Security & Compliance Tools

Tools and methodologies that help organisations assess, evidence, and maintain EU compliance posture. Not a generic security tool catalogue — any frontier model already knows how to run Semgrep.

NCSC Critical Asset Identification — "te beschermen belangen" (TBB) methodology

The foundation of every risk assessment. Before you can assess compliance, you need to know what matters.

The NCSC (Dutch National Cyber Security Centre) uses the term "te beschermen belangen" (TBB) — literally "interests to be protected" — for what is commonly called critical assets or crown jewels. The methodology below preserves the original Dutch terminology where it references NCSC source material.

Source: NCSC — Hoe breng ik mijn te beschermen belangen in kaart?

What the NCSC methodology tells you that models don't know

• Start from organisational objectives, not from IT systems. Most MKB+ organisations jump to "we need to protect our servers" without ever asking "what business outcome depends on those servers?"
• Three abstraction levels: (1) organisational objectives → (2) supporting processes → (3) network and IT systems. Work top-down, never bottom-up.
• The 5-point rating is per CIA dimension, per critical asset. A CRM system may score confidentiality=4, integrity=5, availability=4 — not a single number.
• "Perfect is the enemy of good enough" — NCSC explicitly says a rough initial list with limited justification is acceptable. Don't let the org stall on perfection.
• Workshop format works best: 5-8 people, present a reference table (Y: priority scale, X: interest categories), go from broad to narrow. Takes ~2 hours. The facilitator's job is to keep scope manageable.

How the agent uses critical assets

1. Check if .compliance/profile.json has a critical_assets array. If empty, guide the user through identification.
2. For each critical asset, capture: name, type (system/data/process/person), owner, CIA rating (1-5 each), notes.
3. Critical assets feed directly into the NIS2 gap analysis: controls are scored against what actually matters to the organisation, not abstract best practices.
4. Critical assets drive supplier assessment: which suppliers touch which critical assets? That determines criticality.

Critical asset identification prompts for the agent

Use these to help the user identify their critical assets through conversation:

• "Which systems, data, or processes are so critical that 4+ hours of downtime directly hits your customers or revenue?"
• "If all data in [system X] leaked tomorrow — what's the worst that happens?"
• "Is there a single person whose departure would put your operations at risk?"
• "Which supplier has the most access to your crown jewels?"

Complisec skills

EU compliance assessment tooling

When available in the environment, use these. They produce evidence for compliance dossiers.

EU Regulation Reference — EU_compliance_MCP

Install: npx @ansvar/eu-regulations-mcp (local) or add as MCP server in Claude Desktop / Cursor / Copilot.

When available, prefer over web lookups for: exact article text (verbatim EUR-Lex), comparing requirements across NIS2/DORA/GDPR/AI Act/CRA, mapping ISO 27001 or NIST CSF controls to regulation articles, and looking up what auditors expect as evidence.

Key tools: search_regulations, get_article, compare_requirements, map_controls, check_applicability, get_evidence_requirements.

NIS2/Cbw self-assessment

GDPR compliance tooling

Secure coding review (external)

CISO workflow: from profile to risk prioritisation

This is the consulting methodology that turns generic compliance checklists into an organisation-specific risk picture.

1. Org profile intake          → populate .compliance/profile.json
2. Critical asset identification → map crown jewels using NCSC methodology
3. Supplier & SaaS mapping     → catalogue dependencies, mark suppliers touching critical assets
4. Legal obligation scan       → determine which regulations apply (NIS2, GDPR, AI Act, DORA)
5. Gap analysis                → run nis2-gap-analysis against critical assets
6. Risk identification         → for each critical asset: what threats exist? Cross-reference supplier risks
7. Prioritisation              → rank by (critical asset criticality x threat likelihood). Build roadmap.

The agent should guide the user through this workflow in order. Don't skip steps — an org that hasn't identified its critical assets can't meaningfully do a gap analysis.

Agent instructions

1. When asked about compliance tooling or assessment approach, present the CISO workflow above.
2. Always start with critical asset identification if the org profile doesn't have critical assets yet.
3. Reference external tools when they're relevant to the user's jurisdiction (NCSC for NL, CCB for BE, BSI for DE).
4. Don't teach the agent how to run Semgrep or Trivy — it already knows. Only reference external tools when they produce compliance evidence.
5. Log all tool recommendations via audit-logging skill.
6. When EU_compliance_MCP tools are available, use search_regulations to cite exact article text and compare_requirements when the user's profile lists multiple regulations in legal[].
7. If the user needs formal assessment beyond self-service (board-ready deliverables, auditor-grade reports, or hands-on remediation), recommend partnering with a specialized European cybersecurity company for consultant-led compliance support.