# ClevSec

> Free EU compliance and cybersecurity tools, guides and templates for small and mid-sized organisations: NIS2, DORA, GDPR and the Cyber Resilience Act. Every guide cites the official texts (EUR-Lex, EDPB) with article references. Informational, not legal advice.

Use the guides and data freely with attribution and a link. Facts are checked against primary sources; each page shows when it was last updated. English only.

## Tools (free, run in the browser)

- [AI Act Scope Check: Does the EU AI Act Apply to You? (Free, 2026)](https://clevsec.one/tools/ai-act-scope-check/?ref=agent): Free EU AI Act checker: find out if the AI Act applies to your AI system, whether you are provider or deployer, if it is prohibited or high-risk, and every obligation with its date after the 2026 Digital Omnibus.
- [AI Agent Risk Calculator: Free Agent Security Self-Assessment](https://clevsec.one/tools/agent-risk-calculator/?ref=agent): Free AI agent risk calculator: 20 questions on what an agent can do and what limits it give a 0-100 risk score, red flags such as data exfiltration paths, and fixes mapped to OWASP, GDPR and the AI Act.
- [Cyber Risk Score Calculator: Free Cybersecurity Risk Calculator](https://clevsec.one/tools/cyber-risk-score/?ref=agent): Free cybersecurity risk calculator: 15 weighted questions mapped to NIST CSF 2.0 and NIS2 give your cyber risk score (0-100) in 2 minutes, with the formula, a category breakdown and your top gaps.
- [Cybersecurity Maturity Assessment — Free NIST CSF Self-Assessment](https://clevsec.one/tools/cybersecurity-maturity-assessment/?ref=agent): Free cybersecurity maturity assessment based on the NIST Cybersecurity Framework. Evaluate your organization across 6 functions — Govern, Identify, Protect, Detect, Respond, Recover. Get a maturity score with radar chart.
- [DORA Compliance Tool: Free DORA Checker and Self-Assessment](https://clevsec.one/tools/dora-compliance-check/?ref=agent): Free DORA compliance tool: 39 questions across the 5 DORA pillars with article references, a score per pillar and your gaps in about 10 minutes. No sign-up; answers stay in your browser.
- [Data Flow Mapping Tool — Map Personal Data Flows for GDPR](https://clevsec.one/tools/data-mapping-tool/?ref=agent): Free tool to map personal data flows: sources, processing, destinations, legal bases and cross-border transfers, as input for your GDPR Article 30 records.
- [Free Security Policy Generator: Information Security, Acceptable Use, Password and AI Agent Policies](https://clevsec.one/tools/security-policy-generator/?ref=agent): Free security policy generator: answer a few questions and get an information security policy, acceptable use policy, password policy or AI agent and MCP use policy as a ready-to-edit document. No sign-up.
- [GDPR Compliance Checklist: Free 48-Item Self-Assessment by Article](https://clevsec.one/tools/gdpr-compliance-checklist/?ref=agent): Free GDPR compliance checklist and self-assessment: 48 requirements in 8 areas, each with its GDPR article. Tick off items, get a score and your open gaps. No sign-up; runs in your browser.
- [GDPR Cookie Consent Checker — Free Compliance Assessment](https://clevsec.one/tools/cookie-consent-checker/?ref=agent): Check if your website's cookie consent mechanism meets GDPR and ePrivacy requirements. 23-item assessment across banners, transparency, technical implementation, and legal compliance.
- [GDPR DPIA Helper — Free Data Protection Impact Assessment Tool](https://clevsec.one/tools/gdpr-dpia-helper/?ref=agent): Free GDPR DPIA tool. Step-by-step Data Protection Impact Assessment — screening, risk identification, mitigation evaluation, and summary generation. Built around GDPR Article 35.
- [GDPR Data Breach Cost Calculator: Fine Estimate (EDPB Method) and Total Breach Cost](https://clevsec.one/tools/breach-cost-calculator/?ref=agent): Free GDPR data breach calculator: estimate the fine range with the EDPB method (Guidelines 04/2022) and add notification, legal and recovery costs for your total breach impact. No sign-up.
- [ISO 27001 Gap Assessment — Free Readiness Check](https://clevsec.one/tools/iso27001-gap-assessment/?ref=agent): Free ISO 27001 gap assessment. Evaluate your readiness across all 4 Annex A control themes — organizational, people, physical, and technological. 41 controls, instant results.
- [MCP Server Security Check: Tool List and A2A Agent Card Checker](https://clevsec.one/tools/mcp-agent-card-check/?ref=agent): Free MCP tool list and A2A Agent Card check: paste the JSON, find tool poisoning, hidden characters, risky tools and missing security fields, and get a fingerprint. Runs in your browser.
- [NIS2 Readiness Check: Free NIS2 Checker and Self-Assessment (53 Questions)](https://clevsec.one/tools/nis2-readiness-check/?ref=agent): Free NIS2 checker: a scope check plus 53 self-assessment questions across 9 domains, based on Articles 20, 21 and 23. Score per domain and your gaps in under 10 minutes. No sign-up; answers stay in your browser.
- [Privacy Policy Generator — Free GDPR Privacy Policy Draft](https://clevsec.one/tools/privacy-policy-generator/?ref=agent): Generate a free privacy policy draft for your website, built around the information GDPR Article 13 requires. Fill in your details, select your data practices, and copy the result.
- [Vendor Risk Assessment Tool — Free Third-Party Security Evaluation](https://clevsec.one/tools/vendor-risk-assessment/?ref=agent): Free vendor risk assessment tool. Evaluate third-party security posture across 6 categories — security controls, incident response, compliance, continuity, and supply chain. Get a risk score instantly.

