TugevOneJoin early access
In development

One place to run security and compliance.

An AI-assisted governance, risk and compliance platform, built by a practising CISO for the people who carry this responsibility.

AI drafts. You decide.

Join early accessSee what it covers

Stronger together.

Remote working policyAI draft

4. Working from another location

Employees may work remotely with their manager's approval. Company devices must be encrypted and connect through the company VPN.

Confidential documents must not be opened on shared or public computers.

5. Lost or stolen devices

Employees must report a lost or stolen device to the IT team as soon as they notice it, so that it can be locked and erased.

NIS2GDPRISO 27001
Waiting for approval
Information Security Manager
Illustrations with sample data, not screenshots of the finished product.

The responsibility arrived. The team did not.

NIS2 is an EU directive, and it has brought many companies across the EU into scope. Most of them have no compliance team, and many do not have the budget for consultants.

So the work ends up with one person, spread across spreadsheets, shared folders and email. TugevOne gives that person one place to scope, document, train, assess risk, monitor controls and prove compliance. CyberTugi support is there if you want it.

The core idea

One obligation, one item.

Different frameworks often ask for the same thing. TugevOne shows it once, labelled with every framework it applies to, so you do the work once and can show it for each of them.

Without one list

The same work, tracked three times.

  • NIS2
    Security awareness training for staff
  • ISO 27001
    Security awareness training for staff
  • DORA
    Security awareness training for staff

With TugevOne

One item, one owner, one set of evidence.

Security awareness training for staff
NIS2ISO 27001DORAYour company

The same approach applies to risks: similar risks become one entry that shows the highest score and every framework it touches.

Illustrative example.

What it covers

Built to cover the whole job.

This is what we are building. Modules arrive one at a time, and early access partners will see them first. Open a module to see what it includes.

Scoping and onboardingAnswer questions about your company and see which frameworks apply.
  • Enter your sector, size, countries, certifications and main IT platforms
  • Get a guided helper for working out your NIS2 entity type
  • Get a framework recommendation, and change it if you disagree
  • See one consolidated list of requirements for your chosen frameworks
  • Add your own requirements, with your company as a label
  • Finish with a recommended document list and an onboarding checklist
Policies and documentsCreate, assess, approve and publish every document you need.
  • See the documents your frameworks require, and deselect those you already have
  • Generate original drafts in your language, using your company details
  • Upload a DOCX or PDF and get a gap report with severity and requirement references
  • Accept or reject proposed new sections one at a time
  • Set up multi-step approvals, with a recommended review period for each document
  • Compare versions and see the full approval history
  • Control who can see each document with classification labels
  • Assign documents, send reminders and record each acknowledgement
  • Export to DOCX or PDF with your own branding
Employee portal and Ask the policiesGive employees one place for their policies, training and questions.
  • See which policies are waiting for acknowledgement and which are done
  • Browse and search the library
  • Ask a question in plain language and get an answer with its sources
  • Choose between a summary and the exact wording
  • Follow a link to the exact section of the document
  • Only get answers from documents you are allowed to see
Training and awarenessAssign, track and prove security training across the company.
  • Build courses from text, slides, uploaded video and quizzes with a pass mark
  • Offer modules in English, Estonian, Latvian and Lithuanian
  • Upload your own content, or ask CyberTugi for new or updated content
  • Assign by role, department, country, language or new joiner
  • Run an annual mandatory training cycle
  • Send reminders, escalate to managers and issue completion certificates
  • Link completed training to the related controls as evidence
  • Follow completion by department, country and course, and act on overdue lists
Risk managementAssess risk at the design stage and keep one register.
  • Set your own scales, matrix, appetite and categories, or start from a recommended method
  • Assess a new system, vendor, process change or AI use case before it goes live
  • Get draft risks, scores and remediation steps for the risk owner to confirm
  • Merge similar risks into one entry that shows the highest score and every framework
  • Add risks by hand, and link them to controls, vendors and incidents
  • Track treatment plans, tasks, and inherent and residual scores
  • Run risk acceptance with a named approver and an expiry date
  • Export a board report, with a narrative that AI drafts and a person edits
Controls and compliance scorecardSee where you stand, and show an auditor why.
  • Start from a library of suggested controls, or add the ones you already have
  • Let one control satisfy requirements from several frameworks
  • Assign owners, schedule control tests and attach evidence
  • Mark a control as not applicable, with a justification
  • See a score per framework and overall, with the trend over time
  • Follow each requirement down to its control and evidence
  • Give an auditor time-limited, read-only access
  • Export an evidence package per framework or requirement
Integrations and automated evidenceCollect evidence from the systems you already use.
  • Connect Microsoft 365 and Entra ID, Google Workspace and AWS with read-only access
  • Check MFA, admin counts, legacy sign-in, audit logging and storage encryption
  • Check CloudTrail and public bucket exposure in AWS
  • Keep every result as timestamped evidence linked to its control
  • Flag the control when a check fails, with a suggested task or risk
  • Add evidence from other tools by manual upload, CSV import or webhook
Third partiesFirst versionKeep track of your vendors and what they do for you.
  • Keep a vendor register with services, contacts, contract dates, data and criticality
  • Flag ICT services that support critical or important functions under DORA
  • Link vendors to risks, controls, incidents and documents such as DPAs
  • Send a due-diligence questionnaire with your own questions
  • Run an AI-assisted vendor risk assessment as a draft
  • Get reminders when a vendor is due for review
Incidents and authority reportingFirst versionLog an incident, watch the deadlines and prepare the reports.
  • Keep an incident log with severity, owner, timeline and lessons learned
  • Use classification helpers for NIS2, DORA and GDPR incidents
  • Follow reporting deadline clocks, configurable for each regime
  • Look up the relevant authorities in Estonia, Latvia and Lithuania
  • Generate report drafts from the incident data, approve them and export them
Day-to-day runningThe shared tools that keep the work moving.
  • Build your own approval workflows, with reminders, escalations and deadlines
  • Get email notifications when something needs your attention
  • Search across the platform
  • Set your own languages, classification scheme and review periods
  • Add your logo and colours to the employee portal and exports
  • Receive framework content in versioned packs, separate from software updates

