Information Security
DocSetMinder ONE (ISMS)
EU-Made Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Allgeier CyRis GmbH · www.allgeier-cyris.de
Report an error on this page Is this your product? →
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
DocSetMinder ONE from Allgeier CyRis GmbH is presented as one integrated management system bundling BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and EU-DSGVO — and that bundling sentence is the substance of the public record. Framework coverage is the strongest criterion, with scores clustering at 4. Weakest are audit readiness, clustering at 1, and integrations and automation at 0 to 1: we found no public information on evidence collection, revision-safe change history, an API or any connector. Information security management runs 1 to 2 and controls and statement of applicability 1 to 2, with no public information on risk methodology, asset inventory or statement-of-applicability generation. Sovereignty scores spread 2 to 3: the imprint documents a German GmbH at Amtsgericht Bremen, while we found no public information on where the product is hosted or on its data-processing terms — the higher scores weigh the entity, the lower ones that silence. Prices are unpublished; the route to a number is an email address and a phone number.
Speaks for it
- Bundles the German-market core — BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and EU-DSGVO — into one integrated management system.
- Framework coverage is the strongest criterion in this verdict, with scores clustering at 4.
- The vendor is a Germany-registered GmbH — Allgeier CyRis GmbH, Amtsgericht Bremen, HRB 37552 HB — within the Allgeier group.
- A data protection officer with a published contact stands behind the vendor.
- NIS-2 consulting and incident response as a managed service are offered by the same vendor alongside the software.
Held against it
- We found no public information on asset inventory, risk methodology, treatment tracking or incident workflows with statutory reporting clocks.
- We found no public information on control catalogs, statement-of-applicability generation or measures with owners and due dates; controls and statement of applicability scores run 1 to 2.
- Audit readiness scores cluster at 1, with no public information on evidence collection, auditor-facing reports or revision-safe change history.
- Integrations and automation scores run 0 to 1, with no public information on an API, connectors, directory or CMDB import.
- We found no public information on where the product is hosted, on a product data-processing agreement or on product subprocessors; the captured privacy policy covers the vendor's website, documenting Google Analytics and possible Microsoft transfers to the USA under standard contractual clauses and the Data Privacy Framework.
Best for
- You are building a German-market management system and want BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and the GDPR bundled in one system rather than stitched from separate tools.
- You want a vendor with a German legal home — Allgeier CyRis GmbH at Amtsgericht Bremen — and are prepared to ask the vendor directly about product hosting and processing terms.
- You would rather source software, NIS-2 consulting and managed incident response from one vendor group than from separate suppliers.
Avoid if
- You need NIS-2 obligations handled as product capability — the vendor offers NIS-2 as a consulting engagement from implementation to ongoing operations, not as product content.
- You need incident handling with statutory reporting clocks inside the tool — incident response is sold as a managed service with retainers via the vendor's managed-service arm.
- You must form a budget from published prices before contacting vendors — this vendor publishes none, and the public route to a figure is an email address and a phone number.
- You need to see control catalogs, statement-of-applicability workflows and audit evidence before committing — the public product page is a single sentence on bundled standards.
The scores
Asset & risk management depth
Show reasoningHide reasoning
How this is scored
The ISMS core: asset inventory, risk methodology (identification, assessment, treatment), protection-needs inheritance, incident handling with statutory clocks.
0 — No ISMS substance; "information security" is a chapter in the marketing site.
3 — A flat risk list and an asset spreadsheet import; no treatment tracking, no inheritance, incidents live in the ticket system.
5 — Asset and risk management with configurable matrices and treatment tracking; basic incident handling; inheritance and aggregation need manual work.
8 — A real risk backbone: documented methodology (ISO 27005 or equivalent), inherited protection needs across asset relations, incident workflows with statutory reporting clocks (NIS2 24h/72h), risk acceptance with ownership.
