# ClevSec

> Free EU compliance and cybersecurity tools, guides and templates for small and mid-sized organisations: NIS2, DORA, GDPR and the Cyber Resilience Act. Every guide cites the official texts (EUR-Lex, EDPB) with article references. Informational, not legal advice.

Use the guides and data freely with attribution and a link. Facts are checked against primary sources; each page shows when it was last updated. English only.

## Tools (free, run in the browser)

- [Cyber Risk Score Calculator — Free Security Assessment](https://clevsec.one/tools/cyber-risk-score/?ref=agent): Calculate your cyber risk score in 2 minutes. 15 questions covering access control, encryption, patching, monitoring, and incident response. Free visual risk gauge with category breakdown.
- [Cybersecurity Maturity Assessment — Free NIST CSF Self-Assessment](https://clevsec.one/tools/cybersecurity-maturity-assessment/?ref=agent): Free cybersecurity maturity assessment based on the NIST Cybersecurity Framework. Evaluate your organization across 6 functions — Govern, Identify, Protect, Detect, Respond, Recover. Get a maturity score with radar chart.
- [DORA Compliance Checker — Free Assessment for Financial Firms](https://clevsec.one/tools/dora-compliance-check/?ref=agent): Free DORA compliance checker for financial entities. Assess your readiness across all 5 DORA pillars — ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing.
- [Data Flow Mapping Tool — Map Personal Data Flows for GDPR](https://clevsec.one/tools/data-mapping-tool/?ref=agent): Free tool to map personal data flows: sources, processing, destinations, legal bases and cross-border transfers, as input for your GDPR Article 30 records.
- [GDPR Breach Cost Calculator — Estimate Your Financial Exposure](https://clevsec.one/tools/breach-cost-calculator/?ref=agent): Free GDPR breach fine calculator using the EDPB fine-calculation method (Guidelines 04/2022). Estimate the fine range for a personal data breach and add notification, legal and recovery costs.
- [GDPR Compliance Checklist — Free Interactive Assessment](https://clevsec.one/tools/gdpr-compliance-checklist/?ref=agent): Free interactive GDPR compliance checklist with 48 items across 8 categories. Track your progress, identify gaps, and build your compliance roadmap.
- [GDPR Cookie Consent Checker — Free Compliance Assessment](https://clevsec.one/tools/cookie-consent-checker/?ref=agent): Check if your website's cookie consent mechanism meets GDPR and ePrivacy requirements. 23-item assessment across banners, transparency, technical implementation, and legal compliance.
- [GDPR DPIA Helper — Free Data Protection Impact Assessment Tool](https://clevsec.one/tools/gdpr-dpia-helper/?ref=agent): Free GDPR DPIA tool. Step-by-step Data Protection Impact Assessment — screening, risk identification, mitigation evaluation, and summary generation. Built around GDPR Article 35.
- [ISO 27001 Gap Assessment — Free Readiness Check](https://clevsec.one/tools/iso27001-gap-assessment/?ref=agent): Free ISO 27001 gap assessment. Evaluate your readiness across all 4 Annex A control themes — organizational, people, physical, and technological. 41 controls, instant results.
- [NIS2 Readiness Assessment — Free Compliance Check](https://clevsec.one/tools/nis2-readiness-check/?ref=agent): Free NIS2 readiness assessment. Check your compliance across 9 security domains — governance, risk management, incident handling, supply chain, and more. Instant results.
- [Privacy Policy Generator — Free GDPR Privacy Policy Draft](https://clevsec.one/tools/privacy-policy-generator/?ref=agent): Generate a free privacy policy draft for your website, built around the information GDPR Article 13 requires. Fill in your details, select your data practices, and copy the result.
- [Security Policy Generator — Free Customized Policies](https://clevsec.one/tools/security-policy-generator/?ref=agent): Generate customized security policies for your organization. Free Information Security, Acceptable Use, and Password policies. Answer questions, get a ready-to-use document.
- [Vendor Risk Assessment Tool — Free Third-Party Security Evaluation](https://clevsec.one/tools/vendor-risk-assessment/?ref=agent): Free vendor risk assessment tool. Evaluate third-party security posture across 6 categories — security controls, incident response, compliance, continuity, and supply chain. Get a risk score instantly.

