Take control of your security risks

GRC platform for risk management and compliance

Comply with ISO 27001, NIS2, GDPR and the Norwegian Digital Security Act with a management system built on real risk assessments. Developed by information security researchers and advisers who can also do the work with you.

Book a demo

See the platform

Hands typing on a laptop, with padlock icons connected in a network

Take control of your security risks

GRC platform for risk management and compliance

Comply with ISO 27001, NIS2, GDPR and the Norwegian Digital Security Act with a management system built on real risk assessments. Developed by information security researchers and advisers who can also do the work with you.

Book a demo

See the platform

Hands typing on a laptop, with padlock icons connected in a network

Take control of your security risks

GRC platform for risk management and compliance

Comply with ISO 27001, NIS2, GDPR and the Norwegian Digital Security Act with a management system built on real risk assessments. Developed by information security researchers and advisers who can also do the work with you.

Book a demo

See the platform

Hands typing on a laptop, with padlock icons connected in a network

Take control of your security risks

GRC platform for risk management and compliance

Comply with ISO 27001, NIS2, GDPR and the Norwegian Digital Security Act with a management system built on real risk assessments. Developed by information security researchers and advisers who can also do the work with you.

Book a demo

See the platform

Hands typing on a laptop, with padlock icons connected in a network

A complete GRC platform for risk, compliance and privacy

Most tools help companies pass audits. Cyrigo is a SaaS platform that helps organisations understand and control their business and security risks.

Governance and compliance

ISO 27001, NIS2, the Digital Security Act, DORA and more

Cross-mapping, so evidence is reused across frameworks

Policies, incidents, deviations and reports for management and auditors

Supported frameworks →

Privacy and GDPR

Record of processing activities (ROPA) linked to systems and vendors

Pre-DPIA and data protection impact assessments (DPIA)

Transfer impact assessments (TIA) and legitimate interest balancing tests

ROPA and DPIA →

Risk management

Operational and cyber risk in one risk register

Asset, threat and vulnerability assessments, combined with our bow-tie method

Treatments with owners, deadlines and follow-up

Bow-tie risk assessment →

A complete GRC platform for risk, compliance and privacy

Most tools help companies pass audits. Cyrigo is a SaaS platform that helps organisations understand and control their business and security risks.

Governance and compliance

ISO 27001, NIS2, the Digital Security Act, DORA and more

Cross-mapping, so evidence is reused across frameworks

Policies, incidents, deviations and reports for management and auditors

Supported frameworks →

Privacy and GDPR

Record of processing activities (ROPA) linked to systems and vendors

Pre-DPIA and data protection impact assessments (DPIA)

Transfer impact assessments (TIA) and legitimate interest balancing tests

ROPA and DPIA →

Risk management

Operational and cyber risk in one risk register

Asset, threat and vulnerability assessments, combined with our bow-tie method

Treatments with owners, deadlines and follow-up

Bow-tie risk assessment →

A complete GRC platform for risk, compliance and privacy

Most tools help companies pass audits. Cyrigo is a SaaS platform that helps organisations understand and control their business and security risks.

Governance and compliance

ISO 27001, NIS2, the Digital Security Act, DORA and more

Cross-mapping, so evidence is reused across frameworks

Policies, incidents, deviations and reports for management and auditors

Supported frameworks →

Privacy and GDPR

Record of processing activities (ROPA) linked to systems and vendors

Pre-DPIA and data protection impact assessments (DPIA)

Transfer impact assessments (TIA) and legitimate interest balancing tests

ROPA and DPIA →

Risk management

Operational and cyber risk in one risk register

Asset, threat and vulnerability assessments, combined with our bow-tie method

Treatments with owners, deadlines and follow-up

Bow-tie risk assessment →

Compliance frameworks: ISO 27001, NIS2, GDPR, DORA and more

Activate a framework and start with a ready set of tasks, policies, controls and risk assessments. We add new frameworks continuously.

ISO/IEC 27001

NIS2

Digital Security Act

GDPR

DORA

AI Act

SOC 2

NIST

Security and privacy for small businesses

See all frameworks →

Your data stays in Scandinavia

ISO 27001-certified data centre

In Denmark, not on a US cloud platform.

Encrypted backups

Daily encrypted copies, stored separately in Norway.

Developed in Norway

By the same team that advises you.

You decide on AI

We never send your data to AI services unless you choose to.

Read our security overview →

Get an overview of your tasks
and delegate

The system to get a good overview to follow up on tasks. You can connect tasks to frameworks or resources, or simply use it for any tasks you want.

Cyrigo platform dashboard with shortcuts to each module and a task list

Get an overview of
your tasks and
delegate

The system to get a good overview to follow up on tasks. You can connect tasks to frameworks or resources, or simply use it for any tasks you want.

Cyrigo platform dashboard with shortcuts to each module and a task list

Get an overview of your tasks and delegate

Our task management system allows you to delegate and follow up on tasks. You can connect tasks to frameworks or resources,

or simply use it for any tasks you want.

Cyrigo platform dashboard with shortcuts to each module and a task list

GRC platform features

1

Shared registers

Register systems, vendors, assets and processes once. Risk, privacy and compliance all build on them.

