NIS2
Supply chain and security controls for essential and important entities
Compliance
Technical evidence your auditors can actually use
Sprita iT helps regulated organizations produce the software security evidence that compliance frameworks expect: what was assessed, what was found, how it was prioritized, and how remediation is governed.
We are precise about our role: we produce technical evidence and control narratives — we do not certify your compliance. Certification decisions remain with you, your QSA, and your auditors.
European regulation
The three instruments reshaping EU software delivery
Each briefing states what the instrument requires of a software organization and links the legal text, so you can verify it rather than take our word for it.
Directive (EU) 2022/2555
NIS2 and software security
What NIS2 requires from software teams: supply chain security, secure development and maintenance, vulnerability handling — and the evidence that proves it.
Read briefing →Regulation (EU) 2022/2554
DORA and application security
What DORA means for software delivery in financial entities and their ICT providers: ICT risk management, resilience testing, third-party risk and the evidence expected.
Read briefing →Regulation (EU) 2024/2847
Cyber Resilience Act and SBOM
Deadline · 11 September 2026
The CRA's vulnerability and incident reporting obligations apply from 11 September 2026: 24-hour early warning, 72-hour notification. What manufacturers must do — SBOM, vulnerability handling, secure-by-design.
Read briefing →Read the pillar guide: DevSecOps for regulated EU enterprises
Frameworks we support
DORA
ICT risk and third-party software governance for financial entities
EU Cyber Resilience Act
Product security and SBOM obligations for software placed on the EU market
PCI DSS
Payment applications and card data environments
ISO/IEC 25000
Software quality and maintainability measurement
ISO 27001
Secure development within your ISMS
OWASP / CWE / SANS
Vulnerability assessment baselines (Top 10, CWE Top 25)
NIST SSDF
Secure software development framework alignment
What "evidence" means in practice
- Baseline assessment reports documenting scope, method and findings
- Prioritization rationale tying findings to risk, not just scanner severity
- Remediation tracking with owners, dates and status
- Documentation of secure-development controls integrated in your SDLC
This content describes consulting services; it is not legal advice or a certification of compliance.
Facing an audit or a customer questionnaire?
We help you show your work — with evidence, not adjectives.