## Guides

- [AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs](https://clevsec.one/blog/ai-agents-gdpr/?ref=agent): AI agents and personal data: who is controller, which legal basis, when Article 22 bars automated decisions, when a DPIA is due, and what to check in a model.
- [Assessing AI Agent Providers: A Questionnaire for NIS2, DORA and GDPR Article 28](https://clevsec.one/blog/ai-agent-vendor-assessment/?ref=agent): How to assess an AI agent or model provider under GDPR Article 28, NIS2 supply chain rules and DORA third-party risk, with a 24-question vendor questionnaire.
- [Backup and Recovery Requirements Under NIS2 and DORA](https://clevsec.one/blog/backup-requirements-nis2-dora/?ref=agent): What NIS2 and DORA require for backups and recovery: backup plans, separate storage, integrity checks, restore testing, recovery objectives and redundancy.
- [Cookie Banners: What EU Regulators Actually Check](https://clevsec.one/blog/cookie-banner-requirements/?ref=agent): What EU data protection authorities check in cookie banners: the ePrivacy consent rule and the practices the EDPB Cookie Banner Taskforce found invalid.
- [Cyber Resilience Act Reporting: What Manufacturers Must Report Since 11 September 2026](https://clevsec.one/blog/cyber-resilience-act-reporting/?ref=agent): Article 14 of the Cyber Resilience Act applies since 11 September 2026: what manufacturers must report, the 24-hour, 72-hour and final deadlines, and where.
- [Cyber Resilience Act vs NIS2: Products vs Organisations](https://clevsec.one/blog/cyber-resilience-act-vs-nis2/?ref=agent): How the Cyber Resilience Act and NIS2 differ: products versus organisations, who is covered, what each requires, reporting, fines, and when both apply.
- [Cybersecurity Checklist for Startups: 20 Things to Do Before Your First Enterprise Client](https://clevsec.one/blog/cybersecurity-checklist-startups/?ref=agent): The 20 security measures that matter most for startups — ordered by impact. Start with the first 10: they give the biggest risk reduction for the effort.
- [DORA Compliance Checklist: 59 Requirements by Article](https://clevsec.one/blog/dora-compliance-guide/?ref=agent): Free DORA compliance checklist: 59 requirements of Regulation (EU) 2022/2554 with article references and microenterprise exemptions. Tick off, save and print.
- [DORA Contract Requirements: Article 30 Clause Checklist for ICT Providers](https://clevsec.one/blog/dora-article-30-contract-requirements/?ref=agent): The clauses DORA Article 30 requires in every ICT contract, extra clauses for critical or important functions, termination rights and subcontracting rules.
- [DORA Exit Strategies and Exit Plans: Article 28(8) Explained](https://clevsec.one/blog/dora-exit-strategy/?ref=agent): What DORA requires for exiting ICT providers that support critical or important functions: exit strategies, tested exit plans and contract terms.
- [DORA ICT Risk Management Framework: What to Document (RTS 2024/1774)](https://clevsec.one/blog/dora-ict-risk-management-framework/?ref=agent): The policies and procedures Delegated Regulation 2024/1774 requires for the DORA ICT risk management framework, mapped by article, plus the simplified version.
- [DORA Major ICT Incident Classification: Criteria and Thresholds Explained](https://clevsec.one/blog/dora-major-incident-classification/?ref=agent): When an ICT incident is major under DORA: the critical-services gate, the materiality thresholds of Delegated Regulation 2024/1772 and the reporting deadlines.
- [DORA Register of Information: What to Include, Template by Template](https://clevsec.one/blog/dora-register-of-information/?ref=agent): What the DORA register of information must contain under Implementing Regulation (EU) 2024/2956: the 15 templates, key fields, identifiers, deadlines and how to build it.
- [DORA Threat-Led Penetration Testing (TLPT): Who Must Do It and How](https://clevsec.one/blog/dora-tlpt/?ref=agent): Who must perform threat-led penetration testing under DORA, how firms are selected, the TLPT phases and timelines, tester rules, and what smaller firms do.
- [DORA for Crypto-Asset Service Providers (CASPs)](https://clevsec.one/blog/dora-crypto-asset-service-providers/?ref=agent): How DORA applies to crypto-asset service providers and asset-referenced token issuers under MiCA: scope, the MiCA links and the obligations to plan for.
- [Data Processing Agreement (GDPR Article 28): Clause-by-Clause Checklist](https://clevsec.one/blog/gdpr-data-processing-agreement-checklist/?ref=agent): What a GDPR data processing agreement must contain under Article 28: the eight mandatory processor obligations, sub-processor rules and what to check.