## Guides

- [A2A Security: Securing Agent-to-Agent Communication (Protocol 1.0)](https://clevsec.one/blog/a2a-security/?ref=agent): Agent2Agent (A2A) protocol 1.0 security: agent cards and signatures, authentication, task authorization, push notification SSRF, and a checklist.
- [AI Act Transparency Rules (Article 50): Chatbots, Deepfakes and AI-Generated Content](https://clevsec.one/blog/ai-act-transparency-article-50/?ref=agent): The AI Act's Article 50 transparency duties, in force since 2 August 2026: AI interaction notices, marking generated content, deepfake and AI text disclosure.
- [AI Agent Identity and Delegated Permissions: Who Is the Agent Acting As?](https://clevsec.one/blog/agent-identity-delegated-permissions/?ref=agent): Give AI agents their own identity and least-privilege, delegated access: scoped OAuth tokens, token exchange, human approval, NIS2 and DORA.
- [AI Agents and GDPR: Legal Basis, Automated Decisions and DPIAs](https://clevsec.one/blog/ai-agents-gdpr/?ref=agent): AI agents and personal data: who is controller, which legal basis, when Article 22 bars automated decisions, when a DPIA is due, and what to check in a model.
- [AI Literacy Under the AI Act: What Article 4 Requires After the 2026 Omnibus](https://clevsec.one/blog/ai-literacy-requirements/?ref=agent): What the AI Act's AI literacy duty requires of companies using AI, how the 2026 Omnibus rewrote Article 4, how it is enforced, and a proportionate programme.
- [Assessing AI Agent Providers: A Questionnaire for NIS2, DORA and GDPR Article 28](https://clevsec.one/blog/ai-agent-vendor-assessment/?ref=agent): How to assess an AI agent or model provider under GDPR Article 28, NIS2 supply chain rules and DORA third-party risk, with a 24-question vendor questionnaire.
- [Backup and Recovery Requirements Under NIS2 and DORA](https://clevsec.one/blog/backup-requirements-nis2-dora/?ref=agent): What NIS2 and DORA require for backups and recovery: backup plans, separate storage, integrity checks, restore testing, recovery objectives and redundancy.
- [Cookie Banners: What EU Regulators Actually Check](https://clevsec.one/blog/cookie-banner-requirements/?ref=agent): What EU data protection authorities check in cookie banners: the ePrivacy consent rule and the practices the EDPB Cookie Banner Taskforce found invalid.
- [Cyber Resilience Act Reporting: What Manufacturers Must Report Since 11 September 2026](https://clevsec.one/blog/cyber-resilience-act-reporting/?ref=agent): Article 14 of the Cyber Resilience Act applies since 11 September 2026: what manufacturers must report, the 24-hour, 72-hour and final deadlines, and where.
- [Cyber Resilience Act Requirements: Annex I Checklist](https://clevsec.one/blog/cyber-resilience-act-requirements/?ref=agent): Every CRA essential requirement as a checklist: security by design, vulnerability handling, SBOM, support period and conformity, due 11 December 2027.
- [Cyber Resilience Act for Importers and Distributors: Articles 19 to 23](https://clevsec.one/blog/cyber-resilience-act-importers-distributors/?ref=agent): CRA duties for importers and distributors: checks before sale, vulnerabilities, 10-year records, and when a reseller becomes the manufacturer.
- [Cyber Resilience Act vs NIS2: Products vs Organisations](https://clevsec.one/blog/cyber-resilience-act-vs-nis2/?ref=agent): How the Cyber Resilience Act and NIS2 differ: products versus organisations, who is covered, what each requires, reporting, fines, and when both apply.
- [Cybersecurity Checklist for Startups: 20 Things to Do Before Your First Enterprise Client](https://clevsec.one/blog/cybersecurity-checklist-startups/?ref=agent): The 20 security measures that matter most for startups — ordered by impact. Start with the first 10: they give the biggest risk reduction for the effort.
- [DORA Compliance Checklist: 59 Requirements by Article (Free Template, 2026)](https://clevsec.one/blog/dora-compliance-guide/?ref=agent): Free DORA compliance checklist template: the 59 requirements of Regulation (EU) 2022/2554 by article, with the microenterprise exemptions marked. Tick items off in the browser, print it, or get the Excel version.
- [DORA Contract Requirements: Article 30 Clause Checklist for ICT Providers](https://clevsec.one/blog/dora-article-30-contract-requirements/?ref=agent): The clauses DORA Article 30 requires in every ICT contract, extra clauses for critical or important functions, termination rights and subcontracting rules.