10 — Risk management a certifier works inside: complete asset-risk-treatment chain with inheritance, continuity planning, incident reporting with authority export, and risk reporting the executive level actually reads.
The CISO
The product is positioned as an integrated management system bundling BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and the GDPR, which is one step above a marketing chapter — but we found no public information on asset inventory, risk methodology, treatment tracking, protection-needs inheritance, or incident workflows with NIS2 reporting clocks. Incident response appears only as a managed service from the vendor's MSSP arm, not as product functionality. For my certificate, this is positioning without an evidenced risk backbone. 2 7 8
The GRC Consultant
DocSetMinder ONE is described as one integrated management system bundling BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and the GDPR, but the captured pages never show a risk methodology, asset inventory, treatment tracking or protection-needs inheritance. Incident response appears as a managed service retainer, not as product workflows with statutory reporting clocks, so the risk backbone is a claim rather than something I can put twelve clients on. 2 7 8
The Drafted IT Officer
The product page promises one integrated management system bundling IT-Grundschutz, ISO 27001, business continuity per BSI 200-4 and the GDPR, but I found no public information on asset inventory, risk methodology or treatment tracking inside the tool. Incident response appears as a managed service from their security team rather than a product workflow with the NIS2 reporting clocks I would personally answer for. From these pages I cannot tell what I would actually operate day to day. 2 7 8
The Lead Auditor
DocSetMinder ONE is presented as an integrated management system bundling BSI IT-Grundschutz, ISO 27001, BCM nach BSI 200-4 and DSGVO, and incident response is offered as a managed service — but we found no public information on asset inventory, a documented risk methodology, treatment tracking, protection-needs inheritance, or NIS2 reporting clocks as product capabilities. The incident side I can see is a consulting retainer, not an evidenced workflow inside the ISMS. 2 7 8
The Evidence Integrator
The product page's one sentence positions DocSetMinder ONE as an integrated management system bundling BSI IT-Grundschutz, ISO 27001, BSI 200-4 continuity and GDPR — and that is the whole of the captured substance. We found no public information on asset inventory, a risk methodology, protection-needs inheritance, treatment tracking or incident workflows with statutory clocks; the incident response offer is a managed service with retainers, not a product module. 2 7 8
The Skeptic
The whole public product story is a single sentence: an integrated management system bundling BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and EU-DSGVO. We found no public information on asset inventory, risk methodology, treatment tracking, inheritance, or incident workflows with statutory clocks — incident response appears only as a managed service from the vendor's security-operations side and NIS-2 only as consulting. A named bundle of standards is not a risk backbone. 2 7 8
Controls, SoA & measures
Show reasoningHide reasoning
How this is scored
Control catalogs, statement of applicability, measure tracking and internal audit — whether the control side of the ISMS is operable or a checklist.
0 — A static control checklist; applicability, implementation status and evidence are the consultant's spreadsheet.
3 — Control catalogs with status fields, but no SoA generation, no measure ownership, no link between controls and risks.
5 — Controls linked to risks and measures with owners and due dates; SoA producible with manual assembly; internal audit supported by checklists.
8 — SoA on demand from live control status, measure tracking with delegation and escalation, internal audit workflows with findings management, controls carrying their own evidence.
10 — The control fabric as a living system: catalog updates versioned, SoA always current, audit programs with recurring schedules, and every control answerable with linked evidence at any moment.
