, certification and formal submissions.
Sign out
Proof
Review the records behind compliance claims. Approval records a decision; a missing obligation, policy or evidence link remains only partially supported.
Find evidence in SharePointAdd evidence
Awaiting review31No decision recorded
Approved records3941Durable review history
Stored files128SHA-256 integrity recorded
Needs review (31)History (3941)Evidence vault
Proof awaiting review3 shown
Backup restore test · SeptemberStanding review · sara.ek@northstar.example · 30 sep.
restore-test-sep.pdfawaiting approvalapprovedPassportSigned DPA · Nordlys ITCertification requirement · jonas.berg@northstar.example · 29 sep.
dpa-nordlys-signed.pdfawaiting approvalapprovedPassportAccess review · Q3Standing review · sara.ek@northstar.example · 1 okt.
No control linkedawaiting approvalPartially supportedAsk SagaSource-led · proof-aware
Ask about anything at Northstar Kapital AB.
You · 09:02
Which evidence can I approve today?
Saga update
Checking the requirement → control → evidence chain for 3 records awaiting review.
Next: comparing the files’ checksums.Saga · answer
Two are complete. The restore test and the Nordlys agreement have the full chain and unchanged files. The access review has no link to a control, so it only counts as partially supported.
SourceISO 27001 A.8.13 · DORA Art. 30Approve the two complete records?
ApproveNot now
Each approval is saved with your name.✓ Approved by Maya Lind · 2 records
Ask Saga to research, draft, compare, or take the next step…
Edit modeIllustrative product view with sample data.
Approve exactly the right version.
Saga shows what has changed since the last version, why, and which requirement each change answers. You approve that exact version, and the approval is saved with a name, a time and a fingerprint of the document.
v3.0v3.1v3.2v3.3
Supplier Security PolicyVersion 3.3
SHA-256 7f3a 91c2 e04b 5d18✓ Approved by Maya Lind · 1 Oct 2026 16:30Every decision, with its reasoning and owner.
Judgments that matter are saved in the decision log: what was decided, why, on what basis and by whom. When the auditor asks why NIS2 does not apply, the answer is there, with its sources.
Decision log
The long-form reasoning record for important choices behind policies, findings, caveats and reports: what was decided, why and when it must be reviewed.
Active 2Archived 1All 3
Active decisions2
Review dates1
Comply/explain1
Proof links3
Decision recordsOpen decisions stay visible until archived.
2 shown§
Scope decision · NIS2 does not apply
Read full decisionApplicabilityactive
Northstar is a financial entity under DORA, which takes precedence over NIS2 for ICT risk and incident reporting.
§
Risk acceptance · Legacy archive system until Q1 2027
Read full decisionRisk acceptanceactive
The old archive system stays in use until the migration is done. Access is limited to two named people and logged.
Illustrative product view with sample data.
Everything in Review & proof.
What shows the work is done, gathered in one place.
- ProofCollect and assess the evidence behind compliance claims.
- ApprovalsReview exact versions and give accountable sign-off.
- Decision logRecord material judgments, rationale and ownership.
What you can ask Saga.
Saga answers from your own records and always shows the source. Nothing changes without your explicit approval.
Ask SagaSource-led · proof-aware
- Where is our proof chain incomplete?
- What is waiting for my approval?
- Why did we decide NIS2 doesn’t apply?
- Which requirements have no evidence?
- What has changed since the last audit?
- Show the evidence for ISO 27001 A.5.18
- Which evidence needs renewing soon?
- Who approved the supplier policy, and which version?
- Compare versions 3.2 and 3.3 of the IT policy
See it with your own scope.
We walk through Saga with your frameworks, your policies and your questions.
Share
Turn approved evidence into clear reports for the board, the auditor and the regulator. Everything points back to the record behind it.
Illustrative product view with sample data.
Ready when the auditor calls.
Saga assembles a versioned, approved pack for the auditor in a room of its own: the requirements, the approved evidence and the decisions behind it. You see exactly what is included before you publish, and internal gaps never end up there by mistake.
Compliance rooms
Prepare a versioned, approved pack for an auditor, customer or regulator. Every room has its own topic, scope, period and recipients.