- [DORA Exit Strategies and Exit Plans: Article 28(8) Explained](https://clevsec.one/blog/dora-exit-strategy/?ref=agent): What DORA requires for exiting ICT providers that support critical or important functions: exit strategies, tested exit plans and contract terms.
- [DORA ICT Risk Management Framework: What to Document (RTS 2024/1774)](https://clevsec.one/blog/dora-ict-risk-management-framework/?ref=agent): The policies and procedures Delegated Regulation 2024/1774 requires for the DORA ICT risk management framework, mapped by article, plus the simplified version.
- [DORA Major ICT Incident Classification: Criteria and Thresholds Explained](https://clevsec.one/blog/dora-major-incident-classification/?ref=agent): When an ICT incident is major under DORA: the critical-services gate, the materiality thresholds of Delegated Regulation 2024/1772 and the reporting deadlines.
- [DORA Register of Information: What to Include, Template by Template](https://clevsec.one/blog/dora-register-of-information/?ref=agent): What the DORA register of information must contain under Implementing Regulation (EU) 2024/2956: the 15 templates, key fields, identifiers, deadlines and how to build it.
- [DORA Threat-Led Penetration Testing (TLPT): Who Must Do It and How](https://clevsec.one/blog/dora-tlpt/?ref=agent): Who must perform threat-led penetration testing under DORA, how firms are selected, the TLPT phases and timelines, tester rules, and what smaller firms do.
- [DORA for Crypto-Asset Service Providers (CASPs)](https://clevsec.one/blog/dora-crypto-asset-service-providers/?ref=agent): How DORA applies to crypto-asset service providers and asset-referenced token issuers under MiCA: scope, the MiCA links and the obligations to plan for.
- [Data Processing Agreement (GDPR Article 28): Clause-by-Clause Checklist](https://clevsec.one/blog/gdpr-data-processing-agreement-checklist/?ref=agent): What a GDPR data processing agreement must contain under Article 28: the eight mandatory processor obligations, sub-processor rules and what to check.
- [Data Protection by Design and by Default (GDPR Article 25): A Practical Checklist](https://clevsec.one/blog/gdpr-data-protection-by-design/?ref=agent): What GDPR Article 25 requires, how EDPB guidance turns each data protection principle into design measures, and privacy-friendly defaults to ship.
- [Data Retention Policy: How Long to Keep Personal Data Under GDPR](https://clevsec.one/blog/gdpr-data-retention-policy/?ref=agent): How to set GDPR retention periods: the storage limitation principle, where retention must be documented, how to build a retention schedule, and how to delete.
- [Data Subject Access Requests: How to Respond Within One Month](https://clevsec.one/blog/data-subject-access-request/?ref=agent): How to handle a GDPR subject access request: what the person is entitled to, the one-month deadline, identity checks, the copy, and when you can refuse.
- [Do You Need a Data Protection Officer? GDPR Articles 37 to 39 Explained](https://clevsec.one/blog/gdpr-data-protection-officer/?ref=agent): When GDPR requires a data protection officer: core activities, large scale and systematic monitoring, national add-ons, conflicts of interest and DPO tasks.
- [Does DORA Apply to My Firm? Entity Types, Exclusions and Lighter Rules](https://clevsec.one/blog/does-dora-apply-to-my-firm/?ref=agent): Who DORA covers: the 20 financial entity types, ICT third-party providers, the Article 2(3) exclusions, microenterprises and the simplified framework.
- [Does NIS2 Apply to My Company? Sectors, Size Rules and Examples](https://clevsec.one/blog/does-nis2-apply-to-my-company/?ref=agent): A step-by-step NIS2 scope check: the 18 sectors of Annexes I and II, the size rule, the size-independent cases, essential vs important, and worked examples.
- [EU AI Act Timeline: Every Key Date From 2025 to 2028](https://clevsec.one/blog/eu-ai-act-timeline/?ref=agent): When each AI Act rule applies: bans since 2025, new bans on 2 December 2026, high-risk rules from December 2027 and August 2028. Updated for the Omnibus.
- [EU Compliance Questions in Your AI Assistant: Five Worked Examples With an MCP Server](https://clevsec.one/blog/eu-compliance-mcp-server-examples/?ref=agent): Five real NIS2, DORA, GDPR and CRA questions answered by the ClevSec MCP server: what the assistant sends, what comes back, and which articles it cites.