The CISO
Supporting Grundschutz and ISO 27001 implies control content, but we found no public information on statement-of-applicability generation, measure ownership with due dates, or any link between controls and risks. The certifications-and-audits page describes consulting services, which is the consultant's side of the ISMS, not the system's. 2 8 10
The GRC Consultant
The only control-side evidence is the list of bundled standards; we found no public information on control catalogs, statement-of-applicability generation, measure ownership with due dates, or internal audit workflows in the product. As it stands, the control fabric would live in a consultant's spreadsheet, which is exactly what I will not buy. 2 8
The Drafted IT Officer
The captured pages name the standards the system bundles and stop there — I found no public information on control catalogs, a statement of applicability, or measures with owners and due dates. With nothing showing how controls connect to risks, I would end up rebuilding the consultant's spreadsheet myself, which defeats the reason for buying. 2 8
The Lead Auditor
Bundling IT-Grundschutz and ISO 27001 into one management system implies control documentation, but we found no public information on statement-of-applicability generation, measure ownership and delegation, control-to-risk linkage, or internal audit workflows with findings management. Nothing in the captured pages evidences a live control status behind that integrated-system claim. 2 8
The Evidence Integrator
The bundled standards imply control content exists somewhere, but we found no public information on control catalogs, statement-of-applicability generation, measure ownership or internal audit workflows. The only related item is a certifications-and-audits page under the vendor's services, with no product detail captured. 2 8 10
The Skeptic
Beyond the bundling sentence we found no public information on control catalogs, statement-of-applicability generation, measure ownership with due dates, or internal audit support — nothing shows a control carrying status or evidence inside the product. Framework logos carrying the entire control story is precisely what I discount. 2 8
Framework & standard coverage
Show reasoningHide reasoning
How this is scored
Which regimes the product actually operationalizes — ISO 27001, NIS2, TISAX/VDA ISA, DORA, BSI IT-Grundschutz, SOC 2 — and whether one control maps across them or each framework is a fresh island.
0 — One framework, hard-coded; anything else is "on the roadmap".
3 — Two or three frameworks as separate checklists; the same control is answered once per framework.
5 — The major regimes for its market with partial cross-mapping; newer regimes (NIS2, DORA) present as content packs of varying depth.
8 — Broad current coverage including NIS2/TISAX/DORA where relevant, one-control-many-frameworks mapping, and visible maintenance as regimes evolve.
10 — Framework coverage as a living product: dozens of regimes, genuine multi-compliance mapping on one data basis, per-industry profiles, and documented update cadence when the standard moves.
The CISO
Four regimes are named for one integrated management system — the classic German stack of BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and the GDPR — which sits above separate checklists. NIS2 appears only as a consulting engagement rather than product content, and we found no public information on cross-framework mapping, TISAX, DORA or update cadence as standards move. 2 8 9
The GRC Consultant
Four regimes for the German market — BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and the GDPR — are claimed inside one integrated management system, which is a fair base set. NIS-2 appears only as a consulting engagement rather than product content, and we found no public information on TISAX, DORA, SOC 2 or any one-control-many-frameworks mapping; if the same control must be answered once per regime, client twelve never gets cheaper than client one. 2 8 9
The Drafted IT Officer
Four regimes — BSI IT-Grundschutz, ISO 27001, business continuity per BSI 200-4 and the GDPR — are claimed inside one integrated management system, which is a reasonable base for the German market. NIS2 appears only as a consulting engagement, and I found no public information on TISAX, DORA or SOC 2 coverage. Nothing captured says whether one control answer serves several frameworks or each regime is a separate questionnaire. 2 8 9
The Lead Auditor
Four regimes are named — BSI IT-Grundschutz, ISO 27001, BCM nach BSI 200-4 and DSGVO — which covers the German market's majors in one claimed-integrated system. NIS2, however, appears only as a consulting offering rather than product content, and we found no public information on cross-framework mapping or on TISAX, DORA or SOC 2. 2 8 9
The Evidence Integrator
Four regimes are named as bundled into one integrated system — BSI IT-Grundschutz, ISO 27001, BSI 200-4 business continuity and GDPR — which is the core German-market set. NIS2 appears only as a consulting offer rather than product content, and we found no public information on DORA, cross-framework mapping, or how catalogs are kept current as regimes evolve. 2 8 9
The Skeptic
Four regimes are named as bundled into one management system — BSI IT-Grundschutz, ISO 27001, BCM per BSI 200-4 and EU-DSGVO — which covers the German-market majors at headline level. But we found no public information on whether one control answer maps across frameworks, and NIS-2 surfaces only as a consulting engagement rather than product content; we found no public information on DORA, TISAX or SOC 2 in the captured pages. 2 8 9
Audit readiness & evidence
Show reasoningHide reasoning
How this is scored
Whether the system produces defensible proof: revision-safe history, evidence collection, reports for auditors, authorities and management.
