Test Test Product

Listing tier Get Listed Last evaluated September 2026 Methodology CL v4.0

Test Test Product

Strong fit on NIS 2, Moderate fit on HIPAA, GDPR

Strong fit on NIS 2 and moderate fit on HIPAA and GDPR: Test Test Product keeps immutable copies of critical data and restores them quickly, without by itself making your organisation compliant.

Regulatory fit

3 regulations

Category fit

88% 7 of 8 capabilities documented

Sector stakes

21 days Average downtime after a ransomware attack without usable backups, demo survey.

What Test Test Product covers, and what remains with your organisation to operate or decide.

Covered by the software ?

0 Technical

Obligations the software executes itself, such as keeping immutable copies.

See the requirements

Operated by your organisation ?

0 Operational

Processes your teams run with the software, such as restore tests.

See the processes

Decided by your organisation ?

0 Management

Decisions your organisation owns, such as recovery objectives.

See the decisions

Top 3 Findings

Backups are written to immutable storage that ransomware cannot encrypt or delete.
Restore tests run automatically every week and produce a report.
Recovery time objectives are tracked per application.

Top 3 Caveats

Loremi-psumdo lorsitam: etc onsec tetur adipi scin gel itsedd oeiusmodtempo rin cid idu ntut laboreetdolor emagna.
0 loremipsu mdolorsita met co nsecte turadipiscing (EliT seddoeiusmo dtempo).
Loremips umdol orsitam e tconse cteturad ipiscingel itse dd oeiu smod.

1.2

Software profile

Test Test Product backs up servers, databases and virtual machines to immutable storage and automates restore testing. It is not an endpoint protection tool, an archiving system or a disaster recovery site.

Category coverage

Test Test Product documents 7 of the 8 capabilities Compliance Labs defines for Backup & Recovery software (88%). See breakdown

DeploymentOn-Premise, SaaS EnvironmentInformation Technology (IT), Operational Technology (OT) RegionEurope, Americas IndustryHealthcare, Energy & Utilities, Financial Services

Test Test Product addresses immutable backup and fast recovery. To build a complete posture, plan adjacent categories: Endpoint Detection & Response, Disaster Recovery as a Service, Data Security Posture Management, Archiving & eDiscovery, Business Continuity Management.

1.3

Sectoral briefing teaser

Healthcare

21 daysdowntime

Hospitals without usable backups stayed offline for three weeks on average in the demo survey.

Demo Breach Cost Survey 2026, p. 14

Financial Services

48%of attacks

Nearly half of ransomware attacks tried to destroy backups first, demo report.

Demo Sector Threat Report 2026, p. 9

Technology & Communications

4htarget

Four hours is the most common recovery objective set by technology firms in the demo sample.

Demo Regulator Outlook 2026, p. 3

Test Test Product reduces one recurring cause of long outages: backups that ransomware can reach. See sector insights

1.4

Reading paths for other roles

For CRO / Board

Sector exposure, breach costs, insurer expectations and board accountability, sourced.

See the sector briefing

For DPO

GDPR Art. 32(1)(c) restoration of availability, HIPAA contingency plan and NIS 2 business continuity measures.

See NIS 2 & HIPAA detail

For Procurement

Vendor responsibilities under each regulation: SLA, sub-processors, right-to-audit.

See vendor responsibilities

For Auditor / Consultant

Methodology, source sampling, triple traceability, what was not examined.

See Methodology & Evidence

2.1

Coverage Snapshot ?

7 / 8

capabilities documented, 88% of the Backup & Recovery software reference ?

4 of 7 run out of the box (vendor-stated)

4 out-of-box – 3 config – 0 not specified

3/3

Data Protection

2/2

Recovery

1/2

Cyber Resilience

1/3

Disaster Recovery as a Service (adjacent)

Not documented (1): SaaS application backup.

Category intelligence

Backup vendors are adding anomaly detection to spot ransomware before it spreads to copies. Demo Market Brief 2026

Regulators now ask for proof of restore tests, not only for backup schedules. Demo Audit Practice Survey 2026

2.2

Capability coverage detail

Each capability signal (Table-Stakes, Out-of-box, Config change, and the rest) is defined in the glossary.

