Skip to the page
Eurus
Try it live
Menu

N · Compliance

Every record checked against the rules you keep.

Every enquiry, payment, invoice, email and change of access is checked against the controls your organisation keeps, at the moment it happens. Each result is kept with a fingerprint of what was checked. The evidence is there before an auditor asks for it.

Try it live Book an audit

Compliance, kept on every record

What is checked

72 checks run on the events from an organisation's own systems. Each one follows a clause of the law or of ISO/IEC 27001, and says in plain words what it found.

All 72 checks

  • Medium

    Enquiry forms collect only what is needed

    The rule

    A website enquiry carries only name, email, phone, company, message, service and the consent tick; nothing sensitive is asked for.

    When it fails

    1. Remove the extra field from the form
    2. Delete the extra data already collected
    3. Record the change

    Closing it needs a named approver.

    The clauses it serves

Try a check

An enquiry form to try, checked by the same code that checks every enquiry the software reads. What you type stays on this page.

A website enquiry form

To try

To see a check fail, ask for a date of birth, or type the test card number 4242 4242 4242 4242 into the message.

The checks waiting for it

  • Enquiry forms collect only what is needed
  • No full card numbers in payment records

Send the enquiry to see what each one finds, and the fingerprint it keeps.

Try this in a copy of your own, for two hours, with nothing to sign up for.

Open your own copy

How a result is kept

Check a fingerprint yourself

  • Recorded once

    Each event from your systems is written to the record once. The same event sent twice is recognised and not counted again.

  • Checked as it arrives

    Every check that applies to that kind of event runs straight away. A failed check alerts the organisation's admins at once.

  • Fingerprinted

    Each result is stored with the SHA-256 hash of exactly what was checked. Recomputing it from the record gives the same value.

  • Kept for good

    The software can add results and cannot delete or change them. The database refuses.

  • People by id

    A result names records by their id, never a person's name or address. Erasing a person leaves every result standing and every fingerprint true.

  • Checked daily too

    Each day the record is checked for systems left unwatched and results without a fingerprint. A check that could not run is recorded as missing.

When a check fails

The compliance workflows, step by step

  • An issue

    The assistant that owns the check raises an issue, with the records behind it.

  • A person

    Accepting the issue makes a task for the right team, due by its severity.

  • An approver

    A fix that touches access, money or customer data needs a named approver before the failed result can close.

  • On the record

    Who closed it, who approved it and what was done are written onto the failed result itself.

  • Back if still true

    An issue clears when its cause clears. One closed while still true is raised again, linked to the first.

Want this on your own systems? It starts with an audit of how your business really runs.

Book an audit

Evidence you can hand over

A weekly pack

  • The week's report

    Each week the record becomes one report: the checks run, what failed and how each was closed, with a PDF pack.

  • For whoever asks

    An auditor, a regulator or a customer gets the organisation's own records, each with its fingerprint.

  • Practice work, marked

    Everything an organisation does in its sandbox is labelled simulated, in the record and in the report.

The law behind each check

Each check maps to the clauses it serves in the FourWinds law catalogue, the same catalogue behind the FourWinds compliance record.

Which of these laws apply to you

GDPR

7 clauses · 36 checks

The EU's data protection law (Regulation 2016/679).

  • GDPR Article 5(1)(c)Collect only what is needed

    Served by 1 check

    • Enquiry forms collect only what is needed
  • GDPR Article 5(1)(e)Delete data once it is no longer needed

    Served by 1 check

    • No one erased comes back

  • Served by 2 checks

    • Erasures are finished in every system within a month
    • No one erased comes back
  • GDPR Article 25(1) and (2)Build data protection in, and keep defaults minimal

    Served by 1 check

    • Enquiry forms collect only what is needed
  • GDPR Article 32(1)Security appropriate to the risk

