Eulogika Logo
    eulogika
    Change language
    A&T Vicenza 202627-29 October 2026
    CyberSentinel · Compliance & GRC

    CyberSentinel: assets, information security, NIS2 supply chain and privacy in one software

    Five modules on a single platform, integrated with the JobTracker3 ERP, to manage the IT asset inventory, the ISO/IEC 27001 management system, NIS2 supply chain security with a supplier portal, supply chain business continuity and GDPR obligations. One database and one shared document archive, ready for certification audits, NIS2 assessments and data protection inspections.

    Last updated:

    Discover the five modulesRequest a demo
    CyberSentinel: IT asset management, ISO 27001 ISMS, NIS2 supply chain, continuity and GDPR privacy on a single database

    In short

    CyberSentinel is the GRC (Governance, Risk & Compliance) suite developed by Eulogika S.r.l. of Rubano (Padua, Italy) on the platform of the JobTracker3 ERP. It brings together, in a single on-premise web application, asset and IT infrastructure management, an information security management system aligned with ISO/IEC 27001:2022, the supply chain governance required by article 21.2(d) of the NIS2 directive (inventory by criticality, supplier lifecycle, contract clauses, supplier portal and verifications), supply chain business continuity with the remediation plan, and the privacy obligations of the GDPR (EU Regulation 2016/679). It is designed for manufacturing and service SMEs and large enterprises, and for their suppliers, that must demonstrate compliance with ISO 27001, the NIS2 directive and the GDPR without juggling dozens of disconnected spreadsheets.

    Key facts

    Vendor
    Eulogika S.r.l., Italian software house since 2001, ISO/IEC 27001:2022 certified
    Software type
    GRC platform (web application), used on its own or integrated with the JobTracker3 ERP
    Modules
    Assets & IT infrastructure · ISO 27001 ISMS · NIS2 supply chain · Business continuity · GDPR privacy
    Standards covered
    ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIS2 (EU 2022/2555, Italian Legislative Decree 138/2024), ACN Determination 127437/2026, NIST CSF 2.0, ISO 22301:2019, GDPR (EU 2016/679), ISO 9001:2015 §8.4
    Shared tools
    Document archive with revisions, certified email (PEC) and personal area, AI assistant, regulations catalog
    Deployment
    On-premise or on dedicated infrastructure managed by Eulogika; multi-company
    Technology
    .NET 10, Blazor, SQL Server, OpenAPI REST API
    Application security
    TOTP two-factor authentication, granular permissions on 16 actions, masking of sensitive fields
    Languages
    Italian, English

    Why one system for assets, security, supply chain and privacy

    ISO 27001, NIS2 and the GDPR ask for the same things from different angles: know which assets and data you hold, assess their risks, control who handles them inside and outside the company, and prove it with evidence. When the inventory, the risk register, the supplier list and the record of processing live in separate files, every audit becomes a reconciliation exercise. In CyberSentinel they are linked: the asset points to its risks, the risk to its controls, the supplier to the assets and processing activities entrusted to it.

    A single source of truth

    Assets, risks, suppliers and processing activities share master data and the database with the ERP: no double entry, no conflicting versions.

    Audit-ready evidence

    Every record is dated, attributed to a user and linked to its control: the auditor finds the proof without looking for it.

    Continuous, not annual, compliance

    Deadlines, re-evaluations and scheduled maintenance raise automatic reminders and notifications all year round.

    Permissions on every field

    The DPO sees processing activities, IT sees assets, purchasing sees suppliers: each only what concerns them, with CyberSentinel's granular permissions.

    The five CyberSentinel modules

    Each module is activated independently and works on the same data as the ERP.

    Asset and IT Infrastructure Management

    How do you keep the asset inventory required by ISO 27001 and NIS2?

    The tree-structured asset register records servers, clients, network devices, software, cloud services and information, with owner, location, classification and criticality. Scheduled maintenance carries RTO, RPO and MTD targets; software updates are tracked with the CVE reference of the vulnerability they close; the network inventory is shown as a connection graph.