- [Data Retention Policy: How Long to Keep Personal Data Under GDPR](https://clevsec.one/blog/gdpr-data-retention-policy/?ref=agent): How to set GDPR retention periods: the storage limitation principle, where retention must be documented, how to build a retention schedule, and how to delete.
- [Data Subject Access Requests: How to Respond Within One Month](https://clevsec.one/blog/data-subject-access-request/?ref=agent): How to handle a GDPR subject access request: what the person is entitled to, the one-month deadline, identity checks, the copy, and when you can refuse.
- [Does NIS2 Apply to My Company? Sectors, Size Rules and Examples](https://clevsec.one/blog/does-nis2-apply-to-my-company/?ref=agent): A step-by-step NIS2 scope check: the 18 sectors of Annexes I and II, the size rule, the size-independent cases, essential vs important, and worked examples.
- [EU AI Act Timeline After the 2026 Digital Omnibus: What Applies When](https://clevsec.one/blog/eu-ai-act-timeline/?ref=agent): Every EU AI Act date after the Digital Omnibus (Regulation 2026/1744): what applies now, high-risk rules from December 2027, and what it means for AI agents.
- [GDPR Breach Notification: The 72-Hour Rule Step by Step](https://clevsec.one/blog/gdpr-breach-notification-72-hours/?ref=agent): When a GDPR personal data breach must be reported, when the 72 hours start, what the notification must contain, and when to tell the people affected.
- [GDPR Data Protection Impact Assessment: Step-by-Step Guide](https://clevsec.one/blog/gdpr-dpia-guide/?ref=agent): When is a DPIA required, what must it contain, and how to conduct one step by step. Practical guide for GDPR Article 35 compliance.
- [GDPR Record of Processing Activities (RoPA): What Article 30 Requires](https://clevsec.one/blog/gdpr-record-of-processing-activities/?ref=agent): What a GDPR record of processing activities must contain for controllers and processors, who is exempt under Article 30(5), and how to keep it current.
- [GDPR for SaaS Startups: The Minimum You Need on Day One](https://clevsec.one/blog/gdpr-for-saas-startups/?ref=agent): The GDPR minimum for a SaaS startup: controller and processor roles, the documents customers ask for, security, breaches, transfers and when you need a DPO.
- [How GDPR Fines Are Calculated: The EDPB Method in Five Steps](https://clevsec.one/blog/how-gdpr-fines-are-calculated/?ref=agent): How EU authorities calculate GDPR fines under EDPB Guidelines 04/2022: legal maximums, seriousness bands, turnover adjustment and a worked example.
- [How Much Does a GDPR Data Breach Really Cost? [2026 Data]](https://clevsec.one/blog/gdpr-breach-cost/?ref=agent): Beyond the headline fines — the true cost breakdown of a GDPR breach including legal fees, notification costs, customer churn, and remediation.
- [How to Answer an Enterprise Customer's Security Questionnaire](https://clevsec.one/blog/security-questionnaire-answers/?ref=agent): How to answer an enterprise customer's security questionnaire: what is asked, how to answer honestly, which evidence to attach and when a pentest is needed.
- [How to Scope a Penetration Test (and What to Ask the Tester)](https://clevsec.one/blog/penetration-test-scoping/?ref=agent): How to scope a penetration test: objectives, test types, targets, rules of engagement, authorisation, deliverables, and what NIS2 and DORA expect from testing.
- [How to Write an Incident Response Plan (Free Template)](https://clevsec.one/blog/incident-response-plan-guide/?ref=agent): Step-by-step guide to creating an incident response plan that meets NIS2 and GDPR notification requirements.
- [Incident Response Tabletop Exercise: 5 Scenarios for Small Teams](https://clevsec.one/blog/tabletop-exercise-scenarios/?ref=agent): Five ready-to-run incident response tabletop scenarios for small teams, with injects, discussion questions and the GDPR, NIS2 and DORA reporting decisions.
- [Incident Response for AI Agents: Prompt Injection, Rogue Actions and Reporting](https://clevsec.one/blog/ai-agent-incident-response/?ref=agent): A playbook for AI agent incidents (prompt injection, data leaks, unauthorised actions) and which GDPR, NIS2, DORA, CRA and AI Act reports may be due, and when.
- [Information Security Policy: What to Include, Section by Section](https://clevsec.one/blog/information-security-policy-template/?ref=agent): What an information security policy should contain, based on the eleven elements EU rules list for NIS2 digital providers, plus topic policies and reviews.
- [Legitimate Interest Assessment: The Three-Part Test After EDPB Guidelines 1/2024](https://clevsec.one/blog/legitimate-interest-assessment/?ref=agent): How to run a legitimate interest assessment under GDPR Article 6(1)(f): the three cumulative conditions, the balancing test and what to document.
