Looking for GRC tooling? A tool without an expert is an expensive spreadsheet.
Most organisations buy software and still cannot demonstrate they are in control. We combine a GRC platform with regulatory experts who make it work for you.
Which rules apply to your organisation?
Software records. Experts decide. Supervisors look at the second.
Why a tool on its own is rarely enough
A GRC tool records what you do. It does not tell you what the supervisor expects, which controls are missing or what your board needs to know.
Tool only
Licence, set it up yourself- Central register
- No translation of legislation into controls
- Set-up and maintenance by your own team
- Empty platform after implementation
Adviser only
Hours, reports, spreadsheets- Regulatory knowledge
- Evidence scattered across folders and email
- Knowledge leaves with the adviser
- Hard to demonstrate to supervisors
Expert with platform
GRC Advies with GRC4U- Controls preconfigured per regime
- Quarterly cycle with a dedicated expert
- Evidence and reporting in one place
- Board reporting ready for supervisors
DORA: from ICT risk framework to demonstrable evidence
DORA has applied since 17 January 2025. For financial entities, DORA takes precedence over NIS2 on ICT risk management and incident reporting. Supervisors now focus on whether controls work in practice, not on policies on paper.
For fund managers we combine DORA with AIFMD, SFDR and the AI Act in a single control set.
NIS2: cyber security as a board responsibility
NIS2 applies across the EU through national laws. In the Netherlands that is the Cyberbeveiligingswet, in force since 15 August 2026. Organisations must determine for themselves whether they are in scope, and boards are personally accountable.
Registration is step one. After that you must show that your risk management measures work.
Do you need a tool, or an expert first?
Six questions give a first picture of your maturity. You see the result immediately, without entering any details.
Try it for 30 days, with an expert at your side
Choose the modules you want to test. You get your own environment with preloaded controls and a 45-minute session with one of our experts. No credit card and no automatic renewal.
Choose how much expertise you need
All packages run on the same GRC4U platform. The difference is how much we do for you.
Platform
Licence · do it yourself- GRC4U with a preloaded control set
- DORA, NIS2, ISO 27001 and more
- No expert guidance
NIS2 Start
1 year · fixed price- Baseline assessment of risk management and registration
- Controls set up in the platform
- Board session on cyber risk
- Two review points
Control Buddy
3 years · decreasing fee- Everything in NIS2 Start
- Dedicated expert and quarterly cycle
- New regulation tracked for you
- File ready for supervisors
From baseline to demonstrably in control in three years
A three-year programme with a fixed, decreasing fee. In year one we build, after that we keep it running at a lower price.
Baseline
We assess where you stand against the rules that apply to you.
Set-up
Controls, owners and evidence preconfigured in the GRC4U platform.
Quarterly cycle
A dedicated expert tests, reports and tracks new regulation for you.
Demonstrable
Board reporting and file ready for the supervisor or auditor.