External audit or compliance room
The default. You choose and preview exact approved material before issuing a frozen publication.
Internal gap review
A separate, deliberately authorized working session. Internal gaps are never added to an external room automatically.
ISO 27001 · surveillance audit 2026External audit / complianceDraftPublished
Nordic Assurance · certification body
50 requirements · Oct 2025 – Sep 2026
2 recipients · not published2 recipients · published todayOpen room
Pre-audit gap reviewInternal gap reviewDraft
Internal · Maya Lind and Sara Ek
ISO 27001 · 3 open gaps
2 recipients · not publishedOpen room
DORA register of informationExternal audit / compliancePublished
Finansinspektionen
DORA Art. 28 · 4 suppliers
1 recipient · published 12 SepOpen room
Customer security review · NordbankExternal audit / complianceDraft
Nordbank · supplier assurance
ISO 27001 · DORA Art. 30
1 recipient · not publishedOpen room
Illustrative product view with sample data.
The board gets one page, not a binder.
Saga turns the work into a summary that can be read in five minutes: where things stand, the risks and the decisions the board needs to take. Every figure can be followed down to its record if anyone asks.
Northstar Kapital ABBoard meeting 20 October 2026
Compliance Q3
The position is stable. One ISO 27001 deviation is being fixed before the audit in November.
84%1
proof readiness+4 since Q2
22
open findings with an owner−3 since Q2
13
decision for the boardAwaiting the board
Proof readiness by framework
DORA90%
GDPR86%
AML Act88%
ISO 270011 deviation72 %
Decision needed
Approve the risk acceptance for the archive system until Q1 2027.
Presented by Maya LindBasis: 54 approved records in SagaPage 1 of 7
1
Proof42 of 50 controls approved
2
FindingsNo. 14 and 22 · owners assigned
3
Decision logRisk acceptance · archive system
Everything in Share.
What goes on to auditors, the board and regulators, gathered in one place.
- ReportsCreate evidence-backed reports for each audience.
- Compliance roomsPrepare the audit in its own room, with the requirements, evidence and decisions gathered together.
- Regulator submissionsAssemble, approve and record formal filings.
- PortfolioReview compliance across companies and business units.
What you can ask Saga.
Saga answers from your own records and always shows the source. Nothing changes without your explicit approval.
Ask SagaSource-led · proof-aware
- Prepare the Q3 board report
- Summarise where we stand for the management team
- What evidence is behind the report?
- Which submissions have we made this year?
- Share the gap analysis with the auditor
- Prepare an audit room for ISO 27001
- How do our companies compare?
- What do we need to report to Finansinspektionen?
- Write a supplier risk report for the board
See it with your own scope.
We walk through Saga with your frameworks, your policies and your questions.
Built for the people
who carry the risk.
Find the right way in through your industry, the rules you must follow, your role or the situation you are in.
Four ways into the same Saga.
Start where it feels closest. It all leads to the same place, with your rules and your records.
- IndustriesThe same Saga, with the requirements and day-to-day of your industry.
- RegulationsDo the work once and let it count towards every framework that applies to you.
- Companies and ownersFor those who run compliance in the company, and for owners who want to know that every company does.
- SituationsWhen something is on the line and you need to know quickly where you stand and what to do.
Two ways to use Saga.
Either you run compliance in your own company, or you own several companies and want to know that all of them do. Saga works for both.
For the company
You know what applies, do the work and can show it, with owners, deadlines and proof in one place.
How it works for the companyGranvik Bygg AB
Standing review freshness90%
9 of 10 standing reviews within cadence
Review source
Material exposureNo critical findings
1 high and 1 medium finding are open
View exposure
Proof readiness81%
Approved evidence covers 34 of 42 controls
Review evidence
Today
One task is overdue
The induction for subcontractor Nordfasad AB at Kv. Tärnan was due on 30 September. Saga has prepared the checklist and a reminder to Anna Lund.
For the owner
You own several companies, in a portfolio or a group, and see at a glance how each one stands, without their records being mixed up.
How it works for the ownerPortfolio
RefreshOpen a company to inspect its recorded posture and outstanding work. Refresh reads the latest available records.
