EterShield — The Complete Guide

For years, cybersecurity and privacy regulation was seen as a problem for large organisations. GDPR, in 2018, was the first sign that this was changing: all organisations that process personal data of European citizens were covered, regardless of size. But it was between 2022 and 2025 that regulatory pressure became truly democratised.

NIS2 extended cybersecurity obligations to many more sectors. DORA imposed stringent requirements on the financial sector, including IT suppliers. The EU AI Act introduced obligations for organisations using high-risk AI systems. CSRD made sustainability reporting mandatory for a growing number of companies. In Portugal, Decree-Law 125/2025 transposed NIS2 with ANACOM as the competent authority.

Many organisations respond to regulatory pressure in the most obvious way: they hire a consultant, conduct an assessment, produce documentation, and pass an audit. A year later, the consultant is gone, the person who coordinated the process has moved to another company, and the organisation starts from scratch.

This is the problem EterShield was designed to solve. It is not a problem of lacking tools — it is a problem of knowledge that disappears. Every decision taken, every risk assessed, every policy approved should be a growing asset of the organisation.

The market has responded with solutions at the extremes: Enterprise GRC (OneTrust, IBM OpenPages) with prices of €50,000–€500,000 annually and implementations taking months; or isolated tools (Eramba, spreadsheets) with no integration or AI. The gap is clear: no affordable solution preserves organisational knowledge, integrates multiple European frameworks in Portuguese, and uses contextual AI — all in a single product for SMEs.

A vCISO (Virtual Chief Information Security Officer) externalises the function of strategic security leadership. A vCISO platform is the technological evolution: software that structures, automates, and systematises the functions of a CISO in an interface that any IT or compliance manager can operate — without being a security specialist.

EterShield is a vCISO platform, but goes further: it is an organisational security knowledge management system that collects and structures everything the organisation knows about its own security, uses AI to transform that knowledge into actionable assessments and policies, and accumulates value over time.

• Knowledge that stays — unlike an external consultant, when the person who led the certification leaves the company, the knowledge remains in the platform with all its justification.
• AI that reads the real context — before suggesting a policy or analysing a gap, the AI reads the organisation's Knowledge Base. A logistics company receives different suggestions from a health clinic.
• European regulatory by design — NIS2, DORA, GDPR, EU AI Act were designed for the European context. EterShield was built from the start in Portuguese, with data in the EU, with ANACOM and CNCS as references.
• Single scope for a complete IMS — ISO 27001, ISO 9001, ISO 45001, GDPR, CSRD integrated in a single platform, eliminating silos and data duplication.
• Progressive modularity — pay for what you use — not every organisation needs everything at once. The base plan includes the GRC core (compliance frameworks, risk, TPRM, audits); the operational modules (ISO 9001, OH&S, HR Security, ESG/CSRD, BCM, Fleet, Facilities, NetworkAlerts) and additional frameworks are activated individually, as the organisation grows or when a specific regulatory requirement arises. There is no need to upgrade the plan to access a single additional module.

Instead of going through 93 ISO 27001 controls manually, the user activates the AI Gap Analysis. Based on the organisation's profile and accumulated Knowledge Base, the AI automatically identifies the most likely gaps, suggests remediation priority, and proposes response texts for each control. The compliance score (0–100%) updates in real time by category and by framework.

Control exceptions with expiry: when a gap cannot be closed immediately, the organisation can record a control exception — a temporary risk acceptance with justification and an expiry date. When an approved exception expires without renewal, the platform automatically reopens the underlying gap and notifies the requester, so a stale risk acceptance never becomes permanent by omission. The expiry sweep runs daily inside the platform's in-process scheduler.

An ISO 27001 control can simultaneously satisfy NIS2 and DORA requirements. An organisation working ISO 27001 in parallel with NIS2 and DORA can have 60–70% of DORA controls already answered by the work done on ISO 27001. No duplicate questions, no redundant effort.

The policy repository generates contextualised drafts — not generic templates. Based on the organisation's profile, sector of activity, and active frameworks, the AI creates a policy that references the specific reality of the company. Full versioning with revision history, approvals, and next scheduled review.

Most risk tools stop at coloured matrices. EterShield quantifies risks financially using the FAIR model (Factor Analysis of Information Risk) with Monte Carlo simulation: 10,000 simulations produce an annual expected loss (ALE) distribution with P10, P50, and P90 percentiles in euros.

