GRUMPY BEARGRC & INFOSEC DIGITAL PRACTICE
Client login
( COMING SOON · GOVERNED. NOT GRUMPY. )

Everything you need for the AI era. Governed.

A complete governed operating framework for EU financial services. DORA, the EU AI Act, NIS2, GDPR and the payments regime (PSD2, the Instant Payments Regulation, PCI DSS), mapped to the processes and controls that satisfy them. One flat annual fee, updates included when regulation changes. The bear is putting the finishing touches on the den.

11DOMAINS
78PROCESSES
68ICS CONTROLS
92IT STANDARDS
8LANGUAGES

Be first into the den

One click opens a pre-addressed email. Hit send and you're on the list for the launch date and founder pricing for the first licensees. Nothing else follows; the bear doesn't do drip campaigns.

✓ You're on the list. Talk soon.

One launch announcement + founder offer, then you're forgotten unless you reply. No sharing, no tracking pixels. Unsubscribe = one reply. GDPR the way we'd audit it.

A peek inside

Licensees see it sharp. Here's the shape of what's coming.

THE BEAR’S DEN
Strategy & Governance
Service Planning
Solution Delivery
Infrastructure & Ops
Security, Risk & Compliance
Data & AI Governance
Financial Management
People & Culture
Zero Trust
Payments
Health Data & HIPAA
11 domains · 78 processes
CONTROLS & EVIDENCE

IC-14 · Access recertification

2nd LoDQuarterlyAutomatable

Evidence: system-generated recertification report, approver trail…

Test procedure: sample 10 movers, verify entitlements against…

Integration path: IAM → BI dataset → control dashboard…

68 controls, evidence by design
REGULATORY REGISTER
DORA Art. 6ICT risk management framework → SR-02, SG-04, 5 controls
AI Act Art. 9Risk management for high-risk AI → DI-05, DI-06, 3 controls
NIS2 Art. 21Cybersecurity risk measures → SR-01…SR-07, ZT-01
GDPR Art. 32Security of processing → SR-03, DI-02, 4 controls
EBA GLOutsourcing arrangements → SP-05, register of information
Mapped both directions
GROW-YOUR-DASHBOARD

Control health · evidence freshness · maturity per domain, on the BI stack you already own

Integration hints per control
THE PAYMENTS DESK
SafeguardingRelevant funds €4,213,900 · segregated €4,213,900 · shortfall €0.00 ✓ 2LOD signed
ReconciliationSEPA SCT closed, 0 breaks · SCT Inst closed, 1 break inside threshold
VoPVerification of Payee live on all credit transfers · match-rate drift alert armed
SCA & fraudExemptions governed · fraud rate inside reference band · Art. 96(6) report on schedule
MandatesEPC November release, 74 days out · owner assigned · delivery plan approved
PCI DSS v4.0.1Evidence current, incl. formerly future-dated requirements
10 payments processes · every obligation mapped
SOVEREIGN BY DESIGN
JurisdictionLawful-access exposure assessed per provider (CLOUD Act, FISA 702), not assumed
Key custodySovereignty-sensitive workloads on customer-held keys · revocation tested
ResidencyHosting regions verified against contract · drift monitored, new regions default off
TransfersTIA current for every third-country transfer · post-Schrems II sign-off on file
ExitExit plan per critical service · switching path exercised, not just filed
Data ActArt. 23–31 switching clauses in contract · egress fee phase-out tracked
Your data, whose laws: answered

Behind the door: your den

What a licence actually opens.

Every licence opens a private den on grumpybear.nl: an unguessable address plus credentials only your organisation holds, one den per client, nothing shared. Inside sits everything the licence includes: The Suite as an interactive framework, 11 domain handbooks, 11 assessment workbooks, the 55-template toolkit and the six-phase implementation guide, in 8 languages, refreshed automatically when regulation changes. No projects, no invoices: when the register moves, your den moves with it.

The workbooks (self-audit, maturity, payments governance, sovereign cloud readiness) are downloaded and completed inside your own environment. Your assessment data, your gaps, your scores never touch our servers. The den holds blank instruments; you hold the answers.

One den per organisation · credentials handed over on two separate channels · your door is ready within a day of licensing.

The next regulation is an update you already own.

11 domains, 78 processes and 68 controls, kept current for one flat annual rate. Nothing to install, nothing to re-map, and nothing to explain to your IT team.

hello@grumpybear.nl · grumpybear.nl · Independent practice, EU-hosted 🇪🇺 · The bear stays grumpy so you don't have to be.
Existing clients: your den link works as always.