Companies in view 5
75%
Lindgården Omsorg AB1 critical findingStanding-review freshness
2 reviews overdue2 open findings
90%
Granvik Bygg AB1 overdue taskStanding-review freshness
Reviews current2 open findings
100%
Ekbacken Fastigheter AB1 overdue remarkStanding-review freshness
Reviews current1 open finding
83%
Vätterkraft AB1 supply chain gapStanding-review freshness
1 review overdue1 open finding
92%
Solbacka Livsmedel ABAudit in 41 daysStanding-review freshness
Reviews current3 open findings
We can help you get started.
You don’t have to start from a blank page. If you want support, we offer onboarding and set Saga up together with you.
Map
We map your activities, jurisdictions and which rules apply, together with you.
Bring in what you have
Your existing policies, registers and evidence come into Saga and are linked to the rules they cover.
Operate
Continuous review re-checks work when facts, evidence or dates change. Your team records regulatory changes and decides the response.
Find out what Saga would do for your team.
Tell us your frameworks and your structure. We’ll show you the parts that matter to you.
Industries
Every industry has rules. Saga starts from yours, not from a fixed template, and shows what applies, who does what and that it is done.
What it looks like across industries.
The same Saga, with the requirements and day-to-day of each industry. Here are ten examples.
Order on every site.
Under AFS 2023:1 and 2023:3, construction companies need risk assessments, a work environment plan and appointed BAS-P and BAS-U coordinators in every project, also when subcontractors are on site. In Saga every project gets its checklist with owners and proof, and what is missing shows before it becomes a problem.
No inspection forgotten.
Property owners must have elevators and ventilation inspected at regular intervals and keep fire safety in order. Miss an elevator inspection and the elevator cannot be used. In Saga every property gets its calendar, and every inspection a deadline, an owner and a saved protocol.
Own checks that hold up at the audit.
Food businesses must work to HACCP and be able to show critical control points, deviations and traceability, both to food inspectors and at BRCGS or IFS audits. In Saga every deviation leads to an action with an owner, and the record for the audit is already in place.
Fresh food, fully under control.
Grocery retail must keep the cold chain unbroken, label allergens correctly and be able to trace every product if something has to be recalled. The stores’ own checks are inspected by the municipal food control. In Saga every store has its own checks with temperature logs and deviations, and in a recall you see at once which stores are affected.
From deviation to improvement.
Health and social care providers need a management system for systematic quality work under SOSFS 2011:9, and serious events must be reported to IVO under lex Maria and lex Sarah. In Saga every event is investigated with an owner and a date, and the assessment of whether to report it is saved with the reasons.
Cybersecurity at management level.
Since January 2026, energy companies covered by the Cybersecurity Act must register with MCF, take security measures, train management and report serious incidents. In Saga every measure, incident and management decision is linked to the law’s requirements, so you can show where you stand.
A network others depend on.
Telecom operators fall under the Electronic Communications Act and the Cybersecurity Act, and outages, security incidents and personal data breaches must be reported within short deadlines. In Saga security measures, incidents and reports stay together, with owners and clocks that show how much time is left.
DORA, with the record in place.
Since January 2025, financial entities must be able to show under DORA how they manage ICT risk, incidents and ICT providers. In Saga the register of information stays current, and every contract, exit plan and exercise is linked to the requirements it meets.
Every shipment by the rules.
Logistics companies must follow the rules on driving and rest times, the carriage of dangerous goods under ADR and the work environment at the terminal. In Saga every driver and vehicle has its certificates and checks with deadlines, and whatever is about to expire shows in good time.
Products that meet the requirements.
Appliance makers must be able to show that their products are safe and CE marked, meet the energy labelling and ecodesign requirements and are taken care of when they become waste. In Saga every product is linked to the requirements it falls under, with technical documentation and a declaration of conformity.
Which regulations apply to you?
The catalogue shows which regulations exist. Which of them apply to your company, and what they require of you, Saga works out from your business and where you operate.
Your industry isn’t listed? It still is.
Every business has rules to follow. Saga starts with yours and builds the work around them, whatever the industry.
