Project
A complete Greek GRC engagement kit for NIS2, DORA and ISO 27001, generated from code.
Where it runs: On my own computer
An organisation that falls under NIS2 in Greece (Law 5160/2024 and ΚΥΑ 1689/2025) or under DORA needs far more than one policy. It needs a gap analysis, a documented risk method, a policy suite, incident reporting within 24 hours, 72 hours and one month, continuity plans, staff training and reports a board can approve. Each piece is often written separately, by different people, in different styles, and none of it updates itself when the rules change. I wanted to see what one consistent, complete set would look like.
The GRC Toolkit is my own Greek-language kit with every document a governance, risk and compliance engagement produces, from the first gap analysis to the board report. It covers ISO 27001:2022, NIS2 as transposed in Greece and DORA. It includes a full worked example for a fictional organisation, so each deliverable can be seen filled in. Every file is generated from code, so the whole set stays consistent and can be rebuilt in one run.
Scope: the project tools (proposal and statement of work, project plan, status report) set out what will be delivered and when.
Assess: the gap analysis workbook for the relevant framework and the 5x5 risk tool show where the organisation stands.
Treat: the security measures catalogue, the policy suite and the security study and plan templates turn the gaps into measures and documents.
Prepare: continuity, incident response and awareness material cover the obligations that are tested when something goes wrong.
Report and check: board report, KPIs and an internal audit plan show management the progress and close the loop.
149 files: 73 Word documents, 39 Excel workbooks and 6 PowerPoint decks, in thirteen sections from the operating model of a GRC function to project tools. All share one structure, one naming convention and one visual style, and the policy and plan templates leave the organisation's name as a field to fill in.
A separate gap analysis for the Greek transposition, not only the EU directive: 60 points from articles 4 to 25 of ΚΥΑ 1689/2025 and 14 obligations of Law 5160/2024, 74 in total. Points that apply only to essential entities are marked, so an important entity can record them as not applicable with a reason. ISO 27001:2022 and DORA have their own gap workbooks.
A risk assessment methodology and workbook with a 5x5 likelihood and impact scale, a catalogue of 45 threats and 30 example risks to start from. A catalogue of 54 security measures maps each measure to ISO 27001, ΚΥΑ 1689/2025, DORA and CIS Controls v8.1.
A policy framework and 17 policies, from information security and access control to supplier security and secure development. Templates for a security study and a security plan, a business impact analysis workbook and a BCP/DRP, an incident response plan with playbooks for ransomware, phishing and data breaches, an incident register, and notification forms for the 24 hour, 72 hour and final reports and for personal data breaches. Awareness material includes a programme, a calendar, a staff deck and a quiz.
Four framework kits (ISO 27001:2022, NIS2 EU, NIS2 Greece and DORA), each with a requirement library traced to its source, workshop questions, a scoring workbook, a report chapter, an action prioritisation tool and an internal audit checklist. A complete sample project for a fictional organisation shows 37 filled deliverables, from the signed statement of work to the quarterly board report. All names and figures in it are invented.
Every document is produced by Python and JavaScript generators: separate engines for Word, Excel and PowerPoint, content kept as data files, and a documented run order that rebuilds the whole kit. When a rule or the branding changes, I change it once and regenerate. A verification script checks that every framework kit contains each source requirement exactly once, with identical wording, in source order.
The kit is 41 generator files and about 7,480 lines of Python, JavaScript and PowerShell. Excel workbooks are built with openpyxl, Word documents with python-docx and the docx library, and slides with PptxGenJS. A final step writes the same colour theme and fonts into every Office file, so anything added later in Office keeps the style.
A companion GRC Department Build Plan in 12 chapters describes how to set up and run a GRC function: operating model, deliverables, a four-phase roadmap and naming and version rules. Each chapter ends with prompts for an AI assistant to draft the matching deliverable, followed by a review of the result and a check of every legal reference against official sources.
The full set was last generated in October 2026. I built it with AI agents, from the standards and policies I have worked with and from public material, and I reviewed the structure and a sample of the documents myself. It is a base to start from, not a finished deliverable: each document says what belongs in it and has to be adapted to the organisation. I have not used it on an engagement yet. The legal content reflects the files as of October 2026 and has to be checked against official sources before each use.
Stack
Still under construction
The Tsakmak brand and this website are still being built, so some pages and details are not final yet. Thank you for your patience.