Closed beta

Keep one set of records. Answer to five frameworks.

Management systems drift apart quietly. The asset register says one thing, the risk assessment says another, and the impact assessment was written before either of them. Abacordo holds the facts once and lets ISO 27001, NIS2, GDPR, the Cyber Resilience Act and the AI Act each ask their own questions of them. Change a server, and the risk that names it, the control that treats it, the processing activity that runs on it and the product it ships in all know.

There is a real CMDB underneath, not a folder of documents about one, and your Microsoft directory can keep it honest.

Request access to the closed beta Or see what your own AI can do with it

Built in Belgium
Reads in English, Dutch and French
Works with your own AI assistant
Reads Microsoft Entra, Intune and Active Directory

The Abacordo dashboard for the demo organisation Meridiaan Energie NV, with a switcher for the ISMS, NIS2, GDPR, Cyber Resilience Act and AI Act workspaces and a list of what is due and overdue across all of them. — What is due and overdue, ranked by time remaining rather than by which framework it belongs to. Meridiaan Energie NV is our demo organisation: the company, its people and every record in it are invented.

Your AI, inside your management system

Ask your own assistant to do the paperwork

Every organisation on Abacordo gets its own address for the Model Context Protocol. Add it to Claude, ChatGPT or whichever assistant you already use, approve the connection once, and it can work in your management system directly. Not a chat window bolted onto the side of the product: the same records, the same permissions, the same audit trail.

So you can ask it things like:

Here is our server inventory. Load it into the CMDB with the hosting relationships.
Which of our information assets still have no owner?
Draft an access control policy from the controls we have already implemented, and link it to them.
Is this incident significant under NIS2, and what does it still owe?
Where are we on the NIS2 journey, and what is the next step?

It loads a whole register in one call, links included, and is told which row failed and why. It drafts a policy into the editor as headings, lists and tables, mentioning the records it cites. It files the evidence a record rests on. And each framework's journey is a prompt it can offer you by name, so the walk through NIS2 or the AI Act happens in the conversation you are already having.

It is your assistant, not ours. We hold none of your API keys and make no model choice on your behalf.

An exchange with an AI assistant on the left, asking it to draft an access control policy from the controls already in place, becoming a document record on the right that is marked as updated over MCP and recorded in the activity log.

It documents; it does not decide. The assistant works under the connecting member's own role, cannot reach a framework your organisation has switched off, and every write it makes lands in the activity log under that member's name. It can attach a file to a record but never read one back out. Disconnecting it takes one click.

Five frameworks, one record set

The same facts, asked about five different ways

A server, a supplier, an incident, a product you place on the market, an AI system you deploy. ISO 27001, NIS2, GDPR, the Cyber Resilience Act and the AI Act all want to know about them, and each wants to know something slightly different. Abacordo records the fact once and lets all five ask, so keeping one framework current is most of the work of keeping the next one current too.

ISO/IEC 27001 The management system: Clauses 4 to 10 as a working system rather than a binder: context and scope, a risk method that is yours, the Statement of Applicability against the 93 Annex A controls, policies with a versioned lifecycle, objectives, competence and awareness with the evidence behind them, internal audits, management review and corrective action. Kept current as you work, and exported as an audit package when the auditor asks.
NIS2, in Belgium Law of 26 April 2024, CCB conformity scheme: An entity profile that reads articles 3, 9 and 10 for you, your registration with the Centre for Cybersecurity Belgium, the significance test and the notification clocks, article 30's measure domains and article 31's duties on the management body. The CyberFundamentals catalogue at your assurance level, scored on both maturity scales, evidenced from the records you already keep and frozen into a dated self-assessment when you are ready to claim it. A documentation set for your level, drafted from what you have recorded, in Dutch, French or English. The evidence package a conformity assessment body reads.
GDPR Regulation (EU) 2016/679, Belgian law of 30 July 2018: Both registers article 30 asks for, the retention schedule, the article 28 terms answered one by one on each processor, transfers with their chapter V ground, impact assessments with the screening behind each, a log of data subject requests with the article 12(3) clock running from receipt, and the breach assessment on the same incident record your NIS2 clocks run on. The article 5 principles and article 32 security are read from what you already hold rather than asserted.
Cyber Resilience Act Regulation (EU) 2024/2847: The products with digital elements you make, import or distribute, their components and releases from an imported SBOM, the vulnerabilities found in them with the article 14 actively-exploited test and the clocks it starts, a severity test on incidents, the Annex I coverage, the conformity route, and the Annex VII technical documentation and EU declaration of conformity as exports. The article 14 reporting duty, binding from 11 September 2026, was built first: it is the first duty that binds a manufacturer.
AI Act Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744 (the Digital Omnibus on AI): The AI systems you provide, deploy, import or distribute, each with its article 5 screening against the prohibited practices and its classification against Annexes I and III. The duties that already bind every provider and deployer, the article 5 prohibitions, AI literacy and transparency, are checked today, and the article 73 serious-incident clock runs on the same incident record as the other three regimes. For a high-risk system, the requirement statements, the fundamental rights impact assessment on the DPIA's own shape and the conformity route are ready ahead of the date Chapter III reaches it, from 2 December 2027 for Annex III systems.

