CertBridge did not come out of a standard. It came out of the folder of spreadsheets that gets opened again at every audit.
CertBridge is part of Sinecta BV. We have worked in and around IT service providers for years, and at almost every MSP we saw the same picture: NIS2 and ISO 27001 are on the agenda, the intent is good, but the work ends up in spreadsheets, email threads and folders on a file server.
That works as long as nobody checks it. The moment an auditor reads along — or a customer asks a question about last year — the searching starts. Who established this? When? Which control covers it? The answer usually exists, but it cannot be pointed at.
We decided not to solve that with a generic GRC suite full of modules nobody uses, but with something that follows exactly the process an MSP already goes through: the customer fills things in, the MSP adds what is missing, the auditor assesses, and a report comes out. Four roles, five steps, three audit rounds per three-year cycle.
The result is CertBridge: multi-tenant, using the official criteria numbering of the NIS2 self-assessment — SC10, SC20 and SC30 — and that of ISO/IEC 27001:2022. No black box: for every criterion you see where a score comes from, and the log keeps track of who changed what and when.
We take security seriously in our own product. MFA is mandatory, authorisation is enforced server-side and every change is recorded with actor, role, IP address and timestamp. Not to tick a box, but because we hold our own software to the same standards as the ones our customers are measured against.
When you need us, a real person is there. We think along while you set up your checklist and frameworks, and we say honestly what CertBridge does and does not do.
"Demonstrably in order. Not just on paper."