Governance, risk & compliance in 2026 is no longer the duty program of DAX-30 corporations alone, but day-to-day operations for every mid-market organization with a NIS-2, GDPR, or ISO 27001 footprint. SecTepe.Core is the GRC platform of the SecTepe suite – EU-native, self-hosting capable, and tailored specifically to the German-speaking compliance context.
What SecTepe.Core Is About
SecTepe.Core bundles multi-framework assessments, ISMS management, risk and action tracking, asset and supplier inventory, audit preparation, and a white-label trust center into a single platform. Instead of running three or four separate tools (one for assessments, one for asset management, one for policies, one for audit reports), everything runs in a single auditable environment with shared identity and audit trail.
Which Frameworks the Platform Covers
- NIS-2 – pre-assessment, action catalog, reporting preparation for the 24-hour initial notification.
- ISO/IEC 27001:2022 + 27002:2022 – including a 6-phase certification roadmap with wizard and phase gating.
- BSI IT-Grundschutz – building blocks, requirements, modelling; connection to the BSI threat catalog.
- GDPR / DSGVO – record of processing activities, TIA, data processing agreements, data subject rights workflow.
- SOC 2 Type II, HIPAA, PCI DSS – relevant for international business and subsidiaries.
- DIN SPEC 27076 – compact IT security check specifically for SMBs.
- B3S for SHI (statutory health insurance) – industry-specific security standards of German SHI, with IVDB import.
What Differentiates SecTepe.Core From US SaaS Platforms
- EU data sovereignty: no Cloud Act access, no hyperscaler sub-processors, optionally fully self-hosted or air-gapped.
- German-language frameworks: BSI IT-Grundschutz and DIN SPEC are first-class citizens, not a translation plug-in.
- White-label trust center: a dedicated compliance portal under your own domain – the first self-hosted concept in the EU.
- Framework change management: automatic detection of standard updates (e.g. ISO 27002:2022 → 2025), impact analysis, reassessment workflow.
- Cost: 40–60 % below typical Vanta/Drata licenses (€2k–40k/year vs. €12k–50k/year).
Who Uses the Platform
Three typical target personas:
- The mid-market CISO building or evolving an ISMS – without a €200k license budget for US platforms.
- The external information security officer who serves multiple tenants in one platform – multi-tenant including tenant separation and white-label.
- The compliance officer in a corporate group who has to coordinate NIS-2 and ISO 27001 topics – including automatic mappings between frameworks.
What's Coming in the Next Weeks
This overview kicks off a series. Detail posts coming over the next weeks:
- Multi-framework assessments and cross-framework mapping
- ISO 27001 certification in 6 phases with wizard
- Framework change management – standard updates automated
- AI-supported compliance: policy generation, RAG audit assistant, STRIDE
- Review cycle management for policies, controls, and assets
- White-label trust center under your own domain
- IVDB integration for B3S-compliant ISMS in SHI
Conclusion
SecTepe.Core answers a concrete market gap: a GRC platform with the depth of Vanta/Drata, but with real EU data sovereignty, German-language framework depth, and the option to run it self-hosted or as a managed service. Anyone facing an ISMS tool decision in 2026 should evaluate EU-native alternatives at least on equal footing with the US incumbents.