A new organisation starts with ISO 27001 alone. NIS2, GDPR, the CRA and the AI Act are switched on when they apply to you, or when a client asks for them, each one whole and never in part. Switch one off and its screens, its checks and its dates leave every workspace; its records wait for it to come back.

Where a CyberFundamentals self-assessment run stands: 120 of 133 requirements scored, documentation maturity 3.5, implementation maturity 3.3, total maturity 3.4 against a target of 3.0, a verdict of not yet met, one measure excluded from the scope of the three the level allows, and five risk-based deviations. — A CyberFundamentals self-assessment run at the organisation's own assurance level: the roll-up against the CCB's thresholds, with the exclusions and the risk-based deviations counted apart, and no verdict until every requirement is scored.

The AI system register: four systems, each with its operator role, its kind, its status, its provider and its owner, and beside them the standing of the AI literacy, transparency and human oversight duties, with literacy evidence missing on all four, transparency open on all four and oversight assigned on one. — The AI system register: the role you hold in each system, and where the literacy, transparency and oversight duties stand on it.

A guided route through each framework

Every framework is a journey with a next step

Each framework has a journey: the stages from "does this bind us" to "the evidence is in", built on the regulator's own guidance where there is one. The NIS2 journey is built on the CCB's "NIS2 in 7 steps"; the GDPR journey carries the Belgian data protection authority's 13 steps. Each stage says what the law or the standard asks, what to do in the company and how to record it here, and reads where you stand from your records, so the journey is never a checklist somebody ticked in a meeting.

ISO/IEC 27001 in 11 stages, from the decision to run a management system to the certificate
NIS2 in 11, from the scope test to the evidence a conformity assessment body reads
GDPR in 12, from "who are we under the Regulation" to demonstrating it
Cyber Resilience Act in 11, from whether the Regulation binds you to keeping the product in conformity
AI Act in 12, from the role you hold to the serious-incident duty

The NIS2 journey: the organisation's track, a stepper of 11 numbered stages with seven done, and stage 6, drawing the boundary, open on its first checks: one to do, checking the estate against the directory, with a numbered step that links to the screen that does it, and one done, assets and processes marked as in scope. The stage continues below. — The NIS2 journey on the organisation's own stage: what to do, which checks are done, and a door to the screen for each step.

The estate: the CMDB, the link graph and your directory

Everything links to everything, and the directory keeps it honest

A server links to the application it hosts. The application links to the risk it carries. The risk links to the control that treats it, and the control to the policy that requires it. Follow that chain from any record, in either direction, without cross-referencing a thing by hand.

The same links draw the topology graph and the data-flow diagrams, so a picture of your estate is never a picture of what your estate looked like the last time somebody redrew it.

The dependency graph of the demo estate: configuration items in teal, information assets in indigo, business processes in dark blue, access groups in orange and data flows in grey, joined by their links, with the network segments drawn as boxes around the items in them: an office VLAN, the corporate servers, an Azure production network, a public DMZ and the grid control network. — The dependency graph, drawn from the links the records already carry: the items, the assets and processes that run on them, and the segments as zones.

Read from Microsoft Entra, Intune and Active Directory

A CMDB typed in by hand goes stale the week it is finished. Connect Microsoft Entra and Intune live or by a snapshot file, and an on-premises Active Directory domain by a snapshot file your own script exports, and Abacordo reads what the estate actually holds. It is one-way: Abacordo holds read permissions only and never writes to your directory.

What the directory and your registers disagree about lands in one queue, answered in place: record it, match it to what you already have, take the directory's value, keep yours with a reason, or retire it. Managed devices are linked to the people who hold them. A group that reaches a system is listed on that system, with the purpose and approval you record against it. When somebody's account goes, their record offers the leaver's checklist. And a fact the whole estate answers in full, every managed laptop reporting an encrypted disk for instance, counts on the control that asks for it without a link drawn by hand.