    Regulatory references
    ISO 27001 A.5.9A.7.13A.8.8A.5.30NIS2 art. 21.2(c)(e)(i)
    • Hierarchical asset register with owner, classification and criticality
    • Scheduled maintenance with RTO, RPO and MTD targets
    • Software updates and patches with CVE references
    • Company network inventory and graph
    • Asset movements (handovers, transfers, disposals) linked to the IT inventory
    • Asset linked to risks, suppliers and personal data processing

    ISO/IEC 27001 Management System

    Which software should you use to run an ISO 27001:2022 ISMS?

    The ISMS module guides the whole management system cycle: context of the organization and interested parties, risk register with assessment and treatment, Statement of Applicability on the 93 Annex A controls, business impact analysis (BIA), incident register, non-conformities and corrective actions, internal audits, management reviews, training plans and a versioned document register.

    Regulatory references
    ISO 27001 §4–10§6.1.2–6.1.3A.5.24–5.28§9.2–9.3NIS2 art. 21.2(a)(b)(g)
    • Context, interested parties and scope
    • Risk register with assessment, treatment and residual risk
    • Statement of Applicability on the 93 ISO/IEC 27001:2022 controls
    • BIA, incidents, non-conformities and corrective actions
    • Internal audits, management reviews, training and a document register with drafts, approval and revisions
    • Statement of Applicability review by the AI assistant, on a language model of your choice

    NIS2 Supply Chain and Supplier Qualification

    How do you govern the supply chain security required by NIS2 article 21.2(d)?

    The NIS2 supplier inventory starts from the ERP master data and purchases, or from an Excel import, and gives each supplier a criticality tier computed from five risk factors, non-fungibility included. The supplier moves through a seven-stage lifecycle (selection, qualification, onboarding, operation, suspended, exit, ended) and every stage change is an act that checks the gate conditions. Contract clauses, document requirements and the verification plan are defined per tier; the supplier fills in questionnaires and uploads evidence in its own portal; events, incidents and deadlines reopen the evaluation.

    Regulatory references
    NIS2 art. 21.2(d), 21.3NIST CSF 2.0 GV.SCID.AM-04ISO 27001 A.5.19–5.23ISO 9001 §8.4GDPR art. 28
    • NIS2 inventory by criticality tier, with third-party services, product supplies and supplier personnel
    • Seven-stage lifecycle with gate conditions and approved derogations
    • Contract clauses, document requirements and verification plan per tier
    • Supplier portal in five languages: questionnaires, attachments, submit declaration and plan actions
    • Versioned questionnaires with section scores and a printable report for the auditor
    • Supplier events (security, continuity, quality) with notification times and qualification renewal
    • Purchasing traffic light: no orders to a suspended or unqualified supplier
    • ACN relevant-supplier census with CPV codes and email reminders

    Business Continuity and Remediation Plan

    How do you prove your supply chain withstands the loss of a critical supplier?

    Operational processes are described with tolerable period and recovery objective in hours, work centers and customer commitments; dependencies on suppliers and supplies carry coverage days, alternatives and recovery times. The system highlights exposure and single points of failure and feeds a continuity risk register with a probability × impact matrix and formal acceptance. Supplier and risk gaps generate the remediation plan, approved by management revision by revision; a RACI matrix, an operating model generated from the rules the system applies, a dashboard and a management report close the loop.

    Regulatory references
    NIS2 art. 21.2(c)ISO 22301ISO 27001 A.5.29–5.30NIST CSF 2.0 GV.RR, ID.RAACN Det. 127437/2026
    • Operational processes with tolerable period, recovery objective and customer commitments
    • Supplier dependencies with coverage, alternatives and single points of failure
    • Continuity risk register with a 5×5 matrix and formal acceptance
    • Supplier continuity questionnaire and risks proposed by the AI assistant
    • Remediation plan generated from gaps, with revisions approved by management
    • RACI matrix, printable operating model, dashboard and management report

    Privacy and GDPR Compliance

    How do you manage the record of processing, DPIAs and data breaches under the GDPR?

