Donegal Readiness • European cybersecurity

Know where you stand.
Know what proves it.
Know what to fix next.

An evidence-driven readiness platform that connects framework obligations with actual operating evidence—and introduces an evidence-gated Board Assurance view above detailed CRA, ISO 27001 and NIS2 reports.

CRA first EU-first roadmap Evidence-driven Board-first reporting
Explore Board Assurance Explore Readiness in your Portal

One Donegal account. Availability is shown in your Portal. The Gray illustration is deliberately unassessed and stores nothing.

DONEGAL / BOARD ASSURANCEResearch-stage preview
GRAYInsufficient AssuranceUnknown is not safe.
Board decision required

Approve the assessment boundary and risk appetite. Examine critical dependencies and ask for reviewed operating evidence before treating a controlled conclusion as justified.

See how Board Assurance works →
Rated intersections
0 / 20
Risk appetite
Not documented
Independent challenge
Not established
Confidence
Insufficient

Illustrative unassessed state. Not a certification, an independent assurance opinion or an actual customer report.

Nearly 20successful FedRAMP Moderate and High authorization efforts in the founder’s federal work
Independent researchDeming/PDSA improvement and organizational actualization grounded in the founder’s dissertation and applied work
One principlean assertion is not proof that a process operates
Board-level evidence / Not another averaged score

An executive judgment you can question.

Six evidence-gated signals—not one opaque number. Gray means insufficient assurance. Red can take precedence when a severe uncontrolled condition is actually substantiated. The conclusions preserve risk appetite, confidence, unknowns and the Board's accountable next decision.

Under the signal: five independent measures across organizational, people, physical and technological domains. Twenty intersections, each requiring current, scoped evidence and review. The existing framework reports retain their own meaning.

See the full Board Assurance modelExplore the underlying method

Provisional research-stage methodology · No formal attestation, independent assurance grade or automatic certification.

06distinct executive signal states
05independent measures, never merged into one grade
04organizational, people, physical and technological domains
20cells where unknown remains unrated, not zero
The Donegal method

One number cannot tell the truth.

Maturity, readiness, evidence and risk answer different questions. Donegal keeps them separate—and makes every result explainable.

01

Maturity

How consistently the capability is owned, defined, measured and improved.

Initial → Managed → Defined → Quantitatively Managed → Optimizing
02

Readiness

How prepared the target is to meet the applicable requirements of a particular framework.

Framework-specific and scope-aware
03

Evidence

Whether implementation is merely claimed, supplied, reviewed or independently verified.

Claimed ≠ demonstrated
04

Risk

What the remaining gaps could mean—before controls, after controls and in context.

Inherent → controls → residual
A live slice of the method

Change the evidence. Watch the judgment change.

This is one illustrative capability—not an assessment result. It demonstrates why “yes” is never enough.

Sample capability / Vulnerability management

How consistently does the organization identify, assess and act on vulnerabilities affecting the product or service?

Implementation judgment
Evidence state
Operating effectiveness
Answer once. Prove once. Map carefully.

One body of proof. Many requirements.

Customers should not have to answer the same security question again because the citation changed. Donegal maps reviewed capabilities and evidence across versioned framework requirements while preserving every framework’s scope and meaning.

Mappings indicate reusable capability and evidence—not certification, conformity or regulator endorsement.

Initial productCRAProduct readiness
Core expansionNIS2 • ISO 27001 • DORAEntity, ISMS and financial resilience
EU certificationEUCS • EUMSS • EUCCCandidate modules clearly marked preview
National overlaysC5 • SecNumCloud • ENSAdded after the EU scheme foundation
From scope to defensible change

A readiness process built to finish.

The platform moves every gap toward evidence and verification instead of leaving customers with another static report.

  1. 01ScopeIdentify the target and applicable obligations.
  2. 02AssessAsk only what matters to that target.
  3. 03ProveConnect claims to evidence.
  4. 04PrioritizeSeparate material exposure from noise.
  5. 05RemediateAssign owners, dates and closure tests.
  6. 06ReviewEvaluate evidence and operating effectiveness.
  7. 07ReportGenerate explainable, versioned outputs.
Grounded inPracticethe founder’s work across federal and international security frameworks—not survey software dressed as compliance.
Independent research · Professional experience

Independent research. Practical judgment.

Donegal Readiness is independently developed by Donegal Studio and its founder, William Ochs. Its Deming/PDSA improvement and organizational actualization measures draw on his own professional experience, academic research and dissertation work—not on a former employer’s proprietary intellectual property.

William’s earlier professional work included federal and international cybersecurity programs and nearly 20 successful FedRAMP Moderate and High authorization efforts. Those are career accomplishments, not a Donegal product credential or a former employer’s endorsement. Donegal Readiness remains in development, beginning with the EU Cyber Resilience Act; it does not claim to support every framework today.

Its five-level capability judgments reference the published CMMI maturity progression, while Donegal independently develops its framework-specific questions, evidence tests, Deming/PDSA improvement measures, organizational actualization approach, risk logic and scoring rubric. It is not a CMMI appraisal.

Donegal is developing the assessment model and software independently for European requirements and the organizations expected to meet them. No Cisco-owned code, templates or proprietary program materials are incorporated into this product.

Your readiness workspace

Start with your framework.
Build your next step from there.

Your Donegal Portal shows Readiness availability and the next step. As access is enabled, choose CRA, ISO 27001 or NIS2 and begin with the limited Readiness Lite introduction. Explore software plans from the same account as deeper access is released. Your saved work stays with your workspace; optional expert support is a separate choice.

Through Donegal’s partner program, clients can also access qualified legal counsel and be connected with conformity assessment bodies (CABs) and laboratories capable of conducting applicable audits and testing.

Explore Readiness in your Portal
Donegal Readiness supports preparation and evidence-based decision-making. Legal advice is provided by qualified counsel; independent audits and testing are performed by the CABs and laboratories clients engage through Donegal’s partner program. The platform itself does not issue conformity decisions, certifications or regulator endorsements. EUCS and EUMSS content will be identified as candidate-scheme preview material until adopted.