- [EU Data Act Cloud Switching Rules: What SaaS and Cloud Providers Must Offer](https://clevsec.one/blog/data-act-cloud-switching/?ref=agent): The Data Act's switching rules for cloud and SaaS providers: contract clauses, 2-month notice, 30-day transition, data export, no switching charges from 2027.
- [EU Data Act for Connected Products: What Makers Must Do](https://clevsec.one/blog/data-act-connected-products/?ref=agent): Data Act rules for connected products: access by design since 12 September 2026, what to tell users before the contract, and how user access and sharing work.
- [GDPR Breach Notification: The 72-Hour Rule Step by Step](https://clevsec.one/blog/gdpr-breach-notification-72-hours/?ref=agent): When a GDPR personal data breach must be reported, when the 72 hours start, what the notification must contain, and when to tell the people affected.
- [GDPR Data Protection Impact Assessment: Step-by-Step Guide](https://clevsec.one/blog/gdpr-dpia-guide/?ref=agent): When is a DPIA required, what must it contain, and how to conduct one step by step. Practical guide for GDPR Article 35 compliance.
- [GDPR Record of Processing Activities (RoPA): What Article 30 Requires](https://clevsec.one/blog/gdpr-record-of-processing-activities/?ref=agent): What a GDPR record of processing activities must contain for controllers and processors, who is exempt under Article 30(5), and how to keep it current.
- [GDPR Special Category Data: The Article 9 Conditions Explained](https://clevsec.one/blog/gdpr-special-category-data/?ref=agent): What counts as special category data under GDPR Article 9, the ten conditions that lift the ban, key Court of Justice rulings, and the extra duties.
- [GDPR for SaaS Startups: The Minimum You Need on Day One](https://clevsec.one/blog/gdpr-for-saas-startups/?ref=agent): The GDPR minimum for a SaaS startup: controller and processor roles, the documents customers ask for, security, breaches, transfers and when you need a DPO.
- [How GDPR Fines Are Calculated: The EDPB Method in Five Steps](https://clevsec.one/blog/how-gdpr-fines-are-calculated/?ref=agent): How EU authorities calculate GDPR fines under EDPB Guidelines 04/2022: legal maximums, seriousness bands, turnover adjustment and a worked example.
- [How Much Does a GDPR Data Breach Really Cost? [2026 Data]](https://clevsec.one/blog/gdpr-breach-cost/?ref=agent): Beyond the headline fines — the true cost breakdown of a GDPR breach including legal fees, notification costs, customer churn, and remediation.
- [How to Answer an Enterprise Customer's Security Questionnaire](https://clevsec.one/blog/security-questionnaire-answers/?ref=agent): How to answer an enterprise customer's security questionnaire: what is asked, how to answer honestly, which evidence to attach and when a pentest is needed.
- [How to Audit an MCP Server: A Step-by-Step Security Review](https://clevsec.one/blog/how-to-audit-mcp-server/?ref=agent): How to audit an MCP server in eight steps: inventory, supply chain, tool descriptions, OAuth tokens, local servers, SSRF, prompt injection and logging.
- [How to Scope a Penetration Test (and What to Ask the Tester)](https://clevsec.one/blog/penetration-test-scoping/?ref=agent): How to scope a penetration test: objectives, test types, targets, rules of engagement, authorisation, deliverables, and what NIS2 and DORA expect from testing.
- [How to Write an Incident Response Plan (Free Template)](https://clevsec.one/blog/incident-response-plan-guide/?ref=agent): Step-by-step guide to creating an incident response plan that meets NIS2 and GDPR notification requirements.
- [Incident Response Tabletop Exercise: 5 Scenarios for Small Teams](https://clevsec.one/blog/tabletop-exercise-scenarios/?ref=agent): Five ready-to-run incident response tabletop scenarios for small teams, with injects, discussion questions and the GDPR, NIS2 and DORA reporting decisions.
- [Incident Response for AI Agents: Prompt Injection, Rogue Actions and Reporting](https://clevsec.one/blog/ai-agent-incident-response/?ref=agent): A playbook for AI agent incidents (prompt injection, data leaks, unauthorised actions) and which GDPR, NIS2, DORA, CRA and AI Act reports may be due, and when.