Logistics and transportRetailManufacturingTelecomIT and servicesPharma and life scienceAutomotiveChemicalsEducationPublic sectorInsuranceHotels and restaurantsWaste and recyclingMediaFarming and forestrySecurity servicesConsulting and advisoryFintech
Tell us about your businessSee what Saga looks like for your industry.
Tell us what you do and where you operate, and we will show you the parts that matter to you.
Regulations
A catalogue of the regulations Saga helps you with. Do the work once, and it counts towards every one that applies to you.
Area
Type
Status
No regulations match your search.
Is your regulation missing? Let us know, and Saga will add it for you
The catalogue is an overview and does not replace legal advice.
Find out what Saga would do for your team.
Tell us your frameworks and your structure. We’ll show you the parts that matter to you.
Companies and owners
Saga is used in two ways: by the company that runs its own compliance, and by the owner who wants to know every company does. The same Saga, from one company to a whole portfolio.
A company that knows where it stands.
Strukta AB runs its own compliance in Saga. Everyone knows what applies and who does what, and everyone works from the same record: the people doing the work see their actions and deadlines, the CEO sees the status and the risks, and the board gets a report where every figure can be traced to its evidence.
84Strukta ABConstructionA group that does the work once.
Strukta AB owns three subsidiaries. The parent company writes shared policies and routines once and shares them with all of them. Each subsidiary does the work in its own day-to-day, with its own owners and its own evidence, and the parent sees how they all stand in one place.
84Strukta ABParent company · 3 subsidiaries
79Strukta Infrastructure ABInfrastructure
86Strukta Industrial Solutions ABIndustry
88Strukta Fastighetsförvaltning ABProperty managementAn owner who knows it gets done.
Northstar Kapital owns five companies in different industries. The owner doesn’t do the work, but sees readiness, gaps and trends across the whole portfolio. In an acquisition the target is mapped quickly, and the material for the investment committee and the board is already there.
84Northstar Kapital ABInvestment company · 5 portfolio companies84Strukta ABConstruction77AXD LogisticsLogistics88MatFolkGrocery retail81NordiqHome appliances90TelioTelecomWhat does your portfolio look like?
Add your companies and Saga shows where each one stands, what’s missing and what to do first. We’ll show you what it looks like for you in a demo.
Find out what Saga would do for your team.
Tell us your frameworks and your structure. We’ll show you the parts that matter to you.
Situations
When something is on the line, you need to know where you stand, what to do and be able to show it afterwards.
Certification.
Saga runs the gap analysis against Annex A, assigns owners and collects evidence while the work gets done. When the auditor arrives the material is already there, and nobody has to search their inbox.
01
“We’re going for ISO 27001.”
- Week 1
- Week 2
- Ongoing
- The audit
New law.
Saga maps which requirements of the Cybersecurity Act apply to you, flags the policies they affect and sets up the incident reporting deadlines. You see at once what is done and what is left.
02
“NIS2 now applies to us.”
- Day 1
- Week 1
- Week 2
- Done
Acquisition.
Saga maps the target’s requirements and gaps before the deal is done, so the risks are part of the decision. After closing the company joins the portfolio and the work carries on there.
03
“We’re buying a company.”
- Before signing
- Before closing
- Closing
- The first 100 days
The board.
Saga produces a report with readiness, top risks and decisions, where every figure can be traced to its evidence. After the meeting the decisions are kept with the reasons behind them.
04
“The board wants to know where we stand.”
- Two weeks before
- A week before
- The meeting
- After the meeting
Incident.
Saga opens the case, starts the right notification clock and keeps a timestamped history of everything that is done. You see how much time is left and who owns the next step.
05
“We’ve had an incident.”
- Now
- 24 hours
- 72 hours
- One month
The regulator.
Saga assembles the response from approved evidence and records exactly what was sent, and when. If the regulator asks again, you know exactly what you submitted.
06
“The regulator got in touch.”
- Day 1
- Day 2
- Before the deadline
- Sent
What do you do when it happens to you?
Saga has a way of working for every situation, with steps, owners, templates and deadlines, fitted to the regulations that apply to you. We’re happy to show it in a demo.
Find out what Saga would do for your team.
Tell us your frameworks and your structure. We’ll show you the parts that matter to you.
