01
Process and roles
Choose an audit follow-up plan, risk register, TrustGuard process or ongoing control reviews. Identify action owners, evidence reviewers and report recipients: management, the client or an auditor.
Applications supporting controls
Nexus: risks and actions
After an audit or workshop, recommendations need owners and a way to verify completion. Nexus brings risks, actions, deadlines, evidence and decisions into one register. We tailor fields, reports and views to your process so management, IT and the people responsible for compliance and audit can review progress.
Trusted by
Companies and institutions that need stable IT.
Turn findings into assigned actions
Nexus supports follow-up work after an audit, an IT assessment or a workshop. It maintains action plans, exceptions and matters requiring a business decision. It can support NIS2, DORA, ISO 27001, KSB 315 and TrustGuard projects, as well as ongoing IT support. The register distinguishes accepted risks, work in progress and actions completed and documented. Accepting a risk means deciding to retain it, not confirming that its cause has been removed.
Related solutions
Nexus helps organise actions within these processes. These pages describe separate applications and services, not features automatically included in every implementation.
Audnexa
Audnexa helps banks organise requirements, questions, documentation and gaps across KSC/NIS2, ISO 27001, DORA and KNF. Discuss a demonstration and pilot.KSB 315 audit
IT analysis supporting a financial statement audit. Nexus helps the audited entity or audit firm track findings, evidence gaps and recommendations.TrustGuard
Virtline’s programme with requirements and reviews. Nexus can organise the level, gaps, evidence and scope of annual supervision.IT outsourcing
Ongoing support, helpdesk, agreed SLAs, monitoring, backup and Microsoft 365. Nexus can connect remediation plans with responsibility for ongoing operations.ISO 27001 · TÜV NORD Polska
TÜV NORD Polska has certified Virtline’s information security management system to PN-EN ISO/IEC 27001:2023-08. The published certificate states its scope and validity.
View Virtline’s certificateHow the setup runs
We start with one process and expand after checking its usefulness. A consultation based on a report, recommendation list or workshop defines the pilot and an initial reporting model.
02
Fields and criteria
Agree priorities, deadlines, statuses, decisions, review dates and required evidence. Define closure criteria and matters that need escalation for a business decision.
03
Pilot with findings
Add selected, useful findings from a report or workshop. Link actions to evidence and check the configured views and reports. We do not assume that the entire history from every spreadsheet must be imported.
04
Reviews and next steps
Agree review frequency, responsibility for updates and escalation arrangements. Check the register’s usefulness before adding further areas or connecting the action plan to agreed IT support.
Practical scope
What Nexus organises
We agree the fields and views for the chosen process. The register supports decisions and verification of completed work, not just file storage.
Risk description, affected system, business impact, urgency, priority and owner. Decisions record acceptance, remediation or escalation and the next review date. Exceptions remain visible to the people responsible.
The follow-up plan defines an owner, status, deadline and acceptance criteria. A report, configuration, log, record or approved decision documents the outcome. Closing an action through risk acceptance does not mean a technical fix has been implemented.
Backup reports, restore tests, account lists, configuration reviews and change confirmations. Evidence packages can support management, clients, auditors or certification preparation. Adding a file does not establish control effectiveness; evidence needs assessment against agreed criteria.
Accepted risks, overdue work, evidence awaiting approval and actions without owners. Reports show what has been closed, what is missing and which matters need a decision by the company or its client.
Control reviews
Nexus can organise recurring reviews of access, backups, incidents, training and suppliers. Tasks have owners, deadlines and supporting materials. The register records findings and evidence of work; backups, monitoring and response remain separate services. Nexus does not replace security tools or service agreements.
Services related to follow-up work
Audit, implementation and test results can be recorded in Nexus, with tasks assigned and progress tracked. We agree the scope of each service below separately.
-
NIS2 audit
A review of gaps and risks, with recommendations requiring owners and follow-up actions.
-
NIS2 implementation
Work on safeguards, procedures and documentation within an agreed plan.
-
Cybersecurity
Audits, safeguards and response support selected according to business risk.
-
Security training
Training on phishing, document confidentiality, data protection and incident procedures.
-
Backup and data recovery
Backups, recovery and tests whose results can provide material for review.
-
Multi-factor authentication
Additional sign-in verification and access protection matched to accounts and services.
-
IT monitoring
Service availability checks, alerts and agreed thresholds requiring a response.
-
SOC / SIEM / SOAR
Security event analysis, incident handling and response coordination.
Questions about Nexus
Is Nexus a fixed package?
+
It is an application supporting Virtline processes. We tailor its fields, reports and views to audits, compliance, certification, outsourcing or ongoing control reviews. We start with one process and agree the implementation scope. This page does not describe an identical feature package for every company. Before an offer, we agree the delivery model, data location, roles, access controls, export and maintenance. We do not assume every option is available in every deployment.
Does Nexus replace an audit or a GRC system?
+
No. It organises findings, actions, decisions and evidence, but does not replace an auditor’s assessment or a full governance, risk and compliance (GRC) programme. It can support NIS2 audits and implementation, DORA projects or ISO 27001 work. Register entries do not independently establish compliance or ensure certification.
How does Nexus support KSB 315 and TrustGuard?
+
It helps track IT risks, evidence gaps, recommendations and action status. The audit team can review collected material for audit documentation and matters requiring a client decision. For TrustGuard, the register can cover the level, requirements, gaps, review dates and annual supervision. Nexus does not replace the statutory auditor’s assessment or award a TrustGuard level.
How does Nexus differ from Audnexa?
+
Audnexa helps banks organise questions and documentation across KSC/NIS2, ISO 27001, DORA and KNF. Nexus tracks risks and actions after findings are assessed: owners, deadlines and closure evidence. Transfer of findings is agreed for the project.
Choose your first process
Describe the report or recommendations, participant roles and how actions are approved. We will agree the pilot scope, closure criteria and the view needed for decisions. Do not send passwords or confidential audit documents through the form.
Discuss Nexus for your process