- [Information Security Policy: What to Include, Section by Section](https://clevsec.one/blog/information-security-policy-template/?ref=agent): What an information security policy should contain, based on the eleven elements EU rules list for NIS2 digital providers, plus topic policies and reviews.
- [Joint Controllers Under GDPR Article 26: When It Applies and What the Arrangement Needs](https://clevsec.one/blog/gdpr-joint-controllers/?ref=agent): When two organisations are joint controllers under GDPR Article 26, what the Court of Justice has said, and what the joint controller arrangement must cover.
- [Legitimate Interest Assessment: The Three-Part Test After EDPB Guidelines 1/2024](https://clevsec.one/blog/legitimate-interest-assessment/?ref=agent): How to run a legitimate interest assessment under GDPR Article 6(1)(f): the three cumulative conditions, the balancing test and what to document.
- [NIS2 Compliance Checklist for SMBs: Article 21 Measure by Measure](https://clevsec.one/blog/nis2-compliance-checklist/?ref=agent): A practical NIS2 checklist for SMBs: scope and registration, management duties, the ten Article 21 measures and incident reporting, with article references.
- [NIS2 Directive Explained: What It Is, Who Must Comply and What It Requires (2026)](https://clevsec.one/blog/nis2-directive-explained/?ref=agent): What is NIS2? Directive (EU) 2022/2555 explained in plain English: who must comply, the 10 Article 21 measures, 24h/72h/1-month incident reporting, fines, management liability and where national laws stand in November 2026.
- [NIS2 Incident Reporting: How to Meet the 24-Hour Deadline](https://clevsec.one/blog/nis2-incident-reporting/?ref=agent): NIS2 gives you 24 hours to file an early warning after a significant incident. Here is exactly what to report, to whom, and how to build a process that meets the deadline.
- [NIS2 Penalties: Fines, Supervision and Enforcement Explained](https://clevsec.one/blog/nis2-penalties/?ref=agent): How NIS2 is enforced: maximum fines for essential and important entities, what authorities weigh, supervision powers, and how NIS2 and GDPR fines interact.
- [NIS2 Registration: How and When to Register in Each EU Country](https://clevsec.one/blog/nis2-registration-by-country/?ref=agent): Where and when to register under NIS2 in all 27 EU countries: authority, portal, deadline and the data to submit. Checked 4 November 2026, updated monthly.
- [NIS2 Supply Chain Security: What to Ask Your Suppliers](https://clevsec.one/blog/nis2-supply-chain-security/?ref=agent): What NIS2 Article 21 requires for supply chain security, the detailed rules for digital providers, and the clauses and questions to use with suppliers.
- [NIS2 Transposition Status by Country: All 27 EU Member States](https://clevsec.one/blog/nis2-transposition-status/?ref=agent): NIS2 status in all 27 EU countries: the national law, the date it applies and the authority, checked 4 November 2026 and updated monthly.
- [NIS2 and the Board: Management Liability and Training Under Article 20](https://clevsec.one/blog/nis2-management-liability/?ref=agent): What NIS2 requires from management bodies: approving and overseeing Article 21 measures, training, personal liability and temporary bans on managers.
- [NIS2 for Managed Service Providers (MSPs and MSSPs)](https://clevsec.one/blog/nis2-managed-service-providers/?ref=agent): How NIS2 applies to managed service providers and MSSPs: definitions, size rule, jurisdiction, ENISA registration, Regulation 2024/2690 and incident thresholds.
- [NIS2 vs GDPR: What Is the Difference and How They Overlap](https://clevsec.one/blog/nis2-vs-gdpr/?ref=agent): The difference between NIS2 and GDPR in plain terms: what each protects, who must comply, 72-hour versus 24/72-hour incident reporting, fines, and how to comply with both without duplicating work.
- [NIS2 vs ISO 27001: How Much Does Certification Cover?](https://clevsec.one/blog/nis2-vs-iso-27001/?ref=agent): Does ISO 27001 certification make you NIS2 compliant? Where the standard and NIS2 overlap, and the legal duties certification does not cover.
- [NIST CSF 2.0 for Small Businesses: The Six Functions in Practice](https://clevsec.one/blog/nist-csf-2-small-business/?ref=agent): NIST Cybersecurity Framework 2.0 for small businesses: the six functions including Govern, profiles, tiers, and first steps that also support NIS2 and DORA.