    Served by 32 checks

    • No full card numbers in payment records
    • Admin access is approved and uses two-step sign-in
    • Everyone signs in with two-step sign-in
    • Every account uses two-step sign-in
    • Accounts flagged as at risk are dealt with
    • Devices are managed, compliant and encrypted
    • People who have left cannot sign in
    • The cloud account's root user is locked down
    • Activity in the cloud account is logged
    • Accounts nobody uses are switched off
    • Guest accounts are reviewed
    • Guests hold no admin role
    • Admins sign in with a phishing-resistant method
    • Old sign-in protocols are blocked
    • Admins are asked for two-step sign-in every time
    • Only admins and guest inviters can invite guests
    • Staff cannot hand company data to apps on their own
    • The directory's audit log is recording
    • Files cannot be shared by anonymous link
    • Two-step sign-in is enforced for everyone
    • Okta asks for a second factor at sign-in
    • Every account belongs to someone on the staff list
    • No S3 bucket is open to the public
    • New disks are encrypted by default
    • Databases are private
    • Databases are encrypted
    • The organisation requires two-factor authentication
    • Only owners make repositories public
    • Salesforce's Health Check finds no high-risk setting
    • Every outside collaborator was approved
    • Everyone's access is reviewed each quarter
    • Each system's access is reviewed and signed off each quarter
  • GDPR Article 33(1)Breach notification within 72 hours

    Served by 1 check

    • No full card numbers in payment records
  • GDPR Articles 44 to 46 and 49A lawful route for every transfer outside the EEA

    Served by 1 check

    • Transfers outside the EEA rest on a legal basis

ePrivacy Regulations

1 clause · 1 check

Ireland's rules on marketing email and texts (S.I. 336/2011).

NIS2

6 clauses · 53 checks

The EU's cyber security directive (2022/2555), for the sectors and sizes it covers.

  • NIS2 Article 21(1) to (4)Cyber security risk-management measures (not yet Irish law)

    Served by 47 checks

    • Admin access is approved and uses two-step sign-in
    • Everyone signs in with two-step sign-in
    • Every account uses two-step sign-in
    • Accounts flagged as at risk are dealt with
    • Devices are managed, compliant and encrypted
    • People who have left cannot sign in
    • The cloud account's root user is locked down
    • Cloud access keys are replaced regularly
    • Activity in the cloud account is logged
    • Code changes are reviewed before they reach the main branch
    • Integration failures are caught and handled
    • Accounts nobody uses are switched off
    • Two to four people hold the top admin role
    • Guest accounts are reviewed
    • Guests hold no admin role
    • Admins use a separate account for admin work
    • Admins sign in with a phishing-resistant method
    • Old sign-in protocols are blocked
    • Admins are asked for two-step sign-in every time
    • Risky sign-ins are challenged
    • Text message and voice call sign-in are switched off
    • Staff cannot hand company data to apps on their own
    • The directory's audit log is recording
    • Files cannot be shared by anonymous link
    • Two-step sign-in is enforced for everyone
    • Okta asks for a second factor at sign-in
    • Okta passwords are at least 12 characters
    • Every account belongs to someone on the staff list
    • IAM passwords are at least 14 characters
    • No S3 bucket is open to the public
    • New disks are encrypted by default
    • Remote admin ports are closed to the internet
    • Encryption keys are rotated
    • Threat detection is on
    • Configuration changes are recorded
    • Audit trail files can be proved untouched
    • Databases are private
    • Databases are encrypted
    • Outside access is analysed
    • Backups are planned
    • The organisation requires two-factor authentication
    • History on the main branch cannot be rewritten
    • Secrets pushed to code are caught
    • Vulnerable dependencies are flagged
    • Salesforce's Health Check finds no high-risk setting
    • Every outside collaborator was approved
    • A supplier's new bank details are confirmed before they are paid
  • NIS2 Article 21(2)(a)Risk analysis and information system security policies (not yet Irish law)

    Served by 2 checks

    • Policies are reviewed on time
    • Risks are reviewed on time
  • NIS2 Article 21(2)(b)Incident handling (not yet Irish law)

    Served by 2 checks

    • Accounts flagged as at risk are dealt with
    • Integration failures are caught and handled
  • NIS2 Article 21(2)(g)Cyber hygiene and training (not yet Irish law)

    Served by 1 check

    • Everyone working here has training in date
  • NIS2 Article 21(2)(i)People security, access control and assets (not yet Irish law)

    Served by 6 checks

    • Admin access is approved and uses two-step sign-in
    • Devices are managed, compliant and encrypted
    • People who have left cannot sign in
    • Everyone's access is reviewed each quarter
    • Each system's access is reviewed and signed off each quarter
    • Access a review removed is gone within a week
  • NIS2 Article 21(2)(j)Multi-factor sign-in and secured communications (not yet Irish law)

    Served by 3 checks

    • Admin access is approved and uses two-step sign-in
    • Everyone signs in with two-step sign-in
    • Every account uses two-step sign-in

DORA

7 clauses · 31 checks

The EU's digital operational resilience act for financial entities (Regulation 2022/2554).

