Less duplicate work, more grip on four frameworks at once.
ISO 27001, DORA, NIS2 and the GDPR often ask for the same measure. TRIAS records that measure once, maps it to the requirements of each framework and follows it from self-assessment through review to evidence with an expiry date. Who executes, who reviews and who audits are separate powers in the app, and the server guards that boundary. Built and hosted in the EU.
From now to next
From four spreadsheets to one chain that guards itself
An organisation with a risk, compliance or audit function of one to five FTE sits between two worlds: tooling that collects evidence for the first and second line, and audit packages that assume a file already exists. The gap in between is filled with spreadsheets.
Four frameworks, the same measure four times
Access management sits in the ISO spreadsheet, in the DORA register, in the NIS2 overview and in the GDPR processing records. Four versions, four owners, four dates.
One measure, mapped to four frameworks
You describe the measure in your own words and map it to requirements in several frameworks, each mapping with its degree of coverage and a mandatory justification.
The owner reviews their own work
Self-assessment and review come from the same person, or the review is missing. A deviation only surfaces at the external audit.
Review is always done by someone else
Whoever submits a self-assessment can never review it; the server refuses. Approval requires a complete submission with at least one piece of evidence.
Evidence sits in folders and ages quietly
A three-year-old penetration test report still counts as evidence, because nobody tracks the expiry date.
Evidence with an expiry date and rules on a schedule
Every piece of evidence has a validity period and counts across frameworks. Evidence rules check monthly or quarterly whether the linked evidence is still valid; without evidence a measure is never green.
The RCSA is an annual Excel round
Owners score leniently, the risk manager retypes, and the board sees a summary without provenance.
An RCSA round with a personal link and review
Owners assess their risks and measures through a personal link, on their phone if they like. Risk and compliance reviews, and the reporting compares round against round and shows where owners consistently score more leniently than the review.
This is what it looks like
A selection from TRIAS
Click a thumbnail for that screen, or the image itself for the full-size view.
Frequently asked questions
What you want to know about TRIAS in advance
What is TRIAS?
TRIAS is Audirium's compliance chain for ISO 27001, DORA, NIS2 and the GDPR. One measure maps to requirements in several frameworks and is followed from self-assessment through review to evidence with an expiry date. The name refers to the separation of powers: who executes, who reviews and who audits are separate powers in the app.
Who is TRIAS for?
For organisations within the scope of DORA or NIS2 that have a risk, compliance or audit function of roughly one to five FTE. Process owners self-assess, risk and compliance reviews, the data protection officer reviews within the GDPR, internal audit and the external auditor read along, and the board sees summaries and gives its approval.
What does TRIAS actually do?
TRIAS maps measures to requirements with coverage and justification, lets owners self-assess design, existence and operation with a review by someone else, keeps evidence with a validity period and checks it on a schedule, runs RCSA rounds with a personal link, review and reporting, sends policies with read confirmation to staff, and delivers the board view and the exports for the audit.
How does TRIAS differ from a spreadsheet or a standard GRC package?
In TRIAS the separation between roles sits in the data model and in the server. The submitter cannot review their own assessment, internal audit and the external auditor cannot write anywhere in the file, and a measure without an adopted judgement is called 'not measured' and never turns green. A spreadsheet has no such boundaries, and a generic package leaves them to a working agreement.
How does AI work in TRIAS and who decides?
AI appears in TRIAS only in the RCSA review, and only on request. The AI reads the owners' judgements alongside incidents, KRI readings and open findings and raises flags; for a vague description it drafts a testable proposal. The reviewer decides on every flag, and a new description only takes effect after the owner agrees. Your administrator switches the function on or off per component.
What about data and hosting?
Each organisation has its own TRIAS database on an Audirium server in the European Union (Hetzner). The organisation context comes from the signed-in session and never from a request. The framework library with ISO 27001, DORA, NIS2 and GDPR is read only. Every change in the file is recorded in the audit trail, which internal audit and the external auditor can inspect.