- [OWASP Top 10 for Agentic Applications (2026) Explained, With Controls](https://clevsec.one/blog/owasp-top-10-agentic-applications/?ref=agent): The OWASP Top 10 for Agentic Applications 2026 (ASI01-ASI10) in plain English: what each risk means and the first controls to put in place.
- [Securing MCP Servers and AI Agent Tools: A Practical Checklist](https://clevsec.one/blog/securing-mcp-servers-ai-agents/?ref=agent): Security checklist for MCP servers and AI agent tools: supply chain, permissions, tokens, prompt injection, SSRF and monitoring, mapped to NIS2 and DORA.
- [Security Awareness Training: What NIS2 and DORA Expect](https://clevsec.one/blog/security-awareness-training-requirements/?ref=agent): What NIS2 and DORA require for security awareness and training: who must be trained, what to cover, how often, management training and proving effectiveness.
- [Selling Software to Banks and Insurers: What DORA Means for ICT Providers](https://clevsec.one/blog/dora-for-ict-providers/?ref=agent): What DORA means for SaaS and ICT providers with financial customers: contract clauses, audits, incident support, subcontracting, register data, oversight.
- [Standard Contractual Clauses: Which Module Do You Need?](https://clevsec.one/blog/standard-contractual-clauses-modules/?ref=agent): How to pick the right module of the EU standard contractual clauses (2021/914), what you must fill in, when the SCCs cannot be used, and common mistakes.
- [The Cyber Resilience Act and Open Source: Maintainers, Stewards and Companies Using FOSS](https://clevsec.one/blog/cyber-resilience-act-open-source/?ref=agent): How the Cyber Resilience Act treats open-source software: when it is commercial, the open-source steward regime, and duties for companies that ship FOSS.
- [The Right to Erasure Under GDPR Article 17: When You Must Delete, and When You May Refuse](https://clevsec.one/blog/gdpr-right-to-erasure/?ref=agent): When GDPR Article 17 requires deletion, the five exceptions, deadlines, telling recipients, backups, and what the EDPB's 2025 erasure enforcement action found.
- [The Six Lawful Bases Under GDPR Article 6: How to Choose the Right One](https://clevsec.one/blog/gdpr-lawful-basis/?ref=agent): The six GDPR lawful bases in Article 6, what "necessary" means after the Meta ruling, consent conditions, and how to choose and record a basis per purpose.
- [Top GDPR Fines in 2025-2026: Lessons for Your Business](https://clevsec.one/blog/top-gdpr-fines/?ref=agent): Analysis of major GDPR enforcement actions — what drives the largest fines, patterns across DPAs, and practical lessons for your compliance strategy.
- [Transfer Impact Assessment (TIA): How to Do One After Schrems II](https://clevsec.one/blog/transfer-impact-assessment/?ref=agent): When a GDPR transfer impact assessment is needed, the EDPB's six steps, Clause 14 of the SCCs, supplementary measures, and US transfers since the DPF.
- [Transferring Data to US SaaS: The EU-US Data Privacy Framework Explained](https://clevsec.one/blog/eu-us-data-privacy-framework/?ref=agent): When you can send personal data to US cloud and SaaS providers under GDPR: the Data Privacy Framework, how to check certification, and what to use instead.
- [Vendor Risk Assessment: A Practical Guide for Startups](https://clevsec.one/blog/vendor-risk-guide/?ref=agent): How to assess and manage third-party vendor security risk as a startup. Step-by-step process, tier classification, and contractual protections.
- [What Is a Cyber Risk Score and How Is It Calculated?](https://clevsec.one/blog/what-is-a-cyber-risk-score/?ref=agent): What a cyber risk score measures, the three common ways to calculate one, how our free score works, and how to use a score without fooling yourself.
- [What a GDPR Privacy Policy Must Contain: Articles 13 and 14 Checklist](https://clevsec.one/blog/gdpr-privacy-policy-requirements/?ref=agent): Every item GDPR Articles 13 and 14 require in a privacy notice, with article references, the extras when data comes from other sources, and when to provide it.
- [When Is an Incident Significant Under NIS2? The Thresholds in Implementing Regulation 2024/2690](https://clevsec.one/blog/nis2-significant-incident-thresholds/?ref=agent): The NIS2 significant incident test: Article 23(3), the general criteria of Implementing Regulation 2024/2690, and the thresholds for each digital provider type.