  • DORA Article 6ICT risk management framework

    Served by 2 checks

    • Policies are reviewed on time
    • Risks are reviewed on time
  • DORA Article 8Identification of ICT assets

    Served by 2 checks

    • Devices are managed, compliant and encrypted
    • Configuration changes are recorded
  • DORA Article 9Protection and prevention

    Served by 22 checks

    • Admin access is approved and uses two-step sign-in
    • Everyone signs in with two-step sign-in
    • Every account uses two-step sign-in
    • Devices are managed, compliant and encrypted
    • People who have left cannot sign in
    • The cloud account's root user is locked down
    • Code changes are reviewed before they reach the main branch
    • Accounts nobody uses are switched off
    • Two to four people hold the top admin role
    • Admins use a separate account for admin work
    • Admins sign in with a phishing-resistant method
    • Old sign-in protocols are blocked
    • Admins are asked for two-step sign-in every time
    • Two-step sign-in is enforced for everyone
    • Okta asks for a second factor at sign-in
    • No S3 bucket is open to the public
    • Remote admin ports are closed to the internet
    • Databases are private
    • Vulnerable dependencies are flagged
    • Everyone's access is reviewed each quarter
    • Each system's access is reviewed and signed off each quarter
    • Access a review removed is gone within a week

  • Served by 2 checks

    • Risky sign-ins are challenged
    • Threat detection is on
  • DORA Article 12Backup and restoration

    Served by 1 check

    • Backups are planned
  • DORA Article 13Learning and evolving

    Served by 1 check

    • Everyone working here has training in date
  • DORA Article 28ICT third-party risk and the register of information

    Served by 2 checks

    • Staff cannot hand company data to apps on their own
    • A supplier's new bank details are confirmed before they are paid

ISO/IEC 27001

30 clauses · 71 checks

The information security standard, by its Annex A controls.

  • ISO/IEC 27001 8.2Information security risk assessment

    Served by 1 check

    • Risks are reviewed on time
  • ISO/IEC 27001 A.5.1Policies for information security

    Served by 2 checks

    • Everyone has acknowledged the policies in force
    • Policies are reviewed on time
  • ISO/IEC 27001 A.5.14Information transfer

    Served by 2 checks

    • Customer emails are delivered or handled
    • Files cannot be shared by anonymous link
  • ISO/IEC 27001 A.5.15Access control

    Served by 8 checks

    • Admin access is approved and uses two-step sign-in
    • Every account uses two-step sign-in
    • Two to four people hold the top admin role
    • Guests hold no admin role
    • Only admins and guest inviters can invite guests
    • Only admins register apps
    • Outside access is analysed
    • Members start with read access
  • ISO/IEC 27001 A.5.16Identity management

    Served by 1 check

    • Every account belongs to someone on the staff list
  • ISO/IEC 27001 A.5.17Authentication information

    Served by 5 checks

    • Cloud access keys are replaced regularly
    • Text message and voice call sign-in are switched off
    • Okta passwords are at least 12 characters
    • IAM passwords are at least 14 characters
    • Secrets pushed to code are caught
  • ISO/IEC 27001 A.5.18Access rights

    Served by 9 checks

    • Admin access is approved and uses two-step sign-in
    • People who have left cannot sign in
    • Accounts nobody uses are switched off
    • Guest accounts are reviewed
    • Every account belongs to someone on the staff list
    • Every outside collaborator was approved
    • Everyone's access is reviewed each quarter
    • Each system's access is reviewed and signed off each quarter
    • Access a review removed is gone within a week
  • ISO/IEC 27001 A.5.19Information security in supplier relationships

    Served by 5 checks

    • Guest accounts are reviewed
    • Only admins and guest inviters can invite guests
    • Staff cannot hand company data to apps on their own
    • Every outside collaborator was approved
    • A supplier's new bank details are confirmed before they are paid
  • ISO/IEC 27001 A.5.21Managing information security in the ICT supply chain

    Served by 1 check

    • A supplier's new bank details are confirmed before they are paid
  • ISO/IEC 27001 A.5.23Information security for use of cloud services

    Served by 1 check

    • Staff cannot hand company data to apps on their own
  • ISO/IEC 27001 A.5.26Response to information security incidents