FAIR quantification requires parameters that few IT managers know how to estimate. The AI proposes frequency and magnitude parameters with justification based on benchmarks from DBIR (Verizon), ENISA, and CNCS, presenting a TransparencyBadge with the complete reasoning and sources used.

For each implemented security control, EterShield automatically calculates the risk reduction in euros — allowing investments to be prioritised by financial return, not intuition. Each risk enters a formal treatment plan with milestones, owners, approval, and linkage to the compliance calendar.

A dedicated KRIs (Key Risk Indicators) page complements the risk register: each indicator carries a warning threshold, a critical threshold, a configurable direction (higher-is-worse or lower-is-worse), and either a manual or an automatic source. The automatic source L3_CONTROL_TESTS feeds directly off continuous control monitoring: the indicator is the failure rate of automated control tests (FAIL=1, PARTIAL=0.5), recalculated at the end of every hourly monitoring cycle. State transitions — into warning, into critical, or back to normal — trigger deduplicated notifications, with no noise while an indicator sits steady.

A loss events register grounds risk management in actual financial outcomes rather than opinion: events categorised as cyber, operational, fraud, legal/compliance, or reputational, with direct, indirect, and recovered loss values, root cause, and lessons learned. Optional links to an existing risk, incident, or CAPA avoid duplicate data entry; a running summary of total and per-category net loss gives management a factual baseline to calibrate FAIR parameters.

EterShield uses an adaptive TPRM questionnaire with 33 questions distributed across 5 modules, activated automatically based on the vendor's profile. An office supplies vendor answers 8 questions. A personal data processor with direct CRM access answers all 33.

The vendor does not need to create an account. They receive an email with a unique token link, access a secure public page, respond, and submit. The token expires after submission or deadline. All interaction is tracked and audited.

After submission, the AI analyses each response: score 0–100, red flags identified with reasoning, and overall recommendation (Approve / Conditional / Reject / Defer). The responsible party records the formal decision with a justification note — direct evidence for ISO 27001 and NIS2 auditors.

The access lifecycle tracks Joiners (new employees with a provisioning checklist), Movers (role changes with access review), and Leavers (departures with a revocation checklist). Each event generates an assigned task with a deadline and completion confirmation.

Automated periodic access reviews: a cron job schedules the review, the responsible party receives the access list, approves or revokes each entry, all recorded with a timestamp. Background checks with status and validity. Disciplinary process with PII fields encrypted in AES-256-GCM (GDPR Art. 9).

GDPR Art. 15–20 requests with entry date registration, 30-day legal countdown, status tracking (Received → Under review → Responded), and complete history for compliance demonstration.

Accident records with root cause analysis and automatic ACT report; hazard register with risk assessment and controls; PPE management per employee; documented worker consultation (clause 5.4 ISO 45001 requirement).

Critical physical systems (HVAC, CCTV, alarms, sprinklers, UPS) registered as assets with preventive maintenance plans, inspection history, and imminent maintenance alerts. Direct linkage to ISO 27001 physical and environmental security controls.

Vehicle and driver records, fuel tracking, maintenance history, and document expiry calendar (inspection, insurance, service). Fuel data feeds directly into the GHG Scope 1 emissions module.

The CSRD report editorial cycle follows a Draft → Under Review → Approved → Published flow. The report is generated from records already existing on the platform — no manual re-entry of data.

All AI in EterShield is auditable. Every generated result includes a TransparencyBadge visible to the user — relevant for organisations subject to the EU AI Act.

EterShield's deepest differentiator: a per-entity Knowledge Base system with contextual semantic search in four phases.

The meeting ingestion pipeline: the transcript is sent via API or uploaded manually; the AI extracts risks, gaps, tasks, and decisions; items appear in an approval inbox; approved items go directly into the corresponding modules and the Knowledge Base. A 2-hour meeting produces 15 structured entries in 10 minutes.

With the proliferation of AI systems in business processes, AI risk management has become a formal requirement (EU AI Act, ISO 42001). EterShield includes a set of specialised modules for organisations that develop or use AI systems.

The ARIA Framework (Agentic Risk Intelligence Assessment) is a proprietary agentic AI risk assessment methodology structured in 7 phases, aligned with NIST AI RMF, MITRE ATLAS, MAESTRO, OWASP AIUC-1, and AIVSS. It covers 15 risk vectors: A1–A8 (agentic system risks: objective manipulation, planning hallucination, privilege escalation, context exfiltration, reasoning loop, tool abuse, irreversible impact, malicious coordination) and D Series D1–D7 (development phase threats, OWASP AI Exchange: data poisoning, backdoors, model attacks, inversion, extraction, adversarial evasion, dependency injection).

