What's new.

Your organisation can now record which of NIS2, the GDPR, the AI Act and the Cyber Resilience Act apply to it, with the people designated for each. Every incident opens a track per applicable regime, where the designated person confirms, with the legal basis beside it, whether the regime applies, and each submission is prepared in the structure of the authority's own form, with reminders before every deadline: NIS2 (article 23) through Decreto-Lei n.º 125/2025, the GDPR (articles 33 and 34), the AI Act (article 73) and the Cyber Resilience Act (Regulation (EU) 2024/2847, article 14). The reporting deadlines of DORA and of the Swift Customer Security Programme are tracked as well. Performance against the organisation's targets is measured, and a personal data breach is recorded once for incidents and privacy alike. Aligned with ISO/IEC 27001 A.5.5 (Contact with authorities), A.5.26 and A.5.31.

Every change now has an independent security reviewer and follows the path that fits it: a decision by the change advisory board, a pre-approved standard change, a low-risk change decided by its owner, or an expedited emergency path ratified afterwards. A structured post-implementation review closes the loop with owned corrective actions, risks and opportunities can be recorded straight from a change, and the formal approval and acceptance of a customer are kept with their evidence. Aligned with ISO/IEC 27001 A.8.32 (Change management).

A central register now shows who has access to which system, at which level, from granting to revocation, for applications as well as buildings and rooms. Accesses are requested and approved in the platform, joiners, movers and leavers drive what is granted and removed, and certification campaigns ask the right reviewers to confirm what is still needed, closing with an evidence pack ready for audit. Account lists exported from each system can be imported to reconcile the register. Supports the access control measures of NIS2 (article 21(2)(i)). Aligned with ISO/IEC 27001 A.5.15, A.5.16, A.5.18, A.7.2 and A.8.2.

Every policy and procedure now keeps all its versions. A new version goes through review and approval before it replaces the one in force, reviewers and approvers see exactly what changed, any two versions can be compared, and a document that no longer applies is retired with its text kept on record. Aligned with ISO/IEC 27001 clause 7.5 (Documented information) and A.5.37 (Documented operating procedures).

Anyone in your organisation can now report a security event, and the response team turns it into an incident when it matters. Each incident keeps its life cycle, response actions, evidence with chain of custody and the deadlines to notify the authorities. A library of response guides, one per kind of incident, turns the matching steps into actions to assign and track. Supports the incident reporting duties of NIS2 (article 23) and Decreto-Lei n.º 125/2025. Aligned with ISO/IEC 27001 A.5.24 to A.5.28 and A.6.8 (Information security event reporting).

Your organisation can now plan each audit with its scope, lead auditor and dates, and trace every finding to the audit that raised it. Findings are followed over time with dated notes while the original deadline is always kept, and can be promoted to the risk or opportunity register when they need treatment. Aligned with ISO/IEC 27001 clause 9.2 (Internal audit) and A.5.35 (Independent review of information security).

Your organisation can now tell the platform which standards it follows, and menus and requirements adjust to show only what is relevant. Quality management under ISO 9001 joins ISO/IEC 27001, the NIS2 Directive (EU) 2022/2555 and its Portuguese transposition, Decreto-Lei n.º 125/2025, so the context, objectives, internal audits and improvement actions are reused across both certifications instead of being kept twice.

The documents your ISMS controls are now gathered in one register, each with its version, approver, approval date and next review. Documents kept outside the platform can be added by hand, and the full register can be exported as a PDF for auditors. Aligned with ISO/IEC 27001 clause 7.5 (Documented information).

New Privacy & GDPR module — a single area for everything GDPR your organisation has to manage: Impact Assessments, Records of Processing, personal data breaches and data-subject requests. Each artefact gets a structured review covering scope, lawful basis, data categories and safeguards, signed off by the people accountable for it. Designed to demonstrate, at audit time, that the full scope of GDPR obligations is being managed in one place, with an immutable trail for the supervisory authority. Aligned with ISO/IEC 27001 A.5.34 (Privacy and protection of PII), A.5.24 and A.5.26 (Information security incident management).

Enhanced the existing Project Management module to support information security throughout the project lifecycle, ensuring that security requirements are identified, assessed, approved and monitored from project initiation to delivery. The enhancement introduces structured security governance within projects, helping organisations demonstrate that information security is consistently integrated into project activities and decision-making processes. Designed to support compliance with ISO/IEC 27001 control A.5.8 (Information security in project management), while also supporting secure application and development practices where applicable.

New Development Reviews module — a dedicated place to record the security review of every in-house development task. Each task gets a structured review covering secure coding, access and authorisation, logging and traceability, and testing, signed off by the people accountable for it. Designed to demonstrate, at audit time, that the security posture of every change to the team's code has been assessed, approved, and kept on file. Aligned with ISO/IEC 27001 A.8.26 (Application security requirements) and A.8.28 (Secure coding).

New Application Reviews module — a dedicated place to record the security review of every application your organisation acquires or operates. Each application gets a structured review covering security requirements, access and data, secure coding and operation, signed off by the people accountable for it. Designed to demonstrate, at audit time, that the security posture of every application in your scope has been assessed, approved, and kept on file. Aligned with ISO/IEC 27001 A.8.26 (Application security requirements) and A.8.28 (Secure coding).

Your organisation can now adopt COBIT processes within its ISMS. A new Governance area presents every process end-to-end and exports each one as a PDF for an audit pack.

A dedicated Procedures module is now available alongside Policies, sharing the same structured authoring experience but carrying its own lifecycle — drafting, approval, acknowledgement and reminders — so operating procedures live as first-class documents rather than annexes of policies. Aligned with ISO/IEC 27001 A.5.37 (Documented operating procedures).

A dedicated lifecycle module for privileged accounts — request, multi-step approval, periodic review and automatic revocation when access overstays its approved period. Aligned with ISO/IEC 27001 A.5.18 (Access rights) and A.8.2 (Privileged access rights).

Each Risk Assessment and Statement of Applicability release is now captured as an immutable snapshot, encrypted at rest and recorded with cryptographic integrity verification. Supports controls A.5.31 and A.8.34 of ISO/IEC 27001 by providing tamper-evident evidence of the organisation's position at any point in time.

Business Impact Analysis aligned with ISO 22301 — configurable catalogues for processes, dependencies and impact criteria; per-asset assessments capturing RTO and RPO; drill-down reports; and a built-in user manual.

Multi-factor authentication using Time-based One-Time Passwords (TOTP) through mobile authenticator apps. Aligned with ISO/IEC 27001 A.8.5 (Secure authentication).

Right-to-erasure (GDPR Art. 17 / Lei 58/2019) requests are now managed end-to-end — registration, traceability and resolution — through anonymisation of personal data and permanent account deactivation, while preserving the audit history required for accountability.