Framework Change Managementautomated
When a framework changes, SecTepe.Core marks the controls it hits. Then it guides you through the reassessment.
What you get
- Spots new updates
- Shows the impact
- Reassessment workflow
- Control-mapping delta
- Notifications
- Audit trail
Features at a glance
Stay compliant when frameworks change. The tool reports updates, checks the impact and guides the reassessment.
Update Detection
Core reads public sources such as ENISA, EUR-Lex and the BSI. It filters out news and reports it. Your team then records the change.
Impact Analysis
For each change, Core shows which controls, evidence and policies it hits.
Guided Reassessments
A workflow guides you step by step. Each reassessment lists the affected controls, an owner and a due date. You only check what changed.
Control Delta Report
See at a glance which controls the new framework version adds, changes or drops.
Notifications
When a new version comes out, Core tells you by email and in the app.
Change History
Each framework change and each reassessment from it appear in order. Auditors can use this history as is.
Your benefits
Frameworks change often. Think of ISO 27001:2022, NIS2 or DORA. SecTepe.Core reports the changes and works out the impact. Then it guides you through the reassessment. So your status stays up to date.
- You no longer track framework versions by hand
- You only check the controls that are affected
- You are less likely to miss a change
- Auditors see a clear, documented history
- New versions mean much less work
Use cases
ISO 27001:2013 to 2022 migration
Core shows what changed. Then it guides you step by step through the new controls.
New NIS2 requirements
Track new implementing acts and how each country turns NIS2 into law. So your controls stay up to date.
New BSI IT-Grundschutz editions
A new edition comes out each year. You start the reviews you need, and Core records each change.
Customer contract changes
Large customers often set tighter rules in data processing agreements or SLAs. Then you adapt your controls.
How Framework Change Management works in practice
SecTepe.Core stores each framework change as an update. It holds the new version, the date, the type of change, a severity and a link to the source. Below it sit the changes to single controls.
- A control can be new, changed, removed or renumbered. Its requirement can also change.
- Each change has an impact level and a recommended action.
- If known, it also states the effort in hours.
How Core works out the impact
Core compares each change with your own answers from the assessment of that framework. The result depends on your current status.
- You have not assessed the control yet: Core suggests you do that first.
- A control you fulfill was changed: you are directly affected. Core asks you to check that your setup still meets the new requirement.
- A control you do not fulfill yet was changed: you are indirectly affected. Core suggests you update your setup.
- A control was removed: Core asks you to note this and review your measures.
Core saves each result for your tenant. You confirm it once you have looked at it. On request, the AI estimates effort and risk for each change. The AI runs at IONOS in German data centers, on SecTepe GPU servers or on your own GPU server.
Reassessments with owners and due dates
An admin turns an update into a reassessment request. The request lists the affected controls, a priority and a due date. Once you name a person, it counts as assigned. Then it moves to in progress and done. Core records when work started and ended. The request can link to the assessment that closes it.
Core sends news about updates by email and logs each message. You also see them in the app and can mark them as read.
Common questions
Where do updates come from? Core reads public news feeds, for example from ENISA, EUR-Lex and the BSI. It filters them by keywords such as NIS2 or KRITIS. An admin then records the update and the changed controls.
Who can create updates? Only admins. They create updates, record control changes and start reassessments. Other users see the impact for their own tenant.
Can I run Core on my own servers? Yes. It runs in containers on your own servers or on Kubernetes. It also runs in networks with no internet access.
Ready for automated framework change management?
Book a personal demo. We show you how SecTepe.Core keeps your compliance in line with each framework update.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.