    The privacy module maintains the record of processing activities as controller and as processor, with purposes, legal bases, categories of data and data subjects, recipients, transfers and retention periods. It supports data protection impact assessments (DPIA), the personal data breach register with notification deadlines, data subject requests and the appointment of external processors, linked to the supplier list.

    Regulatory references
    GDPR art. 5, 28–30art. 32–35art. 15–22Garante 27/11/2008ISO 27001 A.5.34
    • Record of processing for controller and processor (art. 30)
    • Data protection impact assessment (DPIA, art. 35)
    • Breach register with 72-hour notification timing (art. 33–34)
    • Data subject requests: access, rectification, erasure (art. 15–22)
    • Appointments of authorized persons, system administrators and DPO with acknowledgement and certified email delivery (art. 29, 37)
    • Data processing agreements (DPA, art. 28) in both directions, with the signed act in the archive

    Tools shared by every module

    The same platform features serve assets, ISMS, supply chain and privacy.

    Shared document archive

    Signed acts, certificates and evidence attach to the rows of any module, with progressive revisions, expiry, verification by a second user and the owning module's permissions.

    Certified email (PEC) and personal area

    Appointments and reserved documents are published as immutable revisions with a SHA-256 fingerprint, with per-recipient acknowledgement and delivery by Italian certified email; receipts are collected and matched automatically.

    CyberSentinel AI assistant

    Proposes corrective actions, continuity risks, supplier types and a Statement of Applicability review, on a language model of your choice, local ones included. A person applies every proposal.

    Regulations catalog

    ISO/IEC 27001 and 27002:2022, ISO 22301:2019, the 106 NIST CSF 2.0 subcategories and their mappings to ISO 27001, linked to the original texts.

    Regulatory map: which module covers which requirement

    How the requirements of ISO/IEC 27001:2022, the NIS2 directive, NIST CSF 2.0, the GDPR and ISO 9001 map to CyberSentinel features.

    Regulatory map: which module covers which requirement
    RequirementReferenceCyberSentinel module
    Inventory of information and assetsISO 27001 A.5.9 · NIS2 art. 21.2(i)Assets & IT infrastructure
    Technical vulnerability managementISO 27001 A.8.8 · NIS2 art. 21.2(e)Assets & IT infrastructure
    Business continuity, backup and recoveryISO 27001 A.5.30, A.8.13 · NIS2 art. 21.2(c)Assets (RTO/RPO/MTD) · ISMS (BIA) · Continuity
    Supply chain continuityNIS2 art. 21.2(c) · ISO 22301 · ISO 27001 A.5.29Business continuity
    Risk assessment and treatmentISO 27001 §6.1.2–6.1.3 · NIS2 art. 21.2(a)ISO 27001 ISMS
    Statement of ApplicabilityISO 27001 §6.1.3 d)ISO 27001 ISMS
    Incident managementISO 27001 A.5.24–5.28 · NIS2 art. 21.2(b), art. 23ISO 27001 ISMS
    Training and awarenessISO 27001 A.6.3 · NIS2 art. 21.2(g)ISO 27001 ISMS
    Internal audit and management reviewISO 27001 §9.2–9.3ISO 27001 ISMS
    Supply chain securityISO 27001 A.5.19–5.22 · NIS2 art. 21.2(d)NIS2 supply chain
    Supplier inventory and criticality tierNIST CSF 2.0 GV.SC-04 · ID.AM-04NIS2 supply chain
    Security requirements in supplier contractsNIS2 art. 21.3 · GV.SC-05 · ISO 27001 A.5.20NIS2 supply chain
    Periodic verification and monitoring of suppliersNIST CSF 2.0 GV.SC-07 · ISO 27001 A.5.22NIS2 supply chain
    Non-fungible suppliers and ACN censusACN Determination 127437/2026Supply chain · Continuity
    Supply chain roles and responsibilitiesNIST CSF 2.0 GV.RR · GV.SC-02Business continuity (RACI)
    Control of external providersISO 9001 §8.4NIS2 supply chain
    Data processorsGDPR art. 28Privacy · Supply chain
    Authorized persons and system administratorsGDPR art. 29 · Italian DPA decision 27/11/2008GDPR privacy
    Record of processing activitiesGDPR art. 30GDPR privacy
    Personal data breach notificationGDPR art. 33–34GDPR privacy · ISMS (incidents)
    Data protection impact assessmentGDPR art. 35GDPR privacy
    Privacy and protection of PIIISO 27001 A.5.34GDPR privacy