0 — Exports are screenshots; history is overwritten in place.
3 — PDF reports exist but evidence is attached ad hoc and changes leave no reliable trail.
5 — Versioned records, standard report generators, evidence attachments per control; assembling a full audit file still takes days.
8 — Revision-safe change history, audit-scoped evidence packs on demand, management reports current at a click, auditor access roles.
10 — Audit readiness as a standing state: continuous evidence status per framework and scope, exportable proof packs an external auditor accepts as-is, and a defensible answer to "show me the state on date X".
The CISO
We found no public information on revision-safe change history, evidence collection, or auditor- and authority-facing reporting in the product; the captured pages describe services and a standards list only. Nothing visible can answer "show me the state on date X". 2 10
The GRC Consultant
We found no public information on revision-safe change history, evidence collection, auditor access roles or report generation; the only audit-related presence is a certifications-and-audits service page whose captured content describes no product capability. I cannot hand a certification body what the vendor does not show. 2 10
The Drafted IT Officer
Beyond a certifications-and-audits service page, I found no public information on revision-safe history, evidence collection or auditor-ready reports in the product. The product name suggests documentation handling, but nothing captured describes an audit trail or a dated export my certification body would accept. As published, I would have nothing to promise the auditor except a sales conversation. 2 10
The Lead Auditor
We found no public information on revision-safe change history, evidence collection per control, audit-scoped evidence packs or auditor access roles for the product. A certifications-and-audits service exists in the vendor's portfolio, but that is a human service relationship, not demonstrated product capability for answering "show me the state on date X". 2 10
The Evidence Integrator
We found no public information on revision-safe change history, evidence collection per control, audit-scoped report packs, auditor access, or point-in-time reconstruction. The only audit-adjacent items are a certifications-and-audits service page and an incident response service promising traceable results — services, not evidenced product capability. 2 7 10
The Skeptic
A certifications-and-audits page exists on the vendor's site, but the captures confirm nothing of its content, and we found no public information on revision-safe change history, evidence collection, or auditor- and authority-facing reports for the product. The existence of a page is not a capability; nothing here shows the software producing defensible proof. 2 10
Integrations & automation
Show reasoningHide reasoning
How this is scored
Whether the platform feeds from the real IT estate — directory import, CMDB, ticketing, scanners, API — and automates evidence collection instead of re-typing it.
0 — A closed island: manual entry in, PDF out, no API.
3 — CSV/Excel import and export; no live connections, no API worth the name.
5 — Directory import (AD/Entra), a documented REST API for core objects, a handful of native connectors (ticketing, CMDB or SSO); automation is reminders and recurrence.
8 — Real connector set (Jira/ServiceNow-class ticketing, CMDB, cloud and endpoint sources), webhooks, SSO/SCIM, automated evidence tests with human review.
10 — The platform behaves like infrastructure: API parity for the data model, event streams, continuous control monitoring against the live estate, and automation that measurably removes the recurring toil rather than renaming it.