ANACOM routing automatically identifies the competent authority based on the sector and Decree-Law 125/2025 — eliminating manual research during a crisis.

Formal internal audit planning with audit team, agenda, findings, and non-conformance classification (Major / Minor / Observation). CAPAs with structured root cause, owner, deadline, status, and effectiveness verification. Evidence with automatic OCR — text extracted from any PDF or image, searchable and linked to the control it supports.

Automated evidence (e.g. a connector-collected screenshot or an OCR-extracted document) carries a freshness / TTL flag: once validity expires, the evidence is marked stale and the control it supports drops out of the "fresh" bucket until re-collected. A continuous coverage view shows, per framework, the split between fresh, stale, and manual evidence — giving the CISO a single screen to answer "what still needs a human this week." Google Drive Livesync links a Drive folder directly to a control: files added to that folder are picked up automatically and attached as evidence, with no manual upload step.

Dedicated portal for external auditors with controlled access to assessments, evidence, and reports — without access to platform configuration or data from other modules. Revocable access, with all queries recorded in the audit trail.

A weekly job polls RSS feeds from EU regulatory sources — the European Data Protection Board (EDPB) and the European Commission's Digital Strategy publications — and runs each new item through AI classification: which framework it affects, likely impact, and any inferable compliance deadline. Classified items land in a human review queue, where a CISO or compliance officer publishes or rejects each one before it reaches end users. Published items are pushed straight into the tenant's regulatory calendar, alongside internal read-time deadlines, so a new EDPB guideline or Commission proposal shows up next to the organisation's own compliance milestones — no manual trawling of regulatory websites.

Per-tenant regulatory impact: each update in the regulatory calendar now shows its concrete impact on the tenant — a badge with the number of active frameworks affected and the total control count, plus an expandable panel listing them (code, name, control count, active or not). Matching between an update's free-text framework name and the catalogue code is fuzzy — alphanumeric normalisation, cross-matching by code and by name, and known aliases — and codes with no match are declared as such rather than silently dropped.

The /dashboard/issues page pulls everything in the organisation that needs attention into a single per-tenant feed: open gaps, integration findings (Wazuh, EterScan, Prowler), audit findings, CAPAs, failed control tests — both manual and from continuous L3 monitoring — and unresolved incidents. Exact count cards per source, filters by source and normalised severity, drill-down into the originating module. Read-only in v1, with a 100-item-per-source cap and a clear truncation indicator. The GET /api/v1/issues route returns an {data, meta:{total, counts}} envelope.

The TIA module addresses the GDPR obligation to assess the impact of international personal-data transfers, as established in GDPR Art. 44–49, grounded in the Schrems II judgment (CJEU C-311/18) and EDPB Recommendations 01/2020 on supplementary measures.

Regulatory trigger: Following the collapse of the EU–US Data Privacy Framework (DPF) on 29 June 2026 (Trump v. Slaughter), transfers based on that adequacy decision lost their legal basis. Organisations relying on the DPF must now use an alternative mechanism — Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or Art. 49 derogations — and, in any case, conduct a formal Transfer Impact Assessment whenever there is a risk of access by authorities in third countries.

DPF Watch is a dashboard card that auto-derives — with no manual data entry — all Data Flows and DPAs in the tenant that involve a DPF-based or adequacy-based transfer to the US and have no associated approved TIA. When uncovered flows exist, the card displays a red alert listing the affected transfers, ensuring that no high-risk transfer goes undetected after a legal-framework change such as the collapse of the DPF in June 2026.

In Portugal, the obligation does not arise directly from NIS2. It arises from the Cybersecurity Legal Framework (RJC) — Decree-Law 125/2025 of 4 December, which transposes Directive (EU) 2022/2555 into Portuguese law. This is the instrument the competent authority enforces, and the one against which an organisation is assessed. Anyone who has already worked through NIS2 has part of the road behind them, not all of it: the RJC adds obligations of its own, deadlines of its own, and a registration cycle the directive never describes.

EterShield treats the RJC as a first-class framework, not as an alias for NIS2. It carries 126 control objectives derived from the statute — governance duties (art. 25), cybersecurity risk management (arts. 26 to 29) and the minimum measures of art. 27 read together with Annex III of Regulation 756/2026 — applicable to the essential and important entities in the critical and highly critical sectors listed in Annexes I and II to the decree-law.