- [NIS2 Compliance Checklist for SMBs: Article 21 Measure by Measure](https://clevsec.one/blog/nis2-compliance-checklist/?ref=agent): A practical NIS2 checklist for SMBs: scope and registration, management duties, the ten Article 21 measures and incident reporting, with article references.
- [NIS2 Incident Reporting: How to Meet the 24-Hour Deadline](https://clevsec.one/blog/nis2-incident-reporting/?ref=agent): NIS2 gives you 24 hours to file an early warning after a significant incident. Here is exactly what to report, to whom, and how to build a process that meets the deadline.
- [NIS2 Penalties: Fines, Supervision and Enforcement Explained](https://clevsec.one/blog/nis2-penalties/?ref=agent): How NIS2 is enforced: maximum fines for essential and important entities, what authorities weigh, supervision powers, and how NIS2 and GDPR fines interact.
- [NIS2 Supply Chain Security: What to Ask Your Suppliers](https://clevsec.one/blog/nis2-supply-chain-security/?ref=agent): What NIS2 Article 21 requires for supply chain security, the detailed rules for digital providers, and the clauses and questions to use with suppliers.
- [NIS2 and the Board: Management Liability and Training Under Article 20](https://clevsec.one/blog/nis2-management-liability/?ref=agent): What NIS2 requires from management bodies: approving and overseeing Article 21 measures, training, personal liability and temporary bans on managers.
- [NIS2 for Managed Service Providers (MSPs and MSSPs)](https://clevsec.one/blog/nis2-managed-service-providers/?ref=agent): How NIS2 applies to managed service providers and MSSPs: definitions, size rule, jurisdiction, ENISA registration, Regulation 2024/2690 and incident thresholds.
- [NIS2 vs GDPR: Key Differences and How They Overlap](https://clevsec.one/blog/nis2-vs-gdpr/?ref=agent): Understanding the relationship between NIS2 and GDPR — scope, incident reporting, security measures, governance, penalties, and how to comply with both efficiently.
- [NIS2 vs ISO 27001: How Much Does Certification Cover?](https://clevsec.one/blog/nis2-vs-iso-27001/?ref=agent): Does ISO 27001 certification make you NIS2 compliant? Where the standard and NIS2 overlap, and the legal duties certification does not cover.
- [NIST CSF 2.0 for Small Businesses: The Six Functions in Practice](https://clevsec.one/blog/nist-csf-2-small-business/?ref=agent): NIST Cybersecurity Framework 2.0 for small businesses: the six functions including Govern, profiles, tiers, and first steps that also support NIS2 and DORA.
- [Securing MCP Servers and AI Agent Tools: A Practical Checklist](https://clevsec.one/blog/securing-mcp-servers-ai-agents/?ref=agent): Security checklist for MCP servers and AI agent tools: supply chain, permissions, tokens, prompt injection, SSRF and monitoring, mapped to NIS2 and DORA.
- [Security Awareness Training: What NIS2 and DORA Expect](https://clevsec.one/blog/security-awareness-training-requirements/?ref=agent): What NIS2 and DORA require for security awareness and training: who must be trained, what to cover, how often, management training and proving effectiveness.
- [Top GDPR Fines in 2025-2026: Lessons for Your Business](https://clevsec.one/blog/top-gdpr-fines/?ref=agent): Analysis of major GDPR enforcement actions — what drives the largest fines, patterns across DPAs, and practical lessons for your compliance strategy.
- [Transferring Data to US SaaS: The EU-US Data Privacy Framework Explained](https://clevsec.one/blog/eu-us-data-privacy-framework/?ref=agent): When you can send personal data to US cloud and SaaS providers under GDPR: the Data Privacy Framework, how to check certification, and what to use instead.
- [Vendor Risk Assessment: A Practical Guide for Startups](https://clevsec.one/blog/vendor-risk-guide/?ref=agent): How to assess and manage third-party vendor security risk as a startup. Step-by-step process, tier classification, and contractual protections.
- [What Is a Cyber Risk Score and How Is It Calculated?](https://clevsec.one/blog/what-is-a-cyber-risk-score/?ref=agent): What a cyber risk score measures, the three common ways to calculate one, how our free score works, and how to use a score without fooling yourself.
- [What Is the NIS2 Directive? Summary, Scope and Requirements](https://clevsec.one/blog/nis2-directive-explained/?ref=agent): NIS2 (Directive (EU) 2022/2555) in plain English: who is in scope, the 10 Article 21 measures, 24h/72h/1-month incident reporting, fines and management liability.
- [What a GDPR Privacy Policy Must Contain: Articles 13 and 14 Checklist](https://clevsec.one/blog/gdpr-privacy-policy-requirements/?ref=agent): Every item GDPR Articles 13 and 14 require in a privacy notice, with article references, the extras when data comes from other sources, and when to provide it.