The CISO
We found no public information on an API, directory import, CMDB, ticketing or scanner connectors, or automated evidence collection. The captured product pages describe standards and services only, so a live feed from the real IT estate cannot be assessed from public information. 2 8
The GRC Consultant
We found no public information on a REST API, directory or CMDB import, ticketing connectors, webhooks or automated evidence collection for the platform. An ISMS that cannot feed from the real IT estate makes my clients re-type their estate, so this silence weighs heavily. 2
The Drafted IT Officer
I found no public information on any integration — no directory import, no ticketing connector, no API, not even a file import mentioned. For someone running the ISMS alongside the day job, a closed island means retyping my whole estate by hand, and nothing published suggests otherwise. 2
The Lead Auditor
We found no public information on an API, directory or CMDB import, ticketing connectors, SSO, or automated evidence collection for DocSetMinder ONE. The captured pages describe standards and services, not connections to a live IT estate. 2 8
The Evidence Integrator
We found no public information on an API, directory, CMDB, ticketing, scanner or SSO connections, nor on any automated evidence collection — the captured product pages say standards are bundled into one system and say nothing about how live data reaches it. As far as the public record shows, this is a data island where every byte is typed by hand. 2 8
The Skeptic
We found no public information on an API, connectors, directory or CMDB import, ticketing links, or automated evidence collection in any of the captured product or company pages. With an integration story entirely unevidenced, this criterion lands at its floor — silence on this front is itself information for a buyer. 2 4
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Where the security posture of the whole company actually lives and under whose law — entity, hosting, subprocessors, DPA. The risk register is itself a target.
0 — Non-EU entity, non-EU-default hosting, no public DPA or subprocessor list — for the system holding your risk register.
3 — A DPA exists and an EU region is available on request or on top tiers; subprocessor exposure to US CLOUD Act reach is broad or undocumented.
5 — EU hosting is the default, DPA and subprocessor list published; the vendor or a critical subprocessor is still within non-European jurisdictional reach.
8 — EU entity, EU hosting with named data centers, published subprocessor list free of content-touching non-EU processors, DPA and TOMs public.
10 — Jurisdictionally clean end to end: European ownership, EU-only hosting and subprocessors, on-premises or sovereign-cloud options, and the whole chain documented publicly.
The CISO
The imprint establishes a German GmbH — Bremen registry entry, German VAT ID — inside the Allgeier group, which is real jurisdictional ground for the entity. Beyond that we found no public information on product hosting location, a customer data-processing agreement, or product subprocessors; the privacy policy we could see governs the website (Google Analytics, Microsoft CRM) rather than the system that would hold my risk register. 4 5 6
The GRC Consultant
A German GmbH with Bremen registry, address and VAT ID is confirmed from the imprint, a solid start for the keeper of a risk register. But we found no public information on where DocSetMinder ONE itself is hosted, on a product DPA and TOMs, or on subprocessors for the product, while the vendor's site privacy policy discloses Google Analytics and possible Microsoft transfers to the USA under standard contractual clauses and the Data Privacy Framework. 5 6
The Drafted IT Officer
The imprint puts a German company on the commercial register in Bremen inside the Allgeier group, which is the right neighbourhood for the system holding my risk register. But I found no public information on where the product itself is hosted, or on a DPA or subprocessor list for it — the only privacy statement captured covers the marketing website, which uses Google Analytics and a Microsoft arrangement with possible US transfer. The product's own chain is undocumented as far as these pages go. 4 5 6
The Lead Auditor
The imprint documents a German GmbH with a Bremen registry entry, German VAT ID and an in-house data protection officer, and the company sits in the Allgeier group — but we found no public information on where the management system itself is hosted, on a product data processing agreement, or on the subprocessors behind the product. For the system that would hold a customer's risk register, that silence matters, and the vendor's own web estate runs Google Analytics and Microsoft with US transfer clauses via the Data Privacy Framework. 4 5 6
The Evidence Integrator
The imprint confirms a German GmbH registered at the Bremen court with a German VAT number — the right home jurisdiction for a system holding your risk register. But we found no public information on where the ISMS itself is hosted, a product data-processing agreement, or a product subprocessor list; the website privacy policy documents Microsoft processing under standard contractual clauses plus the Data Privacy Framework, and Google Analytics, for the vendor's own marketing stack. 5 6
The Skeptic
The imprint confirms a German entity — Allgeier CyRis GmbH, registered at Amtsgericht Bremen with a Bremen address — which is the one solid European fact. We found no public information on where the management system itself is hosted, on a product data-processing agreement, or on a subprocessor list for it; the published privacy policy covers the website and documents Google Analytics plus Microsoft processing with contemplated US transfers on standard contractual clauses. An EU flag on the letterhead does not tell a buyer under whose law the risk register sits. 5 6 2
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real invoice — per module, per entity, per year, with consulting unbundled — from public pages alone. Unpublished pricing is the B2B norm in this market, so this criterion describes rather than condemns; the benches weight it accordingly.