    How the five modules work together

    1. 01

      Inventory

      Record assets, suppliers by criticality and personal data processing, each with its owner.

    2. 02

      Assess

      Link assets and dependencies to their risks, calculate residual risk and decide controls in the Statement of Applicability.

    3. 03

      Qualify

      Suppliers fill in questionnaires in the portal and upload evidence; every stage change checks the gate conditions.

    4. 04

      Monitor

      Maintenance, CVE patches, supplier events, incidents and breaches are recorded and notified within the required time.

    5. 05

      Demonstrate

      The remediation plan and the management and auditor reports find evidence already linked to requirements and controls.

    Spreadsheets or CyberSentinel?

    Spreadsheets or CyberSentinel?
    AspectScattered spreadsheets and documentsCyberSentinel
    Links between assets, risks, suppliers and processingManual, by text referencesNative relations in the same database
    Certificate, maintenance and re-evaluation deadlinesPersonal calendarsAutomatic reminders and notifications
    Who changed whatMissing or partialEvery record dated and attributed
    Access controlShared foldersGranular permissions by role, company and field
    Audit preparationDays of collection and reconciliationEvidence already linked to controls
    Supplier dataCopied from the ERPThe ERP's own master data
    Supplier questionnairesFiles sent and received by emailSupplier portal with scoring and an auditor report
    Orders to unqualified suppliersFound after the factBlocked by the purchasing traffic light

    Who CyberSentinel is for

    NIS2 entities

    Essential and important entities that must apply the measures of article 21 and document them for the national cybersecurity authority.

    ISO 27001 certified companies

    Organizations that want to keep their ISMS alive all year, not just the week before the audit.

    Manufacturing with an extended supply chain

    SMEs and large enterprises that must qualify suppliers and subcontractors, govern their continuity and meet their own customers' NIS2 requirements.

    DPOs, consultants and IT managers

    Those who manage privacy and security for one or more companies of the same group, with a single multi-company installation.

    Built by people who apply ISO 27001 every day

    Eulogika is a software house based in Rubano (Padua, Italy), operating since 2001 and certified ISO/IEC 27001:2022. CyberSentinel's modules come from our own management system and from the NIS2 and GDPR projects we run for industrial customers: they are the tool we use, not a theoretical exercise.

    5
    GRC modules on a single database
    93
    Annex A controls in the Statement of Applicability
    2001
    year Eulogika was founded

    Frequently asked questions about CyberSentinel

    What is CyberSentinel?

    CyberSentinel is Eulogika's GRC platform, built on the JobTracker3 ERP: asset and IT infrastructure management, an ISO/IEC 27001:2022 information security management system, NIS2 supply chain governance with a supplier portal, supply chain business continuity with a remediation plan, and GDPR privacy obligations. It runs as an on-premise web application, on its own or on the same database as the ERP.

    Does CyberSentinel help achieve ISO 27001 certification?

    Yes. The ISMS module covers the requirements of clauses 4–10 of ISO/IEC 27001:2022 and the Statement of Applicability on the 93 Annex A controls, with risk register, incidents, non-conformities, internal audits, reviews and training. Certification is still issued by an accredited body: CyberSentinel organizes the evidence the auditor checks.

    Is CyberSentinel useful for NIS2 compliance?

