iKNSA International
Self-assessment10 to 15 minClient areaContact iKNSA

Guidance by trigger

The triggering event determines the order of the analysis.

A questionnaire, an audit, market entry or the maintenance of several engagements each call for distinct decisions and levels of evidence.

Review situations

A client request exists

Security questionnaireContractual annexAnnounced auditFindings received

A decision needs to be prepared

RenewalEU call for tendersEU market entryProduct security

The role determines the mandate

The supplier examines its own capability. The European client defines the supplier decision it needs to reach.

Self-assess my organisation →Assess a supplier →Search the platform →

Choose an engagement

Meet the deadline. Establish capacity. Sustain commitments.

Start from what needs to be obtained now: an answer, an in-depth review, or a capability tracked over time.

View all engagements
01

Reply

A document and a deadline.

QuestionnaireAnnexAuditAll responses →
02

Prepare

Verify and remediate.

EU exposureClient and technical assessmentEvidence and remediationAll preparations →
03

Maintain

Keep the current commitments.

Continuous assuranceClient assurance officeProduct security cellAll recurring services →

Basis for the conclusions

From the client's requirement to a qualified piece of evidence.

The same trail links Promise, Policy, Practice, Platform, finding, remediation and controlled sharing.

Review the 4P method

Trace

Evidence traceabilityAssurance registerTrust roomContinuous verification

Frameworks and sectors

GDPR and international accessHealth data and HDSNIS2 and the supply chainIndustrial confidentialityAll frameworks →

View deliverables

See fictitious examples to understand the structure and depth of the deliverables.

See examples of deliverables →

Terms of engagement

Responsibilities, information and limits established before the engagement.

Confidentiality, independence, reversibility and traceability of responsibilities structure the conduct of the work.

Review the firm's rules

Trust rules

ConfidentialityIndependenceSecurityReversibility

Working with iKNSA

ExpertiseInternational engagementsRequest an engagementContact

European principals

Have an international supplier assessed under explicit mandate and sharing rules.

Assess a supplier →
Your contextContext not defined
Country of the organisation assessedNot provided
What it providesNot provided
Relationship with the EUNot provided
Home / EU requirements

EU requirements

Qualify the European requirements

Distinguish between obligation, potential exposure, contractual expectation, voluntary standard and the need for legal review.

Qualification of exposure

A regulation, a clause and a standard carry neither the same authority nor the same effect.

The analysis separates the possible applicability of a text, contractual commitments, voluntary references, and questions requiring legal validation. This distinction avoids turning a client expectation into an unfounded regulatory claim.

01, Source
The author, jurisdiction, status and date of the requirement.
02, Applicability
The entity, role, territory and relationship actually concerned.
03, Consequence
The control, evidence, clause or decision affected.

Curated directory

Ten frameworks for qualifying a European relationship.

These pages distinguish data, sectors, obligations, contracts and voluntary references in order to determine the mandate's priorities.

01

Exposure and local context

Establish the nature of the relationship with the Union and the effects specific to the jurisdiction concerned.

01QualificationDirect or contractual exposureBeing a supplier to a European client does not automatically mean being directly subject to every European text.10JurisdictionsLocal and national contextThe country may change data transfers, local rules, engagement eligibility and certain performance conditions without automatically easing a supplier audit.
02

European texts and sector-specific requirements

Position NIS2, DORA, the CRA, GDPR, health data and HDS within the company's actual relationship.

02EU DirectiveNIS2NIS2 may create direct exposure or influence the supply chain requirements of European clients, even where the supply is not a digital product.03EU RegulationDORA for ICT providersDORA governs financial entities and strengthens their expectations of ICT providers.04EU RegulationCyber Resilience ActThe CRA applies to products with digital elements placed on the Union market.05EU RegulationGDPR and international data accessAccess to European personal data from another country must be distinguished from the supplier's location alone and from the nature of the goods or service provided.06Health sectorHealth data and HDSA relationship involving health data must distinguish between data processing, international transfer, and any hosting activity carried out on behalf of third parties.
03

Confidentiality and supplier expectations

Protect industrial information and put supply chain assurance standards and practices into perspective.

07Sensitive informationTrade secrets and industrial confidentialityPlans, processes, technical files and know-how may create protection requirements regardless of whether the supply is digital or physical in nature.08Voluntary standardISO 27001 mappingISO 27001 can help with mapping, but a certification alone does not satisfy every client commitment.09Contractual practiceBuyer security expectationsSupplier expectations combine contracts, procurement policies, sector, past incidents and risk appetite.

Documented qualification

Applicability can never be inferred from a title alone.

Entity, contract, role, data flow, sector and territory are examined together before a conclusion is reached.

Qualify a requirement