EU cybersecurity directive
NIS2
NIS2 raises the baseline for cybersecurity risk management, incident reporting and supply-chain accountability across essential and important entities in the EU.
Compliance & sovereignty.
Regulations describe outcomes. Wombat translates them into architecture controls, a repeatable score and evidence that stays current between audits.
- NIS2 · DORA · BSI C5 · BSI C3A
- 8 pillars · 100+ controls
- Evidence, not just a score
Pick the obligation you are working on.
Each hub explains what the regulation asks for, which Wombat pillars are relevant, and how to turn the gap into an evidence-backed plan.
EU digital operational resilience
DORA
DORA brings ICT risk management, incident reporting, resilience testing and third-party oversight into one operational-resilience regime for financial entities and their critical providers.
German cloud compliance catalogue
BSI C5
The BSI Cloud Computing Compliance Criteria Catalogue (C5) is the German benchmark for cloud security, transparency and auditability — and a common procurement requirement for cloud providers and their customers.
Cloud sovereignty criteria
BSI C3A
C3A is the BSI's non-binding criteria catalogue for digital sovereignty in cloud services. It is structured around six sovereignty categories: strategic, legal and jurisdictional, data, operational, supply chain and technology.
Control, not just location
Sovereignty
Residency, jurisdiction, key ownership, supplier concentration and exit paths — turned into controls a team can assess.
Open the sovereignty hub →How to use these hubs.
The hubs are navigation aids, not a substitute for the official text or the control-level mapping. They help you find the right starting point quickly.
STEP 1
Read the obligation summary and identify the decisions you own.
STEP 2
Open the relevant pillar pages and control themes.
STEP 3
Run the scorecard to establish the current baseline.
STEP 4
Turn failed controls into a remediation plan and evidence pack.
Start with the baseline, not the binder.
A score across the 8 pillars gives the compliance conversation a concrete starting point and a way to show movement.
Wombat is a technical framework, not a law firm. These pages map relevant Wombat pillars and control themes to regulatory obligations; they do not provide legal advice. Validate the mapping against the official text and your auditor.