    Yes. The risk management measures of article 21 of the NIS2 directive map to the modules: risk analysis, incident handling, business continuity, supply chain security, vulnerability handling, training and asset management. Two-factor authentication is native to the application.

    How does CyberSentinel handle NIS2 supply chain security?

    The NIS2 inventory gives every supplier a criticality tier computed from five risk factors, non-fungibility included. Per tier CyberSentinel defines contract clauses, document requirements and the verification plan; the supplier moves through seven stages, from selection to ended, and every stage change checks the gate conditions. Supplier events and incidents, evidence expiry and qualification renewal are tracked. It is aligned with NIS2 articles 21.2(d) and 21.3, the NIST CSF 2.0 GV.SC category, ISO 27001 controls A.5.19–5.23 and ISO 9001 §8.4.

    How do suppliers fill in qualification questionnaires?

    In the CyberSentinel supplier portal, available in five languages: the supplier's contact receives an invitation, fills in the questionnaires, attaches documents, submits with a declaration (name, role, place, acceptance) and updates the remediation plan actions that concern them. The supplier only sees its own assessments, never scores, internal notes or the outcome; section scores and the printable auditor report stay with the company.

    Does CyberSentinel help with the ACN supplier census?

    Yes. CPV codes and the relevance criterion are recorded on the supplier, computed from supply type and non-fungibility in line with ACN Determination 127437/2026; a dedicated list shows one row per CPV code, flags missing data and exports from the grid. Late suppliers receive email reminders with due date and count.

    How is supply chain business continuity managed?

    The Business continuity module links processes, work centers and customer commitments to dependencies on suppliers and supplies, with coverage days, alternatives and recovery times. It highlights single points of failure, feeds a continuity risk register with a 5×5 matrix and formal acceptance, and generates the remediation plan, approved by management revision by revision.

    How does CyberSentinel use artificial intelligence?

    The CyberSentinel AI assistant proposes corrective actions from non-conformities, continuity risks from the supplier card, the supplier type and a review of the Statement of Applicability. It connects to Anthropic's Claude or to any OpenAI-compatible service, local ones such as Ollama included; it reads only the data the user is allowed to see and no proposal is applied without a person.

    Does the privacy module replace the DPO?

    No. The privacy module is the tool controllers, processors and DPOs use to keep the record of processing, DPIAs, the breach register and data subject requests. Legal assessments remain with the competent people; CyberSentinel keeps their decisions and deadlines.

    How are personal data breaches handled?

    Each breach is recorded with discovery date, nature, categories and approximate number of data subjects, consequences and measures taken. The system highlights the 72-hour deadline for notifying the supervisory authority under GDPR article 33 and can be linked to the security incident recorded in the ISMS.

    Can I activate only some modules?

    Yes. Every CyberSentinel module is activated independently: you can start with the asset inventory or the NIS2 supply chain and add the ISMS, continuity and privacy later, with no migration.

    Do I need the JobTracker3 ERP to use CyberSentinel?

    No. CyberSentinel works without accounting, sales or production: the JobTracker3 platform it is built on then provides master data, users, permissions and notifications. If the ERP is already in use, suppliers and assets are the same as in the ERP.

    Where is the data stored?

    On the company's own servers with an on-premise installation, or on dedicated infrastructure managed by Eulogika. Each customer has its own installation; several companies of the same group can coexist with data isolation guaranteed by design.

    How long does it take to get started?

    It depends on the starting point. A typical project begins by importing the inventories, registers and supplier lists already kept in Excel (the supplier import shows a preview before writing), configures roles and permissions and activates modules in phases. Eulogika analyzes the processes and proposes a plan before starting.

    Related reading

    JobTracker3: the complete modular ERPISO 27001:2022 certification consultingCybersecurity and NIS2 complianceIntegrated ERP + AI platform

    Bring compliance into your ERP

    We'll show you CyberSentinel on your own assets, suppliers and processing activities, starting from the registers you use today.

    Request a demoContact us