Starting point
Any security consultancy with several engagements knows the pattern. One client needs the NIS2 risk-management measures, a second is preparing for ISO 27001 certification, a third for the IT-Grundschutz check. The questions behind them overlap to a large extent – access rights, multi-factor sign-in, backups, incident handling – yet they are asked again in a separate spreadsheet for every framework.
The real work lies in between: sending questions to the right people at the client, requesting and chasing evidence by email, reconciling versions, compiling the state of play for management and the auditor. Little of that is consulting and much of it is coordination. AI could take on part of the writing and checking, but it is ruled out as long as nobody can say where the client's data goes.
We heard this again and again in conversations with consultancies. So we built a platform for it as our own development – with the requirements a consultancy has of a tool for its clients:
- One workspace per client, shared by the consultancy and the client – in the consultancy's brand
- One answer counts for every framework it applies to
- Evidence with a due date, an owner and a sign-off instead of email attachments
- AI only with the client's consent, clearly labelled and never without a human decision
- Complete traceability and a defined end of contract
Solution
The platform has three levels: the consultancy, its clients and, for each client, a workspace of its own, strictly separated from the others. The consultancy sets its name, logo, colours, email sender, its own domain and sign-in through Microsoft Entra ID; the sign-in page, emails, reports and supplier questionnaire all appear in its brand. The consultancy's overview orders every client by what needs attention: progress, overdue tasks, open reviews and the next audit.
At its core is a control library of 49 controls in 13 areas. The client answers each control once; through stored mappings it counts for the NIS2 risk-management measures, for ISO/IEC 27001 Annex A with the statement of applicability, and for BSI Grundschutz++. In the ISO step, A.5.15 then notes that the requirement is covered by the "Access rules" control, and the implementation question becomes optional there. Coverage only counts once the consultancy has signed off the area. The consultancy can extend the mappings itself, with suggestions from the AI if it wishes.
Fifteen bilingual methods cover the frameworks: NIS2 from the scope check through the measures to reporting readiness, ISO/IEC 27001 with the management system and Annex A, BSI Grundschutz++, DORA, the GDPR with records of processing, data protection impact assessments and data subject requests, the AI Act, the Cyber Resilience Act, ISO 22301 and a supplier security questionnaire. A consultancy tailors each method once as its own template and then starts it for any client; it can add methods of its own.
The consultancy assigns steps and individual questions to people at the client, each with a due date. Evidence is requested specifically, uploaded, versioned and accepted or sent back by the consultancy; every step is signed off under the four-eyes principle. Everyone sees under "My tasks" what is expected of them, comments with mentions replace the email thread, and notifications arrive at once or as a daily digest. Reports such as the NIS2 measures report or the statement of applicability are produced as PDFs from the current data.
AI assistance stays off until the client's administrator has agreed and the consultancy has switched it on. It then drafts a measure's note from the answers, checks an uploaded piece of evidence against the requirement and suggests mappings. Every output is labelled as an AI draft or AI hint, names the model and who asked for it, and only counts once a person accepts it; personal data is not sent or is replaced by placeholders. The language model comes from a European provider and is used through its EU interface, within a monthly budget per consultancy.
Every change, every sign-off and every document download is written to an audit log that cannot be altered afterwards. Roles for the consultancy and the client, down to read-only access for auditors, limit who sees what. Clients show their status on a trust page of their own, and suppliers answer their questionnaire without an account. Microsoft Entra ID delivers evidence such as MFA registration and Conditional Access by itself every day, and other systems through an evidence interface. At the end of the contract the consultancy exports all data and deletes it, with 30 days to undo.
- One workspace per client with the consultancy's name, logo, colours and domain, and sign-in through Microsoft Entra ID
- A control library of 49 controls, counted for NIS2, ISO/IEC 27001 Annex A and BSI Grundschutz++
- 15 bilingual methods, tailored by the consultancy as its own templates
- Assignments with due dates, evidence requests and sign-off under the four-eyes principle
- AI drafts and AI checks of evidence, only with the client's consent and always with a human decision
- A tamper-proof audit log, a trust page, a supplier questionnaire without an account and a defined end of contract
A look inside the product
Screenshots of the platform with entirely fictitious sample data: the consultancy, clients and people are made up.
Results
The platform shows how far a tool for consultancies can go when it is built from the consultancy's own work. The logic of the frameworks lives in methods and mappings that can be adapted without development. Working with the client is the actual process, not an add-on. And AI prepares writing and checking while the decision stays with people.
For your consultancy this means: we build a tool of this depth for your methodology too – under your brand, for your clients, with the complete source code owned by you. Whether that is shared work on frameworks, a self-assessment as the entry point or a single workflow, we work out in a first conversation.
- Ownership, due date and sign-off for every question and every piece of evidence in one place
- No asking twice: one answer from the client counts for every framework it fits
- AI a client can approve: switchable, labelled, processed in the EU
- Evidence for auditors and authorities from current data, traceable down to the single change