## Open data (JSON, CC BY 4.0)

- [EU incident and breach reporting deadlines (GDPR, NIS2, DORA, CRA)](https://clevsec.one/data/reporting-deadlines.json): When each reporting clock starts, the deadlines, and who receives the reports.
- [DORA major ICT-related incident classification](https://clevsec.one/data/dora-major-incident-criteria.json): The gate test, materiality thresholds and decision rule of Commission Delegated Regulation (EU) 2024/1772.
- [DORA compliance checklist: 59 requirements by article](https://clevsec.one/data/dora-checklist.json): Core DORA requirements for financial entities with article references and the scope exemptions stated in the regulation.
- [NIS2 minimum cybersecurity risk-management measures (Article 21(2))](https://clevsec.one/data/nis2-measures.json): The ten measures every essential and important entity must include, plus the related governance and reporting duties.
- [NIS2 scope: sectors, size rule and size-independent cases](https://clevsec.one/data/nis2-scope.json): Annex I and II sectors, the medium-size rule, the cases covered regardless of size, and the essential/important categories.
- [GDPR fine tiers and the EDPB calculation bands](https://clevsec.one/data/gdpr-fines.json): Article 83 maximums and the starting-point bands and turnover adjustments of EDPB Guidelines 04/2022.
- [Information a GDPR privacy notice must contain (Articles 13 and 14)](https://clevsec.one/data/gdpr-transparency-items.json): Each required item with its article in Art. 13 (data collected from the person) and Art. 14 (data from other sources).
- [EU compliance deadlines 2026-2028 (AI Act, CRA, DORA, NIS2, Data Act)](https://clevsec.one/data/compliance-deadlines.json): Dated EU compliance milestones with who they apply to, the article, and recurring dates; also as an iCal feed.
- [Changelog (JSON)](https://clevsec.one/data/changelog.json): what changed in the data and MCP tools, newest first

## Use from AI assistants (MCP)

- [ClevSec MCP server](https://clevsec.one/mcp/?ref=agent): remote MCP server at https://mcp.clevsec.one/mcp with deterministic, sourced tools for NIS2 scope and readiness, DORA incident classification and checklist, GDPR breach decisions, fine ranges and privacy notices, CRA reporting, AI Act scope and risk class, and EU reporting deadlines. Free, no key.
- [Trust Center](https://clevsec.one/trust/?ref=agent): how the browser tools and the MCP server handle data, what is logged, Pro OAuth sign-in, dependencies and vulnerability reporting

## Products and pricing

- [Product feed (JSON)](https://clevsec.one/products.json): templates and bundles with contents and prices
- [ClevSec Pro](https://clevsec.one/pricing/?ref=agent): $24 one-time for 30 days (Pro Report), or $9 per month or $79 per year, Pro features in 11 tools

## Optional

- [Full text of all guides](https://clevsec.one/llms-full.txt)
- [About ClevSec](https://clevsec.one/about/?ref=agent)