Security
Compliance work touches contracts, incidents and personal data. This page sets out how Saga protects them: where your data lives, who can access it and how AI is used.
Last updated October 2026
In short
- Data in the EUStored and processed in Frankfurt, Germany.
- EncryptedIn transit with TLS and at rest on encrypted disks.
- No AI trainingYour data is never used to train models.
- Separate workspacesEach company has its own boundary and its own permissions.
- People decideSaga drafts, and a named person approves.
- Sign-in with MicrosoftComing soonEntra ID and user provisioning with SCIM.
Data and storage
Saga runs with an established cloud provider in a data centre in Frankfurt, Germany. All customer data is stored and processed there, and your data does not leave the EU. The database is backed up every night, and uploaded files are backed up separately.
Encryption
All traffic between you and Saga is encrypted with HTTPS and TLS. Stored data sits on disks that are encrypted at rest.
Access and permissions
Only the people you invite can access your workspace. Each company has its own bounded workspace with its own permissions, including when several companies belong to the same group or portfolio. Sign-in with your company’s Microsoft account (Entra ID) and automatic user provisioning with SCIM are on the way.
AI and your data
Saga uses AI to read, summarise and draft, and the AI runs entirely within the EU. Your data is never used to train models. Every answer cites its source, meaning the regulation, the policy or the evidence behind it, and every consequential decision is approved by a named person on your side. Saga does not turn missing records into a confident “compliant”.
Compliance and certification
Saga processes your personal data as a processor under the GDPR, and you get a data processing agreement. Saga is not certified under ISO 27001 or SOC 2 today. Work towards certification is under way.
Documents you can request
Before a purchase or a review we share what your security team needs.
Report a security issue
Have you found something that looks like a vulnerability or a security issue in Saga? Get in touch right away and we’ll come back to you as soon as we can.
Contact usWhat security teams ask us.
Where is our data hosted?
In a data centre in Frankfurt, Germany. Your data does not leave the EU.
Is our data used to train AI?
No. Customer data is never used to train AI models.
Who can see our workspace?
Only the people you invite. Each company’s workspace runs inside its own boundary and permissions, including within a fund portfolio.
Does Saga decide that we are compliant?
No. Saga organises the work, drafts and flags. Conclusions are approved by your people and can be traced to the record behind them.
Is Saga certified?
Not today. Saga is not certified under ISO 27001 or SOC 2, and work towards certification is under way.
Can we sign in with our company account?
Sign-in with Microsoft Entra ID and user provisioning with SCIM are on the way.
Can we get a DPA or run a security review?
Yes. Contact us and we’ll share our documentation and answer your questionnaire.
Talk to us about security.
We’ll walk your security team through hosting, access and how Saga uses AI.
Insights
What is on the way, and guides to the rules that take the most time.
This is on the way.
Dates when new rules start to apply, taken from the regulations catalogue and checked in October 2026.
20264
- Consumer Credit DirectiveThe new consumer credit rules start to apply, including for buy now, pay later.EU directiveSee in the catalogue
- Platform Work DirectiveTo be transposed by the member states.EU directiveSee in the catalogue
- Product Liability DirectiveTo be transposed. Liability for defective products then also covers software.EU directiveSee in the catalogue
- Deforestation RegulationStarts to apply to larger companies.EU regulationSee in the catalogue
20275
- Machinery RegulationReplaces the Machinery Directive.EU regulationSee in the catalogue
- European Health Data SpaceStarts to apply in stages.EU regulationSee in the catalogue
- EU Anti-Money Laundering RegulationStarts to apply directly in every member state.EU regulationSee in the catalogue
- AI ActThe requirements for stand-alone high-risk systems start to apply, after the EU postponed the date in 2026.EU regulationSee in the catalogue
- Cyber Resilience ActApplies in full to products with digital elements.EU regulationSee in the catalogue
Three guides to start with.
Short walk-throughs of what most often causes trouble, written for the people doing the work.
The Cybersecurity Act: who is covered and where do you start?
Sweden’s Cybersecurity Act has applied since 15 January 2026. It implements the EU’s NIS2 Directive and affects far more companies than the law it replaced. Here is what matters, in five minutes.