Meeting the technical measures is not enough: the entity must exist in the regulator's eyes. MyCiber is the electronic platform of the Portuguese National Cybersecurity Centre (CNCS) where that cycle takes place, and EterShield tracks it with 13 control objectives under Chapter II (arts. 6 to 19) of Regulation 756/2026 and arts. 8 and 35 of the RJC: initial self-identification, follow-up of the qualification, definitive registration, permanent updating of the data, and notification of the security officer.

The four coexist for a practical reason: cross-mapping between frameworks means a piece of evidence uploaded once answers the RJC control, the NIS2 control and the QNRCS control at the same time. The work is done once; the demonstration is made three times.

Technical Instruction 01/2026 of the Portuguese National Cybersecurity Centre, approved on 24 June 2026 under art. 20(1)(h) and art. 38 of the RJC, sets the requirements for identifying vulnerabilities and disclosing them in a coordinated manner. It defines what is expected of each of the three parties: whoever identifies the vulnerability, the manufacturer or supplier of the vulnerable technology, and the CNCS as coordinator.

EterShield has a dedicated module with 21 control objectives covering the full cycle: publication of the disclosure policy and point of contact, intake and triage of reports, response and remediation deadlines, communication with the reporter, and an auditable record of every step — which is, in practice, what you present if compliance is ever questioned.

A compliance platform holds what an organisation keeps most closely about its own security posture: what remains undone, where the gaps are, which incidents occurred. The client's legitimate question is not whether the platform is secure — it is how they verify that it is. What follows is the answer in verifiable terms.

Isolation by organisation is enforced on every data operation, not as a coding convention but as a condition of each query — there is no path by which one organisation's data surfaces in another. On top of that, granular access profiles (RBAC) per entity and per module let an organisation with several companies or business units give each team exactly what belongs to it.

Since 26 August 2026, accounts with administrative privileges require a second factor — an authenticator application (TOTP) or an email code as the alternative method. It is neither optional nor deferrable by client configuration: an administrative account without a second factor can no longer complete sign-in.

There are moments when the Eter Growth team needs to enter a client's organisation to diagnose a problem. That access is not a standing administrator privilege: it is a temporary grant, with a recorded reason, a defined term and an automatic end. While it lasts, the client sees that we are there — a persistent notice in the interface states that the session is running under a grant and how much time remains. Every visit is recorded to the second in the organisation's own audit log, which they can consult without asking us for anything.

That last line deserves emphasis. The ability to leave is part of the offer: a compliance platform that holds a client's data hostage becomes, itself, a continuity risk to record in that client's risk register.

OneTrust is irreplaceable for multinationals operating across multiple jurisdictions. For the Portuguese SME market, the cost is prohibitive and the complexity excessive.

Drata/Vanta are excellent for English-speaking startups focused on SOC 2. For a European SME that needs NIS2, DORA, ISO 27001, and ISO 9001 in Portuguese with data in the EU — EterShield is the natural choice.

Starter + Operations Pack = €419 + €149/month PT — all operational modules without upgrading to Professional.

• NIS2 Compliance: typical SME fine for non-compliance: €100,000. EterShield provides technical and documentary evidence of compliance. Positive ROI from the first avoided compliance event.
• ISO 27001 Certification: external consultants cost €15,000–50,000 and take 6–18 months. With EterShield, the process is accelerated by AI and already-structured evidence. Consultancy cost reduction: €10,000–30,000 per cycle.
• Knowledge that stays: an SME that depends on an external consultant pays €2,000–5,000/month. When the consultant leaves, the knowledge disappears. EterShield preserves that knowledge — the next person in charge starts where the previous one left off.

EterShield is SaaS — no software installation, no servers to configure. A modern browser (Chrome 120+, Firefox 120+, Safari 17+), an internet connection, and an email address.

PT prices with a 30% discount for organisations headquartered in Portugal (valid NIF).

Security compliance has moved from a peripheral concern to a strategic factor in competitiveness. Organisations that build real security management capability — not just pass audits — gain access to larger clients, public contracts, cyber insurance with lower premiums, and partnerships that require certifications.

EterShield was built for a specific reality: the European SME facing growing regulation without resources for an internal CISO, without budget for enterprise platforms, and without patience for tools that don't speak their language.