2

Pre-assessments

Score vendors, IT systems and AI systems for risk and business impact, and see what needs a full risk assessment.

3

Owners and notifications

Give every treatment and task an owner and a deadline. Notifications keep the follow-up on track.

4

Audit trail

Exclusions, gaps and risk acceptances are logged with a justification, a name and a timestamp.

5

Reports and dashboards

Dashboards and ready-made reports for management and auditors. Export your data at any time.

6

Group and units

Mirror your group, subsidiaries and departments, with an overview across all units.

7

Secure access

Role-based access, single sign‑on with Microsoft Entra ID, and multi-factor authentication.

8

Bring your own AI

Connect your own AI assistant through our MCP server. You decide whether and how AI is used on your data.

9

Norwegian and English

The platform is available in both Norwegian and English.

GRC platform features

1

Shared registers

Register systems, vendors, assets and processes once. Risk, privacy and compliance all build on them.

2

Pre-assessments

Score vendors, IT systems and AI systems for risk and business impact, and see what needs a full risk assessment.

3

Owners and notifications

Give every treatment and task an owner and a deadline. Notifications keep the follow-up on track.

4

Audit trail

Exclusions, gaps and risk acceptances are logged with a justification, a name and a timestamp.

5

Reports and dashboards

Dashboards and ready-made reports for management and auditors. Export your data at any time.

6

Group and units

Mirror your group, subsidiaries and departments, with an overview across all units.

7

Secure access

Role-based access, single sign‑on with Microsoft Entra ID, and multi-factor authentication.

8

Bring your own AI

Connect your own AI assistant through our MCP server. You decide whether and how AI is used on your data.

9

Norwegian and English

The platform is available in both Norwegian and English.

GRC platform features

1

Shared registers

Register systems, vendors, assets and processes once. Risk, privacy and compliance all build on them.

2

Pre-assessments

Score vendors, IT systems and AI systems for risk and business impact, and see what needs a full risk assessment.

3

Owners and notifications

Give every treatment and task an owner and a deadline. Notifications keep the follow-up on track.

4

Audit trail

Exclusions, gaps and risk acceptances are logged with a justification, a name and a timestamp.

5

Reports and dashboards

Dashboards and ready-made reports for management and auditors. Export your data at any time.

6

Group and units

Mirror your group, subsidiaries and departments, with an overview across all units.

7

Secure access

Role-based access, single sign‑on with Microsoft Entra ID, and multi-factor authentication.

8

Bring your own AI

Connect your own AI assistant through our MCP server. You decide whether and how AI is used on your data.

9

Norwegian and English

The platform is available in both Norwegian and English.

Common questions

What is a GRC platform?

A GRC platform (governance, risk and compliance) gathers risk assessments, controls, policies and evidence for frameworks like ISO 27001 and NIS2 in one place. You follow up actions and can show the auditor how each requirement is met. Cyrigo starts with the risk assessment, so compliance follows from real risk work.

We use Excel and SharePoint. Why change?

Spreadsheets work until several people, suppliers and frameworks are involved. Then versions drift, actions go unfollowed and the same evidence is collected twice. Cyrigo keeps risks, systems, suppliers and controls connected, so a change in one place shows everywhere it matters. You can upload your existing risk assessments to get started.

Where is our data stored?

In Scandinavia: in an ISO 27001-certified data centre in Denmark, with daily encrypted backups stored separately in Norway. The platform does not run on a US cloud provider, all access is logged, and we never send your data to AI services unless you choose to. We use Microsoft 365 for our own email and office work, and list every subprocessor in our privacy policy.

We don’t have a security team. Can we still use Cyrigo?

Yes. You can start with one of our GRC consultants working in the platform with you, as CISO as a Service or for a fixed ISO 27001 or NIS2 package. When the consultant steps back, everything is documented and you carry on yourselves.

Does Cyrigo cover the Digital Security Act?

Yes. The Norwegian Digital Security Act is one of the frameworks in Cyrigo, next to NIS2 and ISO 27001. Evidence you collect for one is reused for the others, so you don’t document the same control twice.

See Cyrigo with your own frameworks

We show you the platform with the frameworks you work with, and answer your questions about method and expert support.

Book a demo

Proud member of

Norwegian Cybersecurity Cluster
NORCICS – Norwegian Centre for Cybersecurity in Critical Sectors
Cyrigo logo

We are a SaaS built for governance, risk management and compliance

CONTACT

Get in Touch

Support

TERMS

Terms of Service

Privacy Policy

SECURITY

Security Overview

© 2026 Cyrigo AS. All rights reserved.

Cyrigo logo

We are a SaaS built for governance, risk management and compliance

CONTACT

Get in Touch

Support

TERMS

Terms of Service

Privacy Policy

SECURITY

Security Overview

© 2026 Cyrigo AS. All rights reserved.

Cyrigo logo

We are a SaaS built for governance, risk management and compliance

CONTACT

Get in Touch

Support

TERMS

Terms of Service

Privacy Policy

SECURITY

Security Overview

© 2026 Cyrigo AS. All rights reserved.