Multi-Framework Assessments &automated roadmaps
One assessment covers all the frameworks that apply to you, at once. Gap analyses, maturity scores and a roadmap built for you make even complex compliance clear.
What you get
- NIS2, GDPR & ISO 27001:2022
- BSI IT-Grundschutz & SOC 2
- HIPAA, PCI DSS, DORA
- Controls mapped across frameworks
- Roadmap built for you
- CSV / PDF export
Features at a glance
All you need to assess many frameworks at once with less work. In one platform.
Gap Analysis Engine
The tool compares where you stand with the target controls of each framework. You get a detailed report of each gap.
CMMI Maturity Model
Maturity scores from 1 to 5. They are clear, easy to compare and a solid base for long-term plans.
Roadmap Generator
Gaps turn into a roadmap by themselves. It sets priorities and shows effort estimates and milestones.
Framework Mapping
One piece of evidence, many frameworks. Controls are mapped for you to NIS2, ISO, SOC 2 and more.
Evidence Collection
One central store for all evidence. Each item links to its controls and keeps its versions. You get a reminder before it expires.
Audit-ready Reports
PDF and CSV exports that auditors accept. They come with logos, timestamps and signatures.
Your benefits
You don't run a separate assessment for each framework. You run one that covers all the standards that apply, at once. That saves time and work and gives you results that match up.
- One answer counts for several standards
- The same scoring across all frameworks
- A history of each assessment that shows any tampering
- A roadmap with priorities and effort estimates built in
- Ready-made templates for each major standard
Use cases
Initial NIS2 assessment
Operators of critical infrastructure take a first look at where they stand. They find the controls they must have.
ISO 27001 certification prep
Run a gap analysis against ISO 27001:2022. You also get a plan for the work ahead, with the Statement of Applicability.
Parallel compliance with several standards
SaaS providers cover SOC 2, ISO 27001 and GDPR in one shared process.
Annual reassessment
Check each control again every year. See what changed since last year, and get the report built for you.
How Multi-Framework Assessments work in practice
You pick the frameworks that apply to you. SecTepe.Core builds one questionnaire from them. Many requirements appear in several standards. Core groups these overlaps through a shared mapping. So such a question appears only once. It still counts for each framework it belongs to.
How answers turn into scores
Each question has a weight and a priority. You answer with fulfilled, partly fulfilled or not fulfilled.
- A fulfilled answer counts the full weight. A partly fulfilled one counts half.
- Core calculates a score for each framework and an average across all.
- Core counts open gaps by priority: critical, high, medium and low.
- The maturity model has five levels, from Initial to Optimizing. A fulfilled answer maps to level 4, a partly fulfilled one to level 2.
From gaps to a plan
A requirement can come with recommended measures. Each measure can have a priority and the days needed to put it in place. Core merges these measures into one plan. Once a measure becomes a task, it gets an owner, a status and a due date.
For several standards, Core also builds a certification roadmap. These include ISO 27001, NIS2, BSI IT-Grundschutz, DORA, SOC 2, PCI DSS and HIPAA.
Evidence and reports
Auditors upload documents right at the requirement they support. The file becomes a regular document in the document manager. If you start an audit from the assessment, Core links the file to that audit too.
You export the gap report as a PDF. It shows how many controls are fully, partly or not implemented. It also lists the compliance score, the average maturity level and the gaps by risk.
Common questions
Can I use my own questionnaire? Yes. Upload it as PDF, Excel, Word, CSV or text, or paste the questions. Core extracts them as drafts. You keep or drop each question before it becomes a template.
What does the AI do? It can write a summary of the results. The rating itself stays the calculated score. The AI runs at IONOS in German data centers, on SecTepe GPU servers or on your own GPU server.
Where does my data live? You can host Core yourself, in containers on your own servers or on Kubernetes. Each assessment belongs to exactly one tenant.
Ready for multi-framework assessments?
Book a personal demo. See how SecTepe.Core brings your compliance work together and speeds it up.
How we work with you
We want to work with you for the long run, not just deliver once. Our way of working has four steps. So you always know what comes next, who does what and what you get.
1. Free initial conversation
We learn where you stand and what you want. In 30 to 45 minutes we check if we are a good fit. We show you options and answer your questions. There is no obligation.
2. Current state review
We check where you stand today: tech, processes and rules. You get a list of strengths and gaps, sorted by urgency. Our offer is based on it.
3. Delivery with a dedicated lead
An experienced lead guides you through the project. You get clear goals, an open plan for time and cost, and a status every week. All results are written down and belong to you.
4. Running and reviewing
After the project we stay with you. We run systems for you, check them at set times and keep track of open tasks. When new threats or new rules come up, we get in touch.
Common questions
We hear these questions most often in a first call. For anything else, write to hello@sectepe.de or give us a call.
- How do we start working with SecTepe?
- Every project starts with a free first call. Then you get an offer with scope, timeline and result. If you like, we start small with a pilot. That way you get to know us before the real work starts.
- What company sizes and sectors do you support?
- We work for small and mid-sized firms, for parts of large groups and for operators of critical infrastructure (KRITIS). Often that means industry, trades, health, banks, energy and public bodies. Our focus is mid-sized firms in Germany, Austria and Switzerland.
- Do you work on site, remotely or hybrid?
- Both. Reviews, advice and most services run remotely from German data centers. For workshops, training and emergencies we come to you, mainly in North Rhine-Westphalia, the Rhineland and the Ruhr area. We travel further when needed.
- Which standards and regulations do you cover?
- We work to ISO 27001:2022, BSI IT-Grundschutz, TISAX, B3S KRITIS, NIS2 and DORA, plus sector-specific rules. Our methods build on known frameworks such as NIST CSF, MITRE ATT&CK, OWASP and OSSTMM. We combine them to fit each project.
- How do you protect the confidentiality of my data?
- By contract and by technology. Before every project, both sides sign a non-disclosure agreement. Your data stays in German data centers. Every access needs a second login factor and is checked one by one. Our whole team is bound to secrecy by contract and under the GDPR.