What TRIAS offers
One file, six roles, and boundaries the server enforces
TRIAS brings the file of the first line, the review of the second line and the reading work of the third line into one environment, without those roles being able to overwrite each other's work.
AI built in, not bolted on
In the RCSA review the AI reads first on request and raises flags: contradiction with an incident or KRI reading, a vague description, a copied answer. The reviewer decides on every flag. A rewritten measure description only takes effect after the owner agrees. Each function can be switched on or off, with a usage ceiling.
Four frameworks, one measure
ISO 27001:2022, DORA, NIS2 and the GDPR come from one shared framework library. A measure maps to requirements in each framework, with coverage full, partial or compensating, and the requirements browser shows the ISO counterpart for every article.
Six roles, rights on the server
Process owner, risk and compliance, data protection officer, internal audit, external auditor and board. Internal audit and the external auditor read only, the board sees summaries without the file. Your organisation's administrator adjusts the matrix within locked boundaries, and every role switch is logged.
Self-assessment in plain language
Design, existence and operation as three questions: is it well conceived, does it actually happen, does it work? Every judgement requires an explanation. The reviewer chooses between approved and working, partly working, not working or sent back with a question. Approval freezes the assessment.
Evidence that expires, and rules that watch it
Evidence has a validity period and counts across frameworks. A fragment of a recorded conversation or decision can serve as evidence, frozen and signed. Evidence rules run on a schedule and report a measure whose evidence has expired.
The RCSA as a continuous loop
Rounds on the risk register, reminders and escalation, review by risk and compliance, and the agreed residual risk proposed back to the Risk Heat Map. Between rounds, incidents and KRIs beyond their threshold arrive as triggers for reassessment. Reporting with radar, heatmap and score drift.
Policies with read confirmation
A versioned policy goes out to staff, who confirm through their account or a personal link that they have read it, after a check question. With reminders, annual repetition and an evidence report per organisational unit.
The board in the driving seat
The board view shows where the organisation stands, what awaits approval and the board's own training. An adopted management review receives board approval with an explanation, as NIS2 requires of management bodies.
Data sovereignty, built in the EU
Your file sits in a separate database per organisation on a server in the EU. The framework library is read only and never changed from your session. Every change is in the audit trail, which internal audit and the external auditor can read.
How it works
From set-up to audit file in six steps
Set up
Choose which frameworks apply, assign roles to people and load a starter set of measures from the library. A wizard walks you through the five steps and tells you what is still missing.
Map measures to requirements
Each mapping gets a degree of coverage and a justification. The requirements browser shows the ISO counterpart for every DORA or NIS2 article and the other way round.
Let owners self-assess, then review
Owners answer three questions per measure and attach evidence. Risk and compliance reviews; approval adopts the measure and freezes the assessment.
Record evidence and schedule rules
Link evidence with a validity period and let evidence rules check monthly or quarterly whether it is still valid.
Run the RCSA round and the policy round
Launch a round on the risk register, send policies to staff and follow progress per unit. Assessors without an account work through the same personal link.
Report and prepare for the audit
Status per framework with one definition, the board view, and the exports: evidence register, management report, statement of applicability and the full data export.
The four frameworks
Four frameworks from one library, each with its own status
TRIAS sits alongside the other apps of the suite: incidents live in Incident, risks in the Risk Heat Map, actions in Action Tracking and controls in CRAFT. TRIAS reads along and refers, without creating a second source of truth.
ISO 27001:2022
Voluntary standard, certification by an accredited body. The ISO controls are the hinge: cross-references to the other frameworks run through ISO, in both directions.
DORA
Regulation (EU) 2022/2554, directly applicable to financial entities since 17 January 2025. In TRIAS as a control framework, with an RCSA regime that can be chosen per round.
NIS2
The national transposition of the NIS2 directive. It places approval of the measures and training with the management body; TRIAS gives the board its own screen with an approval field.
GDPR
Applicable since 25 May 2018. In TRIAS the data protection officer reviews only measures that cover a GDPR requirement; the rest of the file is read only for that role.
Record one measure. Demonstrate four frameworks.
Request a demo and see how the chain from owner to board would run in your organisation.