Sectors

The laws your sector answers to, by name.

Financial services answer to DORA, technology and SaaS to NIS2 and the ISO 27001 controls, health and care to the notification clocks, and every sector to GDPR and the AI Act. The audit maps the rules that apply to you, and the checks keep the controls on every record.

Try it live Book an audit

Compliance, kept on every record

Which laws reach which sector

Every business in the EU answers to GDPR, ePrivacy and the AI Act. On top of them, each sector has its own. Each law opens its plain-words guide or its official text.

Which laws reach which sectors. A filled dot: the law reaches organisations in that sector. A ring: a standard an organisation chooses.
Law	Financial services	Technology and SaaS	Health and care	Professional services	Public bodies
GDPREU regulation
ePrivacy DirectiveEU directive
EU AI ActEU regulation
DORAEU regulation			Does not reach it	Does not reach it	Does not reach it
Money laundering ActIrish law		Does not reach it	Does not reach it		Does not reach it
Payment Services DirectiveEU directive		Does not reach it	Does not reach it	Does not reach it	Does not reach it
MiFID IIEU directive		Does not reach it	Does not reach it	Does not reach it	Does not reach it
NIS2EU directive	Does not reach it			Does not reach it
Cyber Resilience ActEU regulation	Does not reach it		Does not reach it	Does not reach it	Does not reach it
Data ActEU regulation	Does not reach it		Does not reach it	Does not reach it	Does not reach it
Patient Safety ActIrish law	Does not reach it	Does not reach it		Does not reach it	Does not reach it
Care regulationsIrish law	Does not reach it	Does not reach it		Does not reach it	Does not reach it
Freedom of Information ActIrish law	Does not reach it	Does not reach it	Does not reach it	Does not reach it
Protected Disclosures ActIrish law	Does not reach it	Does not reach it	Does not reach it	Does not reach it
Web accessibilityIrish law	Does not reach it	Does not reach it	Does not reach it	Does not reach it
ISO 27001Voluntary standard

A filled dot: the law reaches organisations in that sector (NIS2 and the Protected Disclosures Act only above their size limits). A ring: a standard an organisation chooses, which customers and banks often ask for. The grid shows which laws reach a sector. What the checks cover is below, and on Coverage.

The sectors

Each with the rules that bind it, linked to the official text, and what the audit maps for it.

Financial services
Banks, insurers, investment firms, payment and e-money institutions, and the ICT providers that serve them.
The rules that bind it
- DORA · Regulation (EU) 2022/2554 · In plain wordsICT risk management, major incidents classified and reported on its clocks, resilience testing, and a register of every ICT provider with the contract terms Article 30 sets.
- Money laundering Act · Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 · In plain wordsA money laundering risk assessment, due diligence on every customer, and suspicions reported to FIU Ireland and Revenue.
- Payment Services Directive · Directive (EU) 2015/2366 · In plain wordsCustomers' funds safeguarded, and strong customer authentication on payments.
- MiFID II · Directive 2014/65/EU · In plain wordsSuitability and appropriateness assessed for each client, by staff with the knowledge to advise.
- GDPR · Regulation (EU) 2016/679 · In plain wordsCustomer data kept to what is needed, secured, erasable, and a breach reported within 72 hours.
The audit mapsYour ICT risk controls, how incidents are classified and reported, and every third-party provider, against DORA.
Check your sector

Banks, insurers, investment firms, payment and e-money institutions, and the ICT providers that serve them.

The rules that bind it

DORA · Regulation (EU) 2022/2554 · In plain wordsICT risk management, major incidents classified and reported on its clocks, resilience testing, and a register of every ICT provider with the contract terms Article 30 sets.
Money laundering Act · Criminal Justice (Money Laundering and Terrorist Financing) Act 2010 · In plain wordsA money laundering risk assessment, due diligence on every customer, and suspicions reported to FIU Ireland and Revenue.
Payment Services Directive · Directive (EU) 2015/2366 · In plain wordsCustomers' funds safeguarded, and strong customer authentication on payments.
MiFID II · Directive 2014/65/EU · In plain wordsSuitability and appropriateness assessed for each client, by staff with the knowledge to advise.
GDPR · Regulation (EU) 2016/679 · In plain wordsCustomer data kept to what is needed, secured, erasable, and a breach reported within 72 hours.

The audit mapsYour ICT risk controls, how incidents are classified and reported, and every third-party provider, against DORA.

Check your sector

In every sector: EU AI Act · Regulation (EU) 2024/1689. Any organisation that uses AI systems has duties under it, from measures that support its staff's AI literacy to the rules for high-risk uses, which apply from 2 December 2027 for most.

Try this in a copy of your own, for two hours, with nothing to sign up for.

Open your own copy

What the checks cover today

The checks that run on your systems now, by the law their controls map to. The audit maps the rest of what applies to you.

