Vailor: the sovereign AI-native GRC alternative to Probo

With scope, not tooling. List what actually has to be protected: critical activities, customer data, the suppliers who reach into your information system. Then run a first risk assessment over that scope, rough but written down, and let it produce a handful of priority measures rather than a hundred line action plan. The 42 cyber hygiene measures published by ANSSI, the French cybersecurity agency, give a usable baseline for that first pass. Aiming at certification from day one reverses the order: certification validates a programme, it does not create one.

The effort is not evenly spread. The opening phase carries most of the load: defining scope, running the first risk assessment, writing policies, gathering the evidence you already hold. What follows is a maintenance rhythm: reviewing measures, updating the risk register, handling incidents, answering customer questionnaires. That recurring load stays manageable when evidence is captured as work happens, and turns painful when everything has to be rebuilt the week before an audit. In a smaller organisation the subject is almost always part-time work for IT or for management.

Rarely at the outset. Many smaller organisations rely on a fractional CISO, an external consultancy or an internal owner given protected time. What cannot be delegated is the decision itself: accepting a risk, arbitrating a budget, approving a policy. For entities in scope of NIS2, the directive puts approval of the cybersecurity risk-management measures and oversight of their implementation at management body level, and requires those members to be trained. A supplier produces deliverables, it does not carry that accountability for you.

Three sources stack up. The GDPR applies whatever your size: it follows from the personal data you process, not from headcount. NIS2 combines a sector criterion with a size criterion, a medium-sized enterprise under EU rules meaning fifty staff or ten million euros of turnover or balance sheet total, with specific cases named in the directive below that threshold. Then come contractual requirements: security questionnaires, clauses imposed by a large customer, expectations written into a tender. The trigger is often commercial before it is regulatory.

By removing re-entry and by sequencing the work. The AI reads your documents and prefills the risk assessment, in EBIOS RM or in a lighter flash assessment, from cited excerpts: your owner corrects instead of starting from a blank page. Without documents, Vailor organises collection from business teams through simple questions. Risks, action plan measures, controls and evidence stay linked, and reminders flag what is coming due. Every proposal keeps its rationale visible, which is what allows a non-specialist to approve it knowingly rather than on trust.

Through the export, not through a blank slate. What carries over: the risk register, the control catalogue, the evidence already gathered and how it maps to your frameworks, spreadsheets included. Our teams help you rebuild those links inside Vailor, then check with you that each measure points to the requirement and the evidence it should, review dates included. For a small team the real cost of a migration is not technical, it is reading time. Planning it across one audit cycle avoids having to find it under pressure.