CertBridge brings NIS2 and ISO 27001 together in a single portal. Your customer fills things in, you add what is missing, the auditor assesses — and the report comes out at the end. With an audit cycle that lasts three years and a log that holds on to every change.
Frameworks
CertBridge knows the official criteria of the NIS2 self-assessment — SC10, SC20 and SC30 — as well as those of ISO/IEC 27001:2022. You assign the applicable standard per customer; the forms, the checklist and the report follow automatically.
Approach
The navigation in CertBridge follows the process. Nobody has to work out what comes next: the portal shows it, per customer and per standard.
The MSP creates the customer organisation and assigns the standards: NIS2 SC10, SC20, SC30 or ISO 27001. Users get a role, and that role decides exactly what they see.
The customer completes the information security policy, the asset register, the supplier assessments and the continuity plan. The MSP admin can read along and add what is missing.
For every criterion, your MSP's checklist items are ready. The customer ticks them off and records which control covers it. Something missing? Turn it into an improvement point right there.
The auditor picks the audit round and sets a status per control: compliant, partial, non-compliant or not applicable. Every form gets a verdict: compliant or not compliant.
One button produces a printable compliance report per round. At the end of the cycle you archive everything as a snapshot and start the next cycle with a clean slate.
What CertBridge does
At many MSPs, compliance lives in spreadsheets, email threads and folders on a file server. The work does get done, but it cannot be found again — so it cannot be demonstrated. CertBridge records those same steps in one place, with roles, statuses per round and a log. Not because a standard demands it, but because you have to be able to explain it afterwards.
Superadmin, MSP admin, auditor and customer each see precisely their own part. A customer never reaches another customer's data, and an MSP never reaches another MSP's.
On first login every user sets up MFA, with a QR code and backup codes. There is no logging in without it. Anyone who prefers Microsoft 365 can sign in through SSO.
Who changed what, when, and from which IP address? From logins to auditor verdicts: it is all in the audit log. That is exactly what an auditor wants to see.
You define checklist items per criterion for your entire customer base. Import and export via Excel or CSV, and you drag the order into place yourself.
Every customer card shows the compliance score of the latest round plus a bar with the five steps: grey, orange or green, with a counter per step. Clicking takes you straight to that step.
Devices from Datto RMM land in the asset register automatically. Existing assets are never overwritten; they only get a new "last seen" date.
Dashboard
With ten or twenty customers in different stages, the question is not whether the work gets done but where it stalls. The CertBridge dashboard answers that without you having to run a report.
Asset register with CIA classification
The highest score decides whether an asset is a crown jewel.
| Asset | Type | Owner | CIA |
|---|---|---|---|
| File server FS-01 | Server | IT operations | 3 ★ Crown jewel |
| Microsoft 365 tenant | Cloud | Management | 3 ★ Crown jewel |
| Customer administration | Application | Finance | 2 |
| Workstations (42×) | Endpoint | IT operations | 2 |
| Network head office | Infrastructure | IT operations | 3 ★ Crown jewel |
Forms and documents
The heaviest part of a self-assessment is not the assessing, it is the filling in. That work belongs with the customer: they know which systems are in place, who owns them and what breaks when something fails.
CertBridge gives the customer four forms with the same fields as the familiar templates: the information security policy, the asset register with CIA classification, the supplier assessments and the continuity plan. The MSP admin reads along and adds what is missing; the auditor assesses each form as a whole — compliant or not, with an explanation.
Audit cycle
A NIS2 evaluation is valid for three years and is worked through three times in that period: the full audit, an interim check a year later and another one the year after. On paper that is clear. In practice the interim check usually overwrites last year's work.
CertBridge keeps the rounds apart. Every round has its own set of statuses and therefore its own compliance score. What was established in the full audit stays put, even when an interim check passes over it a year later.
At the start of a round you carry over the statuses from the previous round and only change what has actually changed. At the end of the cycle you archive the whole thing — controls, checklist, improvement points, verdicts and history — and the next cycle starts with a blank slate.
Reports
At the end of a round something tangible has to be there: a document stating what was assessed, by whom, when and with what verdict. Nobody enjoys assembling that document by hand.
CertBridge composes the report from what is already in the portal: the verdict per form, the status of every control in the chosen round, the ticked checklist with the control noted beside it and the open improvement points. Above the report you pick the audit round; the default is the most recently completed one.
The customer can view and print their own report — the same content, never another customer's. As soon as a report has been produced, step 4 on the dashboard turns green; the portal records that the report was made.
All the standards for one customer side by side: the score per framework, the state of the checklist, the open improvement points and the verdict per form. This is the report you walk through with the customer.
One standard across all your customers. Where does it run well, and which criterion keeps getting stuck everywhere? That last one is usually the criterion you adjust your own service around.
Audit, Interim 1, Interim 2 and every earlier cycle in the archive. You read back what was established two years ago, exactly as it stood then.
| Standard / chapter | Now | Previous round | +/− |
|---|---|---|---|
| NIS2 SC10 | — | — | — |
| Policy and organisation | 92% | 88% | +4 |
| Access and identity | 78% | 78% | 0 |
| Continuity | 85% | 91% | −6 |
| NIS2 SC30 | — | — | — |
| Supply chain | 74% | 69% | +5 |
| ISO/IEC 27001:2022 | — | — | — |
| Annex A · organisational | 81% | 80% | +1 |
CertBridge is built for MSPs that have to take their customers' self-assessment seriously but do not have a department for it. One portal, fixed steps and a file an auditor can follow. No black box: you see exactly where a score comes from.
Request DEMO
No sales pitch. We walk you through an environment that resembles yours: one customer, one standard, from form to report. After that you decide for yourself whether it fits.
Book half an hour. We ask about your situation before we show you anything.