Each check that runs today, and the laws its controls map to
Check	GDPR	ePrivacy	NIS2	DORA	ISO 27001
Enquiry forms collect only what is needed	Yes	No	No	No	Yes
Marketing email only with consent	No	Yes	No	No	No
Customer emails are delivered or handled	No	No	No	No	Yes
No full card numbers in payment records	Yes	No	No	No	Yes
Invoices match what was quoted and paid	No	No	No	No	Yes
Invoices carry the required details	No	No	No	No	Yes
Admin access is approved and uses two-step sign-in	Yes	No	Yes	Yes	Yes
Everyone signs in with two-step sign-in	Yes	No	Yes	Yes	Yes
Every account uses two-step sign-in	Yes	No	Yes	Yes	Yes
Accounts flagged as at risk are dealt with	Yes	No	Yes	No	Yes
Devices are managed, compliant and encrypted	Yes	No	Yes	Yes	Yes
People who have left cannot sign in	Yes	No	Yes	Yes	Yes
The cloud account's root user is locked down	Yes	No	Yes	Yes	Yes
Cloud access keys are replaced regularly	No	No	Yes	No	Yes
Activity in the cloud account is logged	Yes	No	Yes	No	Yes
Code changes are reviewed before they reach the main branch	No	No	Yes	Yes	Yes
Integration failures are caught and handled	No	No	Yes	No	Yes
Automations finish, or a person takes over	No	No	No	No	Yes
Every connected system is monitored	No	No	No	No	Yes
Every check keeps its evidence	No	No	No	No	Yes
Accounts nobody uses are switched off	Yes	No	Yes	Yes	Yes
Two to four people hold the top admin role	No	No	Yes	Yes	Yes
Guest accounts are reviewed	Yes	No	Yes	No	Yes
Guests hold no admin role	Yes	No	Yes	No	Yes
Admins use a separate account for admin work	No	No	Yes	Yes	Yes
Admins sign in with a phishing-resistant method	Yes	No	Yes	Yes	Yes
Old sign-in protocols are blocked	Yes	No	Yes	Yes	Yes
Admins are asked for two-step sign-in every time	Yes	No	Yes	Yes	Yes
Risky sign-ins are challenged	No	No	Yes	Yes	Yes
Text message and voice call sign-in are switched off	No	No	Yes	No	Yes
Only admins and guest inviters can invite guests	Yes	No	No	No	Yes
Staff cannot hand company data to apps on their own	Yes	No	Yes	Yes	Yes
Only admins register apps	No	No	No	No	Yes
The directory's audit log is recording	Yes	No	Yes	No	Yes
Files cannot be shared by anonymous link	Yes	No	Yes	No	Yes
Two-step sign-in is enforced for everyone	Yes	No	Yes	Yes	Yes
Okta asks for a second factor at sign-in	Yes	No	Yes	Yes	Yes
Okta passwords are at least 12 characters	No	No	Yes	No	Yes
Every account belongs to someone on the staff list	Yes	No	Yes	No	Yes
IAM passwords are at least 14 characters	No	No	Yes	No	Yes
No S3 bucket is open to the public	Yes	No	Yes	Yes	Yes
New disks are encrypted by default	Yes	No	Yes	No	Yes
Remote admin ports are closed to the internet	No	No	Yes	Yes	Yes
Encryption keys are rotated	No	No	Yes	No	Yes
Threat detection is on	No	No	Yes	Yes	Yes
Configuration changes are recorded	No	No	Yes	Yes	Yes
Audit trail files can be proved untouched	No	No	Yes	No	Yes
Databases are private	Yes	No	Yes	Yes	Yes
Databases are encrypted	Yes	No	Yes	No	Yes
Outside access is analysed	No	No	Yes	No	Yes
Backups are planned	No	No	Yes	Yes	Yes
The organisation requires two-factor authentication	Yes	No	Yes	No	Yes
Members start with read access	No	No	No	No	Yes
Only owners make repositories public	Yes	No	No	No	Yes
History on the main branch cannot be rewritten	No	No	Yes	No	Yes
Secrets pushed to code are caught	No	No	Yes	No	Yes
Vulnerable dependencies are flagged	No	No	Yes	Yes	Yes
Past periods are locked in the books	No	No	No	No	Yes
Salesforce's Health Check finds no high-risk setting	Yes	No	Yes	No	Yes
Card fraud warnings are acted on within a week	No	No	No	No	Yes
Every outside collaborator was approved	Yes	No	Yes	No	Yes
Everyone working here has training in date	No	No	Yes	Yes	Yes
Everyone has acknowledged the policies in force	No	No	No	No	Yes
Everyone's access is reviewed each quarter	Yes	No	Yes	Yes	Yes
Policies are reviewed on time	No	No	Yes	Yes	Yes
Risks are reviewed on time	No	No	Yes	Yes	Yes
Each system's access is reviewed and signed off each quarter	Yes	No	Yes	Yes	Yes
Access a review removed is gone within a week	No	No	Yes	Yes	Yes
Erasures are finished in every system within a month	Yes	No	No	No	Yes
No one erased comes back	Yes	No	No	No	Yes
Transfers outside the EEA rest on a legal basis	Yes	No	No	No	Yes
A supplier's new bank details are confirmed before they are paid	No	No	Yes	Yes	Yes
Checks that map to it	36	1	53	31	71

Start here

See it on a business of your own.

Open your own copy in a few seconds and use it for two hours, with nothing to sign up for. When you want it on your own systems, we start with an audit.

Try it live Book an audit Next: How it works