The Directory screen: two connections, an Active Directory domain and a Microsoft Entra directory, each fed by file with its last run, a line counting the active items the directory should know and does not, and a queue of 19 open differences filtered by kind, connection, record and status, its first group folded. — The Directory screen: the connections and their last run, then the queue of what the domain, Entra and Intune report against what the register says, filtered by kind.

Incidents and notification

One incident, four regimes, one record

A single break-in can be a significant incident under NIS2, a personal data breach under the GDPR, a severe incident affecting a product under the Cyber Resilience Act and a serious incident involving an AI system under the AI Act, all at the same moment. Each regime has its own moment of awareness, its own authority and its own clocks. Abacordo runs them all from the one record and says what the incident owes under each, and what it needs from you next.

NIS2 asks for an early warning within 24 hours of your becoming aware, an incident notification within 72 hours (24 for a trust service provider), and a final report no later than a month after that notification, or a month after the incident is handled if it is still running then. The GDPR gives 72 hours from awareness to notify the supervisory authority. The CRA runs the same 24 hours and 72 hours for a severe incident affecting a product, with a final report a month after the notification. The AI Act's article 73 gives the provider of a high-risk AI system 15 days from awareness, shortened to 10 where a person has died and to two for a widespread infringement or a serious and irreversible disruption of critical infrastructure.

Every one of those is a latest date, not a target. NIS2, the GDPR and the CRA ask for notification without undue delay, and the AI Act for a report immediately once the provider has established a causal link, so the window is not a period to wait out. A GDPR notification that misses the 72 hours is still owed, with the reasons for the delay.

A panel headed "What this incident owes", listing NIS2 (Belgium), GDPR, the Cyber Resilience Act and the AI Act. NIS2 applies and is assessed, with a progress report due in 27 days and a button to record it; the other three are not considered and not yet assessed, with no clock running and a button to run each one's test. — What an incident owes under each regime, and the next thing it needs from you. Here NIS2 applies; the other three are still to be assessed rather than assumed.

Abacordo does not file anything on your behalf. You notify through the channel each regime names and record here what you sent and when, which is what makes it provable a year later.

The NIS2 stages on an incident: the early warning and the incident notification submitted, with when; an intermediate report on request; a progress report and a final report both due in 27 days, each with a button to record it; and the notification of service recipients, recorded as not applying. — Each stage with what the law asks of it, when it falls due and what has already been sent.

Risk

Your risk method, not ours

Qualitative, semi-quantitative or quantitative, your own scales, your own matrix bands. A new organisation starts on scales modelled on the ISO/IEC 27005 examples and a three-colour matrix so there is something to work with on day one, and changes any of it afterwards. Nothing in the engine is fixed, so you are not re-teaching your organisation somebody else's method.

The same register holds the risks a data protection impact assessment weighs, scored on a data-subject scale of their own, and the cybersecurity risks of a product you place on the market, so a risk is written once and read by the framework that asks about it.

The risk register for Meridiaan Energie NV in the ISMS workspace, filtered by owner, verdict and level, listing risk scenarios with their inherent level, the residual level where one is recorded, the role that owns each one, and the verdict, treat or accept. — The risk register, scored on this organisation's own scale, with each scenario owned by a role rather than by nobody in particular.

Evidence, files and the audit trail

Nobody has to take your word for it

Changes to your records are attributed: who made each one, and when. An auditor reads the history rather than a summary of it, and when they ask for the whole management system, it exports as one package rather than as an afternoon of copying things into a folder.

A record carries the files it rests on: the CCB's confirmation on the entity profile, the signed processing agreement on a supplier, the certificate on a training record, the forensic report on an incident. They are streamed behind the record's own permissions and never sit at a public address.

The export is one combined PDF, a ZIP of separate documents with an index, a spreadsheet of the registers or a Word document: the Statement of Applicability, the risk assessment report and treatment plan, the operational registers, the NIS2 evidence package a conformity assessment body reads, and the technical documentation and declaration of conformity of the CRA and of the AI Act. The register documents name what the clause asks for and your records do not yet say, so you see the gaps before an auditor does.

Choosing what goes into the export: every document you have a template for is ticked by default, and the registers can come out as a spreadsheet instead.

Closed beta

Request access to the closed beta

There is no self-service sign-up yet. We are taking on a small number of organisations at a time, so that each one is set up properly, frameworks chosen and directory connected, rather than left to work it out. Tell us who you are and we will come back to you.