The frameworks you answer to, predefined
ISO 27001, NIS2 and a long list beside them arrive with their controls already built. At control level the ids and naming are 1:1 with the standard, so an auditor recognises what they are looking at.
Run your ISMS in one platform
An information security management system is the frameworks you answer to, the controls beneath them and the documentation that proves the work happened. In .legal you run all three in the Frameworks module. We build the plan, not the filling-in.
Unlimited users • Free onboarding and support • No commitment
.jpeg)
.jpg)
.jpg)
.jpg)
-1.png)
.jpeg)
.jpg)
Information security management Meridian's ISMS stopped living in three places at once
Anders Krogh is CISO at Meridian Nordic, an energy company that is an NIS2 essential entity and holds an ISO 27001 certification. His management system used to be a folder of policy documents, a spreadsheet of controls and a calendar of reminders he maintained himself, so the audit was always preceded by a fortnight of reconstruction. Now the frameworks he answers to are switched on in the Frameworks module, the controls sit beneath them with the standard's own numbering, and each control carries the tasks that document it, owned by the colleague who actually does the work. Anders works from the overdue list instead of from memory.
-
ISO 27001 and NIS2 run in the same module, on the same controls and the same body of documentation.
-
Every control carries the tasks that prove it, each with an owner, a frequency and the evidence attached.
-
Framework status moves by itself as colleagues complete their tasks, so nobody maintains a status field.
-
Overdue work is red and at the top, so preparing for an audit starts from a list rather than a scramble.
Information security management Your ISMS is the frameworks and the controls beneath them
An information security management system is not a screen you open. It is the frameworks you answer to, the controls beneath them, and the documentation that shows the work was done, and in .legal all three live in the Frameworks module.
-
Activate ISO 27001, NIS2 or another framework and its controls arrive predefined, 1:1 with the standard at control level.
-
Under each control sit the tasks somebody actually performs, documents and closes.
-
The descriptions and practical tips at task level are .legal's own writing, so the standard's own wording stays where it belongs, at control level.
Information security management We build the plan, not the filling-in
That sentence is ours and it belongs near the top, because it is the shortest honest description of the product. You get the structure and the road map. The content is your work.
-
What arrives is a plan, a to-do list and an overview, so you know where to start and where it ends.
-
There are no content templates inside the editor, which is empty on purpose, because your structure and level of detail are yours. Standard policy texts ship as Word files you edit outside the platform.
-
We are a documentation platform rather than advisers, so there is no final stamp saying you comply.
Information security management An ISMS is not a SIEM
Customers arrive confused about this, sometimes in the same sentence, and it is a fair confusion between two four-letter acronyms. So here it is plainly: the platform documents security work, it does not watch your services.
-
It does not scan anything, and it never derives a status from breaches found automatically.
-
Incidents are registered by a person on a template, with the documentation attached afterwards, so the log proves the handling.
-
If a SIEM is what you actually need, this is not it and it does not replace one. Better said now than after the demo.
Information security management Do the work once, and see it count everywhere
Your frameworks share one catalogue of tasks, over 300 activities at launch, each mapped in advance to the controls it satisfies. One completed task moves more than one thing.
-
A single task can satisfy several ISO 27001 controls and a NIS2 article at the same time.
-
Framework status updates itself as tasks are completed across the organisation, with no status field to maintain.
-
You can also see how far you already are towards a framework you have never set up, read off the work you are doing anyway.
Information security management The work runs on the annual wheel
A control nobody performs is just a document. Every recurring control lands as dated tasks on one annual wheel (årshjul), with an owner and a frequency you set.
-
Set the frequency in weeks, months or years, and a completed task comes back with a reminder when it expires.
-
Filter the wheel down to one framework before that framework's audit, or read every framework at once.
-
Overdue items are red and sorted to the top, and you can drill from the framework to the control to the task to the person.
Information security management Progress, not a verdict
There is no single green light per framework, and we would rather explain why than invent one. What you get are measures of how far you are, judged by work you are already doing.
-
Status is read per line, plus documentation progress on a framework you have activated.
-
A control part-way through its documentation is not the same thing as a control nobody has under control, so we do not roll it up into a compliance verdict.
-
Evidence is still collected by hand, typically as a screenshot or an export uploaded to the task. There are no integrations pulling status out of your systems today.
Information security management Frameworks this covers
Two frameworks, one management system underneath.
-
ISO 27001
Learn about ISO 27001The Annex A controls predefined and 1:1 with the standard, with the documentation gathered against them and the Statement of Applicability downloadable as Excel from the framework.
-
NIS2
Learn about NIS2Structured at article level and standing on the same controls and the same tasks as your ISO work, with the Danish national and sector rules activatable alongside the base package.
Our Customers
+400
companies
+10.000
users
+79.000
contracts
+14.000
processing activities
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
.legal's team has consistently demonstrated a commitment to innovation while being responsive to the needs of our mutual clients.
With .legal, we've gained a simpler and more manageable solution that better suits our needs
.legal has been the right choice for us. .legal are professional and welcoming with skilled employees.
Firstly, it means that not all the work is in one place (me), and secondly, that the understanding of GDPR is implemented throughout the organisation.
From .legal, we experience an incredibly high degree of flexibility and willingness to adapt features to our local needs.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
We are satisfied with the switch to .legal – it has strengthened our compliance work, made processes easier to manage and more transparent, and improved cross-team collaboration
It just works! It is so easy and user-friendly, and the overview of processing activities is brilliant.
.legal has really understood what it means to create a user-friendly and efficient solution. Privacy is an attractive product compared to price and functionality.
.legal continuously update the platform to ensure their customers always remain compliant. In our view, any other choice would be a downgrade.
The implementation of .legal has made a difference in the way we handle compliance. The system has created structure and overview, which has had concrete benefits.
Use cases
Book demo
Find the job you need done
Every use case is a real piece of compliance work, told the way it actually runs in the platform. Filter by who you are, what you work with, and which frameworks you answer to.
Compliance & GRC leadCISO & IT securityDPOLegal counselExecutive & board
Energy & utilities
SMVMid-marketEnterprise & group
GDPRNIS2ISO 27001CIS18DORAePrivacyAI ActD-mærketData Act
Compliance & GRC lead
Run awareness training that reaches every colleague
Send out training and policies, chase the stragglers automatically, and prove every colleague completed it. You bring the material, we run the rails.
See awareness training
Compliance & GRC lead
Manage compliance across a group of companies
Run every company in the group from one platform, document once at group level, and still report entity by entity. Delivered by the Group Companies add-on.
See group compliance
Legal counsel
Run due diligence on your vendors
Classify a vendor on your own criteria, get the answers and documents you need with no login for them, and move the approved ones straight into contracts.
See vendor due diligence
Compliance & GRC lead
Multi-framework compliance: do the work once
Do a control once and it counts across every framework it maps to, with a simulated score on the ones you haven't started yet.
See multi-framework compliance
CISO & IT security
Get NIS2-ready without starting from scratch
Build on the ISO 27001 work you've already done, switch NIS2 on, and let a simulated score show how far ahead you already are.
See NIS2 readiness
DPO
From twelve spreadsheets to one record of processing
Your GDPR documentation already exists, it just lives in spreadsheets. Export what you have and we structure it in .legal for you, typically inside two weeks.
See the move off spreadsheets
No use cases match that combination yet. Try removing a filter.