## Open data (JSON, CC BY 4.0)

- [EU incident and breach reporting deadlines (GDPR, NIS2, DORA, CRA)](https://clevsec.one/data/reporting-deadlines.json): When each reporting clock starts, the deadlines, and who receives the reports.
- [DORA major ICT-related incident classification](https://clevsec.one/data/dora-major-incident-criteria.json): The gate test, materiality thresholds and decision rule of Commission Delegated Regulation (EU) 2024/1772.
- [DORA compliance checklist: 59 requirements by article](https://clevsec.one/data/dora-checklist.json): Core DORA requirements for financial entities with article references and the scope exemptions stated in the regulation.
- [NIS2 minimum cybersecurity risk-management measures (Article 21(2))](https://clevsec.one/data/nis2-measures.json): The ten measures every essential and important entity must include, plus the related governance and reporting duties.
- [NIS2 scope: sectors, size rule and size-independent cases](https://clevsec.one/data/nis2-scope.json): Annex I and II sectors, the medium-size rule, the cases covered regardless of size, and the essential/important categories.
- [GDPR fine tiers and the EDPB calculation bands](https://clevsec.one/data/gdpr-fines.json): Article 83 maximums and the starting-point bands and turnover adjustments of EDPB Guidelines 04/2022.
- [Information a GDPR privacy notice must contain (Articles 13 and 14)](https://clevsec.one/data/gdpr-transparency-items.json): Each required item with its article in Art. 13 (data collected from the person) and Art. 14 (data from other sources).
- [Changelog (JSON)](https://clevsec.one/data/changelog.json): what changed in the data and MCP tools, newest first

## Use from AI assistants (MCP)

- [ClevSec MCP server](https://clevsec.one/mcp/?ref=agent): remote MCP server at https://mcp.clevsec.one/mcp with deterministic, sourced tools for NIS2 scope and readiness, DORA incident classification and checklist, GDPR breach decisions, fine ranges and privacy notices, CRA reporting, and EU reporting deadlines. Free, no key.

## Products and pricing

- [Product feed (JSON)](https://clevsec.one/products.json): templates and bundles with contents and prices
- [ClevSec Pro](https://clevsec.one/pricing/?ref=agent): $9 per month or $79 per year, Pro features in 10 tools

## Optional

- [Full text of all guides](https://clevsec.one/llms-full.txt)
- [About ClevSec](https://clevsec.one/about/?ref=agent)