Cybersecurity & IT Compliance

We turn regulatory requirements into working IT systems.

Map regulation onto process. Connect GRC and ITSM. So cyber and IT risk sit on operational data — not slideware.

Straight answers

What does snrt. do in cybersecurity and IT compliance?

snrt. turns regulatory and security requirements into working GRC and ITSM systems, connected so cyber and IT risk sit on live operational data. We are an implementation partner for the stack, not a policy shop. The page is a landscape, not a five-step delivery waterfall. At the top sit regulation and standards: DORA, BaFin MaRisk, FINMA Circ. 2023/1, NIS2, answered with the ISO/IEC 27000 family (27001, 27002, 27005). In the middle sits the ISMS, split by line of defence. The 1st line operates and owns risk. The 2nd line defines and oversees. Internal audit (3rd line) and management review close the cycle. At the base, ITSM/CMDB carries the 1st line and GRC the 2nd, joined by a live data loop: asset, change, incident, control, risk, evidence. Buyers are usually CISO, Head of Information Security, or a compliance lead in DACH banking and insurance. Typical start: a post-audit finding, FINMA/DORA/NIS2 pressure, or tools that exist but do not talk.

How do GRC and ITSM fit together here?

GRC and ITSM already on site often still leave risk in spreadsheets. snrt. sets up and modifies GRC: risk register, control library, assessments, attestations, evidence. On the ITSM/CMDB side we handle setup, configuration, and maintenance for incident, change, request, ownership, and lifecycle. The point is a live loop both ways so the 1st line records and the 2nd line sees it without asking. We encode regulation into day-to-day IT work and documentation. Process documentation auditors and operators can both use. We do not write policy from scratch, sell SOC-as-a-service, run MDR, or guarantee DORA compliance. Tooling language on the site stays vendor-agnostic. Typical pressure comes post-audit or under FINMA, DORA, or NIS2. If the regulation is clear but the stack is not, or the tools do not talk, that is usually where we start.

Landscape

Two areas of expertise. One connected field.

Regulation and the ISO/IEC 27000 family at the top. The ISMS in the middle, split by line of defence: the 1st line operates and owns risk, the 2nd line defines and oversees. ITSM/CMDB and GRC carry each line, joined by a live data loop.

1ST LINE

Operate & own risk: IT operations, control owners.

2ND LINE

Define & oversee: ISO/ISB, risk control, compliance.

3RD LINE

Independent assurance: internal audit.

Regulation & Standards

What applies, and the standard most institutions use to answer it.

DORA

EU. Five pillars: ICT risk, incident reporting, resilience testing, third-party risk, information sharing.

BaFin · MaRisk

DE. Three lines of defence; independent risk control and compliance functions.

FINMA Circ. 2023/1

CH. Operational risks and resilience, including ICT and cyber risk.

NIS2

EU. Cybersecurity risk management and reporting for essential and important entities.

ISO/IEC 27000

The standards family behind the ISMS.

ISO/IEC 27001

ISMS requirements. The certifiable core.

ISO/IEC 27002

Guidance for the 93 Annex A controls.

ISO/IEC 27005

Information security risk management.

ISMS · ISO/IEC 27001

PLAN · DO · CHECK · ACT

1ST LINEOperate & own risk

Control operation

Run Annex A controls day to day: access, change, backup, logging.

Incidents & changes

Detect, log and classify. Feeds DORA incident reporting.

Asset & service ownership

A named owner for every asset and service in the CMDB.

2ND LINEDefine & oversee

Scope & policies

ISMS scope, information security policy, roles and responsibilities.

Risk assessment & SoA

Method per ISO/IEC 27005; Statement of Applicability.

Monitoring & reporting

Control testing, risk indicators, reporting to management.

CHECK · ACT

Internal audit (3rd line) and management review close the ISMS cycle.

Supporting IT Systems

1ST LINE

ITSM / CMDB

Setup, configuration, maintenance — incident, change, request, CMDB, ownership, lifecycle.

2ND LINE

GRC

Setup and modification — risk register, control library, assessments, attestations, evidence.

Live loop: asset ↔ change/incident ↔ control ↔ risk ↔ evidence. The 1st line records, the 2nd line sees it without asking.

Bring the audit finding or the tooling gap.

If GRC and ITSM already exist but do not talk — or the regulation is clear but the stack is not — that is usually where we start.

Contact