0 — No public prices at all; every configuration is a sales conversation.
3 — An entry price exists, but module add-ons, scale steps or bundled consulting make the real total incomputable.
5 — Most editions carry real numbers with billing period stated and software separated from services; at least one commonly needed module or scale step is unpriced.
8 — Every edition and module priced publicly with entity/user boundaries and setup fees stated; only genuine corporate-group contracts are custom.
10 — Complete price computability: modules, scale steps, service packages and renewal rules public, so the invoice for a 100-employee company and a certification project is a two-minute exercise.
The CISO
We found no public prices on any captured page — no editions, no modules, no user or entity steps, no separation of software from consulting. From public information alone, a buyer cannot compute any part of the real invoice; unpublished pricing is the norm in this market and the bottom of pricing transparency describes exactly that. 2 8
The GRC Consultant
We found no public prices at all — no edition, module, user or service figure on the product pages, so every configuration is a sales conversation. Unpublished pricing is the norm in this market, but a buyer cannot compute even the software share of a certification project from these pages. 2
The Drafted IT Officer
I found no public information on pricing — no editions, modules or figures on the product page, only an info email and a phone number as commercial contact. Every real invoice would be a negotiation, so budgeting a certification project from published pages is impossible. Normal for this market, but a buyer gets nothing usable here. 2 5
The Lead Auditor
The captured product pages name no prices, editions or billing periods, and we found no public pricing information anywhere else in the captured material. With consulting sold alongside the software and equally unpriced, a real invoice is not computable from public pages. 2 8
The Evidence Integrator
We found no public prices, editions, modules or billing periods anywhere in the captured pages; the route to a number is the imprint's email address and phone number. A buyer cannot compute any part of the invoice from public information. 2 5
The Skeptic
We found no public information on pricing — no editions, modules, user tiers, billing periods or figures in any captured page, so a buyer cannot compute even a starting invoice. The surrounding offering is consulting-shaped (NIS-2 consulting, incident response as managed service), and the captures give no separation of software price from services. 2 9
European sovereignty — proven facts
0 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined | — | uncited Report an error |
| Subprocessors | Not determined | — | uncited Report an error |
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 15 Sep 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Legal entity. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We could not confirm any pricing information on the vendor’s own pages as captured, so this page shows none rather than a statement we cannot stand behind. Know more? Tell us
- 78 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 13 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 5 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 4 support facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (10)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.allgeier-cyris.de Checked 15 Sep 2026 Details →
- 2 Product page www.allgeier-cyris.de Checked 15 Sep 2026 Details →
- 3 Information security services page www.allgeier-cyris.de Checked 15 Sep 2026 Details →
- 4 About page www.allgeier-cyris.de Checked 15 Sep 2026 Details →
- 5 Imprint www.allgeier-cyris.de Checked 15 Sep 2026 Details →
- 6 Privacy policy www.allgeier-cyris.de Checked 30 Sep 2026 Details →
- 7 Asset & risk management depth — found from sitemap www.allgeier-cyris.de Checked 1 Oct 2026 Details →
- 8 Asset & risk management depth — found from sitemap www.allgeier-cyris.de Checked 1 Oct 2026 Details →
- 9 Framework & standard coverage — found from sitemap www.allgeier-cyris.de Checked 1 Oct 2026 Details →
- 10 Audit readiness & evidence — found from sitemap www.allgeier-cyris.de Checked 1 Oct 2026 Details →