    Served by 3 checks

    • Accounts flagged as at risk are dealt with
    • Integration failures are caught and handled
    • Card fraud warnings are acted on within a week
  • ISO/IEC 27001 A.5.33Protection of records

    Served by 4 checks

    • Invoices match what was quoted and paid
    • Invoices carry the required details
    • Every check keeps its evidence
    • Past periods are locked in the books
  • ISO/IEC 27001 A.5.34Privacy and protection of PII

    Served by 4 checks

    • Enquiry forms collect only what is needed
    • Erasures are finished in every system within a month
    • No one erased comes back
    • Transfers outside the EEA rest on a legal basis
  • ISO/IEC 27001 A.6.3Information security awareness, education and training

    Served by 1 check

    • Everyone working here has training in date
  • ISO/IEC 27001 A.6.5Responsibilities after termination or change of employment

    Served by 2 checks

    • People who have left cannot sign in
    • Access a review removed is gone within a week
  • ISO/IEC 27001 A.8.1User endpoint devices

    Served by 1 check

    • Devices are managed, compliant and encrypted
  • ISO/IEC 27001 A.8.2Privileged access rights

    Served by 8 checks

    • Admin access is approved and uses two-step sign-in
    • The cloud account's root user is locked down
    • Accounts nobody uses are switched off
    • Two to four people hold the top admin role
    • Guests hold no admin role
    • Admins use a separate account for admin work
    • Only admins register apps
    • Outside access is analysed
  • ISO/IEC 27001 A.8.3Information access restriction

    Served by 1 check

    • No S3 bucket is open to the public
  • ISO/IEC 27001 A.8.4Access to source code

    Served by 4 checks

    • Members start with read access
    • Only owners make repositories public
    • History on the main branch cannot be rewritten
    • Secrets pushed to code are caught
  • ISO/IEC 27001 A.8.5Secure authentication

    Served by 14 checks

    • Admin access is approved and uses two-step sign-in
    • Everyone signs in with two-step sign-in
    • Every account uses two-step sign-in
    • The cloud account's root user is locked down
    • Cloud access keys are replaced regularly
    • Admins use a separate account for admin work
    • Admins sign in with a phishing-resistant method
    • Old sign-in protocols are blocked
    • Admins are asked for two-step sign-in every time
    • Risky sign-ins are challenged
    • Text message and voice call sign-in are switched off
    • Two-step sign-in is enforced for everyone
    • Okta asks for a second factor at sign-in
    • The organisation requires two-factor authentication
  • ISO/IEC 27001 A.8.8Management of technical vulnerabilities

    Served by 1 check

    • Vulnerable dependencies are flagged
  • ISO/IEC 27001 A.8.9Configuration management

    Served by 2 checks

    • Configuration changes are recorded
    • Salesforce's Health Check finds no high-risk setting
  • ISO/IEC 27001 A.8.12Data leakage prevention

    Served by 4 checks

    • No full card numbers in payment records
    • Files cannot be shared by anonymous link
    • No S3 bucket is open to the public
    • Only owners make repositories public
  • ISO/IEC 27001 A.8.13Information backup

    Served by 1 check

    • Backups are planned
  • ISO/IEC 27001 A.8.15Logging

    Served by 5 checks

    • Activity in the cloud account is logged
    • Every check keeps its evidence
    • The directory's audit log is recording
    • Configuration changes are recorded
    • Audit trail files can be proved untouched
  • ISO/IEC 27001 A.8.16Monitoring activities

    Served by 8 checks

    • Accounts flagged as at risk are dealt with
    • Activity in the cloud account is logged
    • Integration failures are caught and handled
    • Automations finish, or a person takes over
    • Every connected system is monitored
    • Risky sign-ins are challenged
    • Threat detection is on
    • Card fraud warnings are acted on within a week
  • ISO/IEC 27001 A.8.20Networks security

    Served by 2 checks

    • Remote admin ports are closed to the internet
    • Databases are private
  • ISO/IEC 27001 A.8.24Use of cryptography

    Served by 3 checks

    • New disks are encrypted by default
    • Encryption keys are rotated
    • Databases are encrypted
  • ISO/IEC 27001 A.8.28Secure coding

    Served by 1 check

    • Code changes are reviewed before they reach the main branch
  • ISO/IEC 27001 A.8.32Change management

    Served by 2 checks

    • Code changes are reviewed before they reach the main branch
    • History on the main branch cannot be rewritten

Start here

See it on a business of your own.

Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.

Try it live Book an auditNext: Security