Who is covered?
The Act applies to organisations in 18 designated sectors, including energy, transport, health, drinking water, digital infrastructure, food and manufacturing. As a main rule you are covered if you have at least 50 employees or an annual turnover above EUR 10 million. Some organisations are covered regardless of size, and their suppliers feel the requirements too, through their contracts.
Essential or important?
Organisations are classed as essential or important, mainly by sector and size. The security requirements are broadly the same, but supervision is stricter for essential entities. Fines can reach 2 per cent of global turnover or EUR 10 million for essential entities, and 1.4 per cent or EUR 7 million for important ones.
What does the Act require?
You must register with the supervisory authority for your sector and run systematic, risk-based security work. It covers, among other things, risk analysis, incident handling, continuity and backups, supply chain security, training and access control. Management must approve the measures, follow them up and take training itself.
Incidents must be reported fast
A significant incident must be reported to the Swedish authority MCF (Myndigheten för civilt försvar) in three steps: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. The clock starts when you detect the incident, so it has to be decided in advance who assesses and who reports.
Where do you start?
Start by working out whether you are covered and in which category. Then register with the supervisory authority, run a gap analysis against the requirements and assign an owner to every measure. Make sure management gets its training early, and rehearse incident reporting before you need it.
This guide is an overview and does not replace legal advice.
Incident reporting: the deadlines side by side
When something goes wrong several clocks start at once, and they run for different lengths. Here are the most common deadlines side by side, so you know what applies before it happens.
| Regulations | What is reported | Deadlines |
|---|---|---|
| Cybersecurity Act (NIS2) | Significant incident, to MCF | 24 hours, 72 hours and one month |
| GDPR | Personal data breach, to the Swedish Authority for Privacy Protection (IMY) | 72 hours |
| DORA | Major ICT incident, to Finansinspektionen | 4 hours after classification and at most 24 hours after detection, then 72 hours and one month |
The Cybersecurity Act: three steps
A significant incident is reported to MCF. First an early warning within 24 hours, then an incident notification within 72 hours with an initial assessment, and last a final report within one month of the notification.
GDPR: 72 hours
A personal data breach must be notified to the Swedish Authority for Privacy Protection (IMY) within 72 hours of you becoming aware of it, unless it is unlikely to result in a risk to the people concerned. If the risk is high, they must also be told, without undue delay. Every breach must be documented, including those that are not notified.
DORA: four hours after classification
Financial entities must report major ICT incidents to Finansinspektionen. The initial notification is due within four hours of the incident being classified as major, and at most 24 hours after it was detected. An intermediate report follows within 72 hours and a final report within one month.
One event, several clocks
One and the same event can trigger several reports. A breach at an energy company where customer data leaks may require both an early warning under the Cybersecurity Act and a notification under the GDPR. So decide in advance who classifies the event, and keep a timestamped log from the first minute.
This guide is an overview and does not replace legal advice.
ISO 27001: the path from gap analysis to certificate
ISO 27001 is the international standard for information security management systems. A certificate shows customers and owners that your security is in order. This is what the path there looks like.
What the standard requires
The standard has two parts. One is the requirements on the management system itself, such as scope, risk assessment, objectives, internal audit and management review. The other is Annex A with 93 controls in four groups: organisational, people, physical and technological. You choose which controls are relevant and justify the choice.
Start with scope and a gap analysis
First decide what the certificate should cover: the whole company, a service or a business unit. Then run a gap analysis that compares where you are with the requirements and shows what is missing. That becomes your work plan.
Risks and the statement of applicability
Assess the risks to your information and decide how each one is to be treated. The result is summarised in a statement of applicability, which shows which Annex A controls you apply and why. It is the document the auditor reads first.
Evidence while the work gets done
Certification is not about having policies but about being able to show they are followed. Collect evidence as you go: logs, minutes, training records and completed checks. Before the audit you carry out an internal audit and a management review.
The audit and what follows
The certification audit has two stages. In stage 1 the auditor reviews the documentation, and in stage 2 that the management system works in practice. The certificate is valid for three years, with a surveillance audit every year.
This guide is an overview and does not replace legal advice.