Further out

On our list, but not scheduled yet.

  • National NIS2 laws, including Estonia’s Cybersecurity Act and E-ITS
  • DORA Register of Information export
  • Direct submission to authority portals
  • Qualified e-signature through Smart-ID, Mobile-ID and eIDAS providers
  • SCORM course import
  • Teams and Slack notifications

One platform, many roles

Everyone sees the part that is theirs.

TugevOne starts with a default set of roles that you can adapt to your company. Each role gets its own dashboard and only the access it needs.

CISO and security managers

Run the programme, approve what AI drafts, and see the whole picture.

Compliance officers

See coverage and gaps across every framework, and manage the requirements.

Risk managers and CROs

See the heatmap, top risks, trends and appetite breaches, and prepare board reports.

Risk and control owners

See their own risks, controls, tasks and due dates.

Department managers

See their team’s training and acknowledgement status.

Employees

Acknowledge policies, complete training and ask questions.

Auditors

Review controls and evidence with read-only access that expires.

Board members

Follow progress on read-only dashboards.

AI you stay in charge of

Nothing AI writes is official until a person says so.

AI saves time on the first draft. Accountability stays with people, and you can always see where a draft came from.

  1. AI drafts

    A policy section, gap finding or risk assessment is created as a draft and labelled as AI content.

  2. The source is recorded

    The model, prompt version, inputs and time are stored with the draft.

  3. A named person decides

    Someone in your company reviews, edits, approves or rejects it.

  4. It becomes official

    Only then does it count, and the decision stays in the audit log.

  • Client data is not used to train AI models.
  • Risk scores are calculated from your methodology, not decided by a model.
  • AI never evaluates individual employees.
  • The platform keeps working if you turn AI off.
  • If no source supports an answer, it says so rather than guessing.
  • AI translations stay drafts until a person has reviewed them.

Your data

Designed to keep your data in the EU.

Data, processing, backups and AI inference are designed to stay in the EU. Nothing leaves your deployment unless you configure it.

You choose the AI provider, including a local model. On SaaS, only EU providers are accepted. If you host it yourself, a non-EU provider needs an explicit decision from your administrator, and that decision is logged.

Self-hosted

Installed in your own environment with Docker Compose or Kubernetes, using your own approved AI provider and key.

SaaS

Hosted by CyberTugi in an EU region, with strict separation between customers.

Security

Built to face your security review.

You will trust this platform with sensitive information, so we expect you to check how it is built.

Customers kept apart

The database itself separates each customer’s data, and tests check that the separation holds.

Sign-in and access

Single sign-on, multi-factor authentication, and permissions based on role, org unit and document classification.

An audit log you can check

Actions are written to an append-only log, and changing an old entry can be detected.

Encryption

Data is encrypted in transit and at rest, and AI keys and connector credentials get an extra layer of encryption.

Support only when you allow it

CyberTugi staff can reach your data only if you grant it. That access is limited and logged.

Security in the build

We keep a threat model, build towards OWASP ASVS Level 2, and scan code, dependencies and containers.

Original content, no copied standards

  • Templates and summaries are written by us, not copied from third parties.
  • EU laws can be quoted with article references, because they are public.
  • ISO/IEC 27001 and PCI DSS appear only as identifiers with our own summaries.
  • You can upload your own licensed copy of a standard for private reference.

Who it is for

Scope that fits your company.

A 10-person company may choose only NIS2 and GDPR. A bank may add DORA, PCI DSS and ISO 27001. Pick what applies to you, and the platform follows. It is written so that an office manager with no compliance background can use it, and it is being built to meet WCAG 2.1 AA accessibility.

Frameworks

NIS2GDPRDORAISO/IEC 27001PCI DSSEU AI ActYour own requirements

Languages

EnglishEestiLatviešuLietuvių

From a CISO to CISOs.

Tugev is Estonian for strong. The name also nods to talgud and talka, the Baltic tradition of a community coming together to do a big job.

TugevOne comes from CyberTugi, a cybersecurity company in Tallinn. We will run our own compliance on it too. And when you want a person next to the platform, our team is there to help.

Early access

Help us shape TugevOne.

We are building it now. Tell us about your company and what you need to comply with, and we will keep you close as modules become available.

By submitting this form, you agree to our and .