Question 1

Why annual commitment only?

Accepted Answer

NIS2 and ISO 27001 compliance is not a one-time event. It is an ongoing programme. An annual commitment reflects how compliance actually works: you assess, remediate, and reassess. Short-term subscriptions encourage checkbox thinking. We built Audit41 Readiness for organisations that are serious about closing their gaps, not just generating a report.

Question 2

Can I pay monthly instead of upfront?

Accepted Answer

Yes. You can pay in 12 monthly instalments. The contractual commitment is still 12 months: you are not paying month-to-month with the option to cancel. The instalment option is a cash flow convenience, not a shorter commitment period.

Question 3

What counts as one framework?

Accepted Answer

Each of NIS2, ISO 27001, and NIST SP 800-53 is one framework. Each project covers one framework. Essentials and Professional include 1 project. Programme includes up to 3 projects, one framework per project. NIS2 country variants (e.g. Hungarian NIS2 vs Danish NIS2) are selected at project level and count as the same NIS2 framework.

Question 4

How does the free rerun work?

Accepted Answer

After completing your initial assessment and working on remediation, you can run the full end-to-end assessment again at no additional cost. The rerun produces a fresh gap report that you can compare directly to your original, showing which gaps were closed, which improved, and which remain. Programme includes one free rerun per project.

Question 5

Can I upgrade mid-term?

Accepted Answer

Yes. You pay the difference between your current plan and the new plan, and the contract term remains the same: it does not restart. So if you are 4 months into an Essentials annual plan and upgrade to Professional, you pay the pro-rated difference for the remaining 8 months.

Question 6

Is the free self-check really free?

Accepted Answer

Yes. The NIS2 Self-Checker (which determines whether your organisation is in scope, your entity type, and which plan fits) is completely free with no credit card required. You only pay when you start a full gap assessment project.

Question 7

What frameworks are supported?

Accepted Answer

At launch: NIS2 (with country-specific variants for all 30 EU+EEA countries), ISO 27001, and NIST SP 800-53. Hungarian NIS2 uses NIST SP 800-53 as its underlying technical framework. Additional frameworks and country variants are added on a rolling basis. Phase 2 adds Belgium and Netherlands NIS2 specifics in July.

Question 8

We already use Vanta or Drata. Why consider Audit41?

Accepted Answer

Vanta and Drata are built for US compliance frameworks (SOC 2, HIPAA). Audit41 is built for EU regulatory context: ISO 27001:2022, NIS2, and their country-level variants. If you are selling into DACH, UK, or Nordics, your enterprise prospects want EU-native certification, not a US-shaped checkbox exercise. At scale, Audit41 is 5–10x less expensive.

Question 9

Will our auditor accept Audit41 output as evidence?

Accepted Answer

Audit41 produces structured evidence: gap assessments, control mappings, documentation, not a certificate. The auditor evaluates your controls, not the tool that organised them. The methodology was developed across 600+ real ISO 27001 and NIS2 audit engagements.

Question 10

We are doing SOC 2 first. Should we wait on ISO 27001?

Accepted Answer

SOC 2 and ISO 27001 controls overlap by approximately 70%. Running them in parallel using Audit41 is faster and cheaper than sequentially. If your enterprise prospects are in Europe, ISO 27001 carries more weight than SOC 2 in most procurement conversations.

Question 11

Our runway is tight. Is this worth the spend?

Accepted Answer

Annual Professional tier is €2,990, roughly €8 per day. If a single enterprise deal has stalled because of missing ISO 27001, the cost of not certifying is already higher. A traditional consultant engagement costs €15,000–50,000 and takes 6–9 months.

Question 12

Do we still need a consultant to get certified?

Accepted Answer

You need an accredited certification body to issue the certificate. Audit41 prepares your team for that audit: structured evidence collection, gap remediation, and control mapping. Many companies complete preparation entirely internally using Audit41 and then engage a certification body directly for the audit itself.

Question 13

How long does it take to go from gap assessment to audit-ready?

Accepted Answer

It depends on your starting point. Companies with existing security practices typically reach audit-ready in 8–14 weeks. Audit41 structures the work so you know exactly what is done, what is pending, and what the auditor will look for.

Question 14

You are significantly cheaper than traditional consultants. What is the catch?

Accepted Answer

There is no catch, only software economics. The methodology is built once and validated across 600+ audit engagements. The annual fee distributes that development cost across the platform. We offer the efficient version, not the compromised one.

Question 15

What is ISO 27001 and why do companies get certified?

Accepted Answer

ISO 27001 is the international standard for information security management systems (ISMS). Companies get certified to demonstrate to customers, partners, and regulators that they manage information security systematically. In practice, ISO 27001 certification is increasingly required by enterprise procurement teams (particularly in DACH, UK, US, and Nordics markets) before they will sign contracts with technology and service vendors.

Question 16

What is NIS2 and who does it apply to?

Accepted Answer

NIS2 (Network and Information Security Directive 2) is EU-wide regulation requiring medium and large organisations in critical and important sectors to implement cybersecurity measures and submit to regular audits. In Hungary, NIS2 was transposed by the 2024. évi LXIX. törvény (Kibertan. tv.). Affected entities must register with SZTFH and undergo periodic audits by SZTFH-approved auditors. Sectors include manufacturing, digital infrastructure, private healthcare, logistics, and waste management.

Question 17

What is the difference between ISO 27001 and NIS2?

Accepted Answer

ISO 27001 is a voluntary international standard. Companies pursue it to meet customer demands or demonstrate security maturity. NIS2 is mandatory EU regulation. Companies in scope have no choice. The two overlap significantly in their control requirements. A company that completes ISO 27001 readiness preparation will have addressed most NIS2 requirements as well. Audit41 Readiness supports both frameworks from a single platform.

Question 18

What is a gap assessment and how does it differ from an audit?

Accepted Answer

A gap assessment identifies the distance between your current security posture and the requirements of a compliance framework. It tells you what evidence you have, what is missing, and what you need to fix before an audit. An audit is a formal examination by an accredited certification body, resulting in a certificate or compliance determination. Audit41 Readiness is a gap assessment tool. It prepares you for an audit but does not conduct or replace the audit itself.

Question 19

How long does ISO 27001 certification typically take?

Accepted Answer

With a traditional consultant: 6–12 months from starting preparation to receiving a certificate. With Audit41 Readiness, companies with existing security practices typically reach audit-ready in 8–14 weeks. The certification audit itself usually takes 1–3 days depending on organisation size.

Question 20

What is OSCAL and why does Audit41 use it?

Accepted Answer

OSCAL (Open Security Controls Assessment Language) is an open standard developed by NIST for representing security controls and assessments in a machine-readable format. Audit41 uses OSCAL-aligned templates to ensure control mappings and evidence documentation are structured, auditor-readable, and portable across frameworks.

Question 21

What is SZTFH and what role does it play in Hungarian NIS2 compliance?

Accepted Answer

SZTFH (Szabályozott Tevékenységek Felügyeleti Hatósága) is the Hungarian supervisory authority responsible for NIS2 enforcement. Organisations in scope must register with SZTFH, maintain an ISMS, and undergo regular audits by SZTFH-approved auditors. SZTFH has been actively enforcing audit obligations since late 2025. Audit41 Readiness uses an SZTFH-aligned methodology.

Frequently asked questions

About Audit41 Readiness

Before you decide

ISO 27001 and NIS2, the basics