Frequently asked questions

NIS2 and ISO 27001 compliance is not a one-time event. It is an ongoing program. An annual commitment reflects how compliance actually works: you assess, remediate, and reassess. Short-term subscriptions encourage checkbox thinking. We built Audit41 Readiness for organizations that are serious about closing their gaps, not just generating a report.

Yes. You can pay in 12 monthly installments. The contractual commitment is still 12 months: you are not paying month-to-month with the option to cancel. The installment option is a cash flow convenience, not a shorter commitment period.

Each of NIS2, ISO 27001, and NIST SP 800-53 is one framework. Each project covers one framework. Essentials and Professional include 1 project. Programme includes up to 3 projects, one framework per project. NIS2 country variants (e.g. Hungarian NIS2 vs Danish NIS2) are selected at project level and count as the same NIS2 framework.

After completing your initial assessment and working on remediation, you can run the full end-to-end assessment again at no additional cost. The rerun produces a fresh gap report that you can compare directly to your original, showing which gaps were closed, which improved, and which remain. Programme includes one free rerun per project.

Yes. You pay the difference between your current plan and the new plan, and the contract term remains the same: it does not restart. So if you are 4 months into an Essentials annual plan and upgrade to Professional, you pay the pro-rated difference for the remaining 8 months.

Yes. The NIS2 Self-Checker (which determines whether your organization is in scope, your entity type, and which plan fits) is completely free with no credit card required. You only pay when you start a full gap assessment project.

Audit41 Readiness supports NIS2 (Hungary, Slovakia, Czechia, and Denmark), ISO/IEC 27001:2022, and NIST SP 800-53. ISO 27001 and NIST SP 800-53 are not country-specific. Other NIS2 country variants are built for the engagements that need them - contact us if yours is not listed.

Vanta and Drata are built for US compliance frameworks (SOC 2, HIPAA). Audit41 is built for EU regulatory context: ISO 27001:2022, NIS2, and their country-level variants. If you are selling into DACH, UK, or Nordics, your enterprise prospects want EU-native certification, not a US-shaped checkbox exercise. At scale, Audit41 is 5-10x less expensive.

Audit41 produces structured evidence: gap assessments, control mappings, documentation, not a certificate. The auditor evaluates your controls, not the tool that organised them. The methodology was developed across 600+ real ISO 27001 and NIS2 audit engagements.

SOC 2 and ISO 27001 controls overlap by approximately 70%. Running them in parallel using Audit41 is faster and cheaper than sequentially. If your enterprise prospects are in Europe, ISO 27001 carries more weight than SOC 2 in most procurement conversations.

Annual Professional tier is €2,990, roughly €8 per day. If a single enterprise deal has stalled because of missing ISO 27001, the cost of not certifying is already higher. A traditional consultant engagement costs €15,000-50,000 and takes 6-9 months.

You need an accredited certification body to issue the certificate. Audit41 prepares your team for that audit: structured evidence collection, gap remediation, and control mapping. Many companies complete preparation entirely internally using Audit41 and then engage a certification body directly for the audit itself.

It depends on your starting point. Companies with existing security practices typically reach audit-ready in 8-14 weeks. Audit41 structures the work so you know exactly what is done, what is pending, and what the auditor will look for.

There is no catch, only software economics. The methodology is built once and validated across 600+ audit engagements. The annual fee distributes that development cost across the platform. We offer the efficient version, not the compromised one.

ISO 27001 is the international standard for information security management systems (ISMS). Companies get certified to demonstrate to customers, partners, and regulators that they manage information security systematically. In practice, ISO 27001 certification is increasingly required by enterprise procurement teams (particularly in DACH, UK, US, and Nordics markets) before they will sign contracts with technology and service vendors.

NIS2 (Network and Information Security Directive 2) is EU-wide regulation requiring medium and large organizations in critical and important sectors to implement cybersecurity measures and submit to regular audits. In Hungary, NIS2 was transposed by the 2024. évi LXIX. törvény (Kibertan. tv.). Affected entities must register with SZTFH and undergo periodic audits by SZTFH-approved auditors. Sectors include manufacturing, digital infrastructure, private healthcare, logistics, and waste management.

ISO 27001 is a voluntary international standard. Companies pursue it to meet customer demands or demonstrate security maturity. NIS2 is mandatory EU regulation. Companies in scope have no choice. The two overlap significantly in their control requirements. A company that completes ISO 27001 readiness preparation will have addressed most NIS2 requirements as well. Audit41 Readiness supports both frameworks from a single platform.

A gap assessment identifies the distance between your current security posture and the requirements of a compliance framework. It tells you what evidence you have, what is missing, and what you need to fix before an audit. An audit is a formal examination by an accredited certification body, resulting in a certificate or compliance determination. Audit41 Readiness is a gap assessment tool. It prepares you for an audit but does not conduct or replace the audit itself.

With a traditional consultant: 6-12 months from starting preparation to receiving a certificate. With Audit41 Readiness, companies with existing security practices typically reach audit-ready in 8-14 weeks. The certification audit itself usually takes 1-3 days depending on organization size.

OSCAL (Open Security Controls Assessment Language) is an open standard developed by NIST for representing security controls and assessments in a machine-readable format. Audit41 uses OSCAL-aligned templates to ensure control mappings and evidence documentation are structured, auditor-readable, and portable across frameworks.

SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága) is the Hungarian supervisory authority responsible for NIS2 enforcement. Organizations in scope must register with SZTFH, maintain an ISMS, and undergo regular audits by SZTFH-approved auditors. SZTFH has been actively enforcing audit obligations since late 2025. Audit41 Readiness uses an SZTFH-aligned methodology.