Governance, risk and compliance in one piece

eunom.io is a private project, a side project with a serious core. It brings together what I have learned over years in the telecommunications and financial sectors about information security, risk management and regulation.

Why holistic

Governance, risk and compliance cannot sensibly be split into modules that are unlocked one by one. A protection needs analysis without a risk assessment has no consequences, a contingency plan without knowledge of the dependencies is guesswork, and a register of service providers with no link to the processes is mere formality.

In eunom.io everything therefore works on the same information network. A process, an application or a service provider is recorded once and used wherever it matters. There are no add-on modules to be unlocked or paid for separately: everything is included.

What is included

• Information network: business processes, information, applications, systems, infrastructure and service providers with their dependencies, import and export via Excel and CSV
• Analyses: criticality analysis (protection needs and business impact in one step), inheritance along dependencies, gap analysis, threat analysis, ICT risk analysis under DORA, audits and data protection impact assessment
• Risk management: risk inventory, operational risks, controls with effectiveness reviews
• Business continuity: contingency concepts, business continuity, recovery and restoration plans, and tests, including resilience testing under DORA
• Data protection: records of processing activities and data subject requests with deadlines
• Documents and contracts: written policies with versions and approvals, contracts and amendments
• Operations: incident management and service provider management with the DORA register of information
• Reports: dashboard and reports, also as PDF

What makes eunom.io different

• Damage in euros, not in colours. Damage values are recorded in money. Levels such as “high” or “very high” follow from configurable thresholds instead of being guessed.
• Inheritance along dependencies. Protection needs and classifications flow from the process through the application down to the infrastructure. Deviations require a justification.
• Data sovereignty. All data can be exported in full at any time as Excel, CSV or JSON. There is no lock-in.
• A dedicated instance per company. Its own database, its own sign-in, operated in Germany.

The name

eunom.io, also eunomio, goes back to eunomia, the “good order” that the Athenian statesman and poet Solon described in his elegies around 600 BC. Solon gave Athens laws that applied equally to everyone and understood order not as an end in itself but as protection against arbitrariness and harm. The bust above is modelled on the herm of Solon in the National Archaeological Museum of Naples.

Status

eunom.io is under development and is not for sale. With the trial you can try it for three days in your own trial instance. For questions and comments, write to me.