Data Protection 3 of 3 capabilities documented

Capability	What it does	Audit caveats	Mapping
Immutable backup storage Table-Stakes Out-of-box	Writes backups to storage locked against modification and deletion for a set period.	Lock periods are set per policy.	6 obligations
Database-consistent backup Table-Stakes Out-of-box	Captures databases in a consistent state without stopping the application.	Supported engines are listed in the documentation.	5 obligations
Loremi psumdolors Lorem-Ipsumd Lor-em-ips	Loremips umdolor si tametco nse ct etur adip iscingel-itseddo eius.	Lor emipsumdol orsi ta metconse CTE.	0 obligations

Recovery 2 of 2 capabilities documented

Capability	What it does	Audit caveats	Mapping
Loremipsu mdolors itametc Loremips Loremi psumdo	Loremips umdolor si ta metconse ctetura dipis cing eli tseddoe ius modtem.	Lore mipsu md olorsi ta met consecte.	0 obligations
Loremip sumdolo rsitame tconsect Loremips Loremi psumdo	Loremi p sumdolo rsitame tconsect etur adipis cingeli tsedd oe iu smodtemp.	Loremipsumd olorsit am etcons ectetur adipi.	0 obligations

Cyber Resilience 1 of 2 capabilities documented

Capability	What it does	Audit caveats	Mapping
Loremipsum dolorsi tametcons Loremips Loremi psumdo	Lorem ipsumdo lorsi tametc onse cteturad ipis cingelitse.	Loremi psu mdolorsi.	0 obligations
LorE mipsumdolor sitame Loremips Not in Vendor Doc	Loremipsu mdolorsita me tco nsectetu: radipi sc IngE litsed doei us Modtempor 000. Inc ididu nt utl aboree tdolor emagnaaliqual.		n/a

Governance 1 of 1 capabilities documented

Capability	What it does	Audit caveats	Mapping
Loremips umdolorsi tametcons Lorem-Ipsumd Lor-em-ips	Loremi psumdolo rsita met cons ecteturadi pis cingelitsed doe iusmodt empo.	Loremipsum dol orsitam et con sectetur.	0 obligations

2.3

Architecture, Deployment & Data Flow

Deployment models

On-premises appliance
Software on customer servers
Managed SaaS vault

Database compatibility

Microsoft SQL Server
Oracle Database
PostgreSQL
MySQL

OS & Runtime

Windows Server 2019 and later
Red Hat Enterprise Linux 8 and 9
VMware ESXi 7 and 8

Integration & Ecosystem

S3-compatible object storage
VMware vSphere and Microsoft Hyper-V
ServiceNow ticketing
REST API

2.4

Vulnerability Resilience ?

10 days median time to patch a critical vulnerability, vendor-stated Demo vendor security page, 2026

Patch cadence Vendor-stated

Critical fixes are released within ten days according to the vendor.

Security advisory page

Penetration testing Stated, not verified

An annual third-party test is mentioned; the summary is not public.

Trust center

Vulnerability disclosure Vendor-stated

A disclosure policy with response times is published.

security.txt

Software bill of materials Stated, not produced

An SBOM is announced but not yet available.

Roadmap page

Secure development Vendor-stated

The vendor states it follows a secure development lifecycle.

Security whitepaper, section 3

3.2

Regulation Detail

Each regulation is broken down article-by-article with the corresponding software contribution, capability link, relationship (formal control relationship typology), scope impact and evidence reference. At Get Listed, all software contribution signals are Vendor-Stated

Hide verdict and relationship legend

Verdict, what the software does

Covers – Addresses the obligation directly through a documented mechanism it executes.

Contributes – Addresses part of the obligation; your organisation operates the process that completes it.

Supports – Produces outputs that feed a governance decision your organisation makes.

Relationship, how the capability attaches to the obligation

Direct – Fulfils the obligation through a mechanism named in the regulation.

Contributing – Adds value but the obligation is broader.

Supporting – Participates indirectly.

Equivalent – Replaces the obligation's named mechanism.

Full definitions in the glossary.

NIS 2 – EU Critical Sectors

Strong fit on NIS 2: backup management and recovery are named cybersecurity risk-management measures executed by the software.

Strong

Profile & intent

EU directive on cybersecurity for essential and important entities, transposed by Member States since October 2024.

Why this software matters here

Article 21(2)(c) names backup management and disaster recovery explicitly.

Sectoral pains 2026

Proving that backups can actually be restored.
Keeping backups out of reach of ransomware.
Reporting recovery capability to the national authority.

Evidence at Get Listed. All Software contribution signals below are Vendor-Stated, based on Test public documentation. Compliance Labs (CL) has organised these claims, mapped them to NIS 2 articles and applied formal control relationship typology. Outcome verification is not within Get Listed scope.

How Test Test Product supports NIS 2, by control nature

Showing the 6 most decision-relevant obligations of the 11 mapped. All contribution signals on this table are vendor-stated.

Obligation	Software contribution	Verdict	Relationship	Scope impact	Evidence ref
TechnicalMechanisms the software executes
Art. 21(2)(c) business continuity, such as backup management and disaster recovery	Keeps immutable backups and restores them.	Covers	Direct	Reduces exposure : immutable copies kept	Vendor documentation, p. 4?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
Art. 21(2)(h) policies and procedures regarding the use of cryptography and encryption	Encrypts backups with customer keys.	Contributes	Contributing	Reduces exposure : backups encrypted	Vendor documentation, p. 7?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
OperationalProcesses your organisation operates, software-assisted
Art. 21(2)(f) policies to assess the effectiveness of risk-management measures	Weekly restore tests measure effectiveness.	Covers	Direct	Documents control : weekly test reports	Vendor documentation, p. 4?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
Art. 23(1) notify significant incidents to the CSIRT	Recovery reports support incident notification.	Supports	Supporting	Enables process : facts for notification	Vendor documentation, p. 7?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
ManagementGovernance decisions your organisation makes
Art. 20(1) management bodies approve risk-management measures	Reports support management approval.	Supports	Supporting	Documents control : board-level reports	Vendor documentation, p. 4?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
Art. 21(1) take appropriate and proportionate measures	Recovery objectives make proportionality visible.	Supports	Supporting	Enables process : objectives per app	Vendor documentation, p. 7?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).

Vendor Posture for NIS 2

Vendor-level contractual posture, complementary to org-operated coverage. Not scored.

Restore evidence

Restore test reports can be shared with authorities.

EU data residency

The SaaS vault offers EU-only regions.

Compliance scope impact, time to recover critical services

Before Test Test Product

Weeks : restores are rarely tested and often fail

Instant recovery starts machines from backup storage.

After Test Test Product

Hours : tested restores within the recovery objective

Recovery time drops from weeks to hours in the demo scenario.

Not addressed in this regulation

Art. 21(2)(d)supply chain security

Not engaged

HIPAA – US Healthcare

Moderate fit on HIPAA: supports the data backup and disaster recovery plans of the contingency plan standard.

Moderate

Profile & intent

LO remipsu mdolo rsitametco nsecte turadipisci, ngelitse dd OEI USM.

Why this software matters here

Lore mipsum dol orsitame tconsect etura dip iscingel itseddoeiusmod temporincididu.

Sectoral pains 2026

Loremips umdolor sitamet con secte turad ipiscingel.
Lo remip sumd olorsit am eTCO nse ct eturadip.

Evidence at Get Listed. All Software contribution signals below are Vendor-Stated, based on Test public documentation. Compliance Labs (CL) has organised these claims, mapped them to HIPAA articles and applied formal control relationship typology. Outcome verification is not within Get Listed scope.

How Test Test Product supports HIPAA, by control nature

Showing the 0 most decision-relevant obligations of the 0 mapped. All contribution signals on this table are vendor-stated.

Obligation	Software contribution	Verdict	Relationship	Scope impact	Evidence ref
LoremipsuLoremipsum dol orsitame tconsect
000.000(l