Security improvement - Organization
Compliance Support
Cocoon helps organizations demonstrably comply with laws and regulations, backed by practical evidence instead of paper-based policies.
- Accountability toward auditors and regulators, with practical evidence instead of just policy documents
- Coverage of ABRO, NIS2, BIO, the Wwke, ISO 27001, and the GDPR
- Insight into your own maturity level as a starting point for improvement
Compliance Support at Cocoon
Compliance Support helps organizations demonstrate that security awareness, physical security, and organizational measures actually meet frameworks such as ABRO, NIS2, BIO, the Wwke (CER Directive), ISO 27001, and the GDPR. The difference from a paper policy document is practical evidence: not just describing what should happen, but proving that it actually does.
Cocoon starts with a baseline assessment of the current situation relative to the relevant framework, followed by a concrete action plan for outstanding points. Where possible, practical evidence is gathered through existing Cocoon services, such as observations, awareness measurements, mystery visits, and physical penetration tests, rather than solely through document research. This evidence is then delivered in a structured format so that it is immediately useful for an auditor or regulator.
The result is accountability toward auditors, insight into your own maturity level, practical improvement measures, and structural integration within the organization, instead of a policy document that disappears back into the cabinet after the audit.
Who is this service intended for?
This service is intended for organizations that must comply with laws and regulations, or those preparing for audits and certification processes.
Compliance Support is often deployed in the run-up to an ISO or NIS2 audit, after an initial self-evaluation shows that policy and practice are diverging, or when an organization falls under a new framework like the Wwke for the first time.
Why choose Cocoon
Cocoon substantiates compliance with practical evidence from its own observations, awareness measurements, mystery visits, and physical penetration tests, not exclusively with document research. That makes the difference between an auditor reading a policy document and an auditor receiving concrete proof that the policy also works in practice.
A policy document proves nothing. The behavior that follows it does.
Compliance Support combines well with Protocols & Procedures to first establish workable agreements, and with KPI & Dashboarding to keep compliance continuously measurable thereafter.
- Practical evidence from own observations, measurements, and tests, not just document research
- Coverage of multiple frameworks simultaneously: ABRO, NIS2, BIO, the Wwke, ISO 27001, and the GDPR
- Structural integration, not a one-time report for the audit
Practical example: demonstrable compliance during an ISO audit
A healthcare institution used observations, awareness measurements, and mystery visits to demonstrate during an ISO audit that policies were actually being followed.
Frequently asked questions
What are the costs for Compliance Support?
Costs depend on the number of frameworks to be met, the size of the organization, and the current state of affairs. You will receive a customized quote following a brief intake.
Which frameworks does this support cover?
Including NIS2, BIO, the Wwke (CER Directive), ISO 27001, and the GDPR, insofar as they pertain to security awareness, physical security, and organizational measures.
Do you also provide the report for the auditor?
Cocoon structures the collected practical evidence so that it is directly usable by an auditor. Formal reporting and submission typically proceed through your own compliance or quality function.
What is the difference between Compliance Support and Protocols & Procedures?
Protocols & Procedures focuses on establishing workable agreements themselves. Compliance Support goes a step further: this service helps you demonstrate to auditors and regulators that those agreements are actually being followed.
Who Is This Service For?
For organizations that must comply with laws and regulations, or that are preparing for audits and certification processes.
Can this be combined with an ongoing or previous pentest trajectory?
Yes, and doing so strengthens the practical evidence. Findings from a physical penetration test, Mystery Visit, or periodic penetration test can be directly included as substantiation for an auditor.
Is an ISO 27001 certificate sufficient proof of compliance?
An ISO 27001 certificate can simplify the process—for example, when obtaining an ABRO statement—but it does not automatically demonstrate that measures work in practice. Cocoon combines the certification framework with practical testing to ensure that compliance remains demonstrable.
What happens if the organization is no longer compliant?
Cocoon identifies the gap, proposes concrete improvement measures, and guides the implementation, ensuring the organization is demonstrably compliant before issues arise during an inspection or audit.