In 2026, governance, risk & compliance is no longer a duty only for DAX-30 groups. It is daily work for every mid-market firm that falls under NIS-2, GDPR, or ISO 27001. SecTepe.Core is the GRC platform of the SecTepe suite. It is EU-native and can be self-hosted. It is built for the compliance needs of German-speaking markets.
What SecTepe.Core Does
SecTepe.Core brings these jobs into one platform:
- assessments across many frameworks
- ISMS management
- risk and action tracking
- lists of assets and suppliers
- audit prep
- a white-label trust center
You don't need three or four separate tools: one for assessments, one for assets, one for policies, one for audit reports. It all runs in one place you can audit, with one shared identity and one audit trail.
Which Frameworks the Platform Covers
- NIS-2 – pre-assessment, a catalog of measures, and prep for the 24-hour first notice.
- ISO/IEC 27001:2022 + 27002:2022 – with a 6-phase road map to certification, a wizard, and phase gates.
- BSI IT-Grundschutz – building blocks, requirements, and modeling, linked to the BSI threat catalog.
- GDPR / DSGVO – record of processing activities, TIA, data processing agreements, and a workflow for data subject rights.
- SOC 2 Type II, HIPAA, PCI DSS – useful for business abroad and for subsidiaries.
- DIN SPEC 27076 – a short IT security check made for SMBs.
- B3S for SHI (statutory health insurance) – the security standards for German SHI funds, with IVDB import.
How SecTepe.Core Differs From US SaaS Platforms
- EU data sovereignty: no Cloud Act access and no hyperscaler sub-processors. You can run it fully self-hosted or air-gapped if you like.
- German-language frameworks: BSI IT-Grundschutz and DIN SPEC are first-class citizens, not a translation plug-in.
- White-label trust center: your own compliance portal on your own domain. Self-hosted and built for the EU.
- Framework change management: the tool spots updates to a standard on its own (for example ISO 27002:2022 → 2025). It shows the impact and starts a new assessment.
- Cost: often well below typical Vanta/Drata licenses. The exact amount depends on the number of users and modules; we work it out with you.
Who Uses the Platform
There are three typical users:
- The mid-market CISO who builds or grows an ISMS, without a €200k license budget for US platforms.
- The external information security officer who serves many clients in one platform. Multi-tenancy keeps tenants apart, and white-label is included.
- The compliance officer in a group of companies who has to align NIS-2 and ISO 27001 work. Automatic mappings link the frameworks.
What's Coming in the Next Weeks
This overview starts a series. Posts with more detail will follow over the next weeks:
- Assessments across frameworks and how to map them
- ISO 27001 certification in 6 phases with a wizard
- Framework change management: spotting standard updates on its own
- AI for compliance: writing policies, a RAG audit helper, STRIDE
- Review cycles for policies, controls, and assets
- A white-label trust center on your own domain
- IVDB link for a B3S-compliant ISMS in SHI
Conclusion
SecTepe.Core fills a real gap in the market. It is a GRC platform as deep as Vanta/Drata. But it adds real EU data sovereignty and deep German-language frameworks. And you can run it self-hosted or as a managed service. If you have to pick an ISMS tool in 2026, give EU-native options at least the same weight as the big US players.