PhalanxFAQ
The questions we are asked first.
Short answers, each with a link to the page that covers it properly.
- What is Phalanx?
- A GRC platform for ISO 27001, ISO 9001, NIS2 and the CRA, with packages for each organisation and optional security monitoring. NIS2 coverage includes obligations towards Romania’s DNSC.See details
- How do I map ISO 27001 to NIS2?
- The NIS2 package can be used on its own. If you already have ISO 27001:2022 controls, the platform maps them to points a) to j) of Article 21. It separately tracks obligations towards DNSC and incident reporting deadlines. Automated checks carry references to the controls and requirements they support, for example ISO 27001 A.8.24 and NIS2 Art. 21(2)(h).See details
- Who is it for?
- Companies checking their sites’ exposure, organisations with compliance requirements and providers running services for clients. Start with External scans, CRA package or NIS2 package. Partners receive the whole platform.See details
- Hosted by you, or on our own servers?
- Either. The hosted service includes platform administration, on servers currently located in Germany; if that location changes, clients hear about it first. With self hosting, you install the platform on your own servers, every module stays enabled and you choose when to update. External-service use depends on the chosen configuration.See details
- Which frameworks does it cover?
- ISO 27001 and ISO 9001 have separate pages. For ISO 9001, keep the 2015 edition or preview the move to 2026. NIS2 covers incidents and obligations towards DNSC. CRA covers products, SBOMs and reporting. SOC 2 has criteria labels, and GDPR has a processing register.See details
- Do you file NIS2 or CRA reports for us?
- No. The platform counts the deadlines, flags what has run past them and prepares the export, but the submission stays an act of your company, made by a person who answers for it. For the CRA, it first determines whether you have anything to file at all.See details
- We have no documentation. Where do we start?
- With questions. The platform runs a structured interview per control and writes the policy from your answers. If you do have documentation, it ingests it from an archive or your document library and shows which controls have a policy, which have none, and which have one with no sign it is practised.See details
- Does the AI publish anything on its own?
- No. It drafts policies for the controls you are missing and suggests improvements, and a human reviews and approves every one before it goes live. Document creation, editing and approval are recorded in an append only log.
- Do we need our own SIEM?
- External scans and compliance packages work without your own SIEM. For Monitoring, we agree the event-source setup together. Compatibility with an existing system is checked during technical evaluation.See details
- How long does onboarding take?
- Almost entirely on where your documentation stands today. An organisation with its policies already written works differently from one starting from nothing, so that is the first thing we work out together. The technical side is not what holds you back: the account is opened the same day, and your data is isolated from the first login.
- How is our data kept apart from other clients?
- The database enforces separation by client. Client users stay in their own space, and operators access only clients they have been granted. With self hosting, data is stored on your infrastructure; external services depend on your chosen configuration.See details
- How much does it cost?
- Choose External scans, CRA package, NIS2 package or Compliance. Compliance includes external scans, CRA, NIS2, ISO 27001 and ISO 9001. Monitoring is an add-on. Partners receive the whole platform. Request a quote for your setup. We do not publish a price table.See details
- How do we start?
- Write us a few lines through the quote form: which sites you want to scan or which requirements you have, and whether you want it hosted or on your servers. A person replies, and if we are not the right fit we say so directly.
- Can I start with one package?
- Yes. For direct customers, modules are enabled per organisation. Modules that are not enabled have a muted menu entry with a preview. You can request a quote there when a sales contact is configured.See details
- What do I need before the first scan?
- Add the domain and publish the DNS TXT record shown by the platform. Once verified, you can scan the sites covered by that domain. A target can be registered earlier, but scans skip it until the domain is verified.
- How are backups protected in the hosted service?
- We create encrypted backups every night. Each week we test restoring the database from the latest backup. For self hosting, backup responsibilities and configuration are agreed at installation.
Did we miss your question?
Ask it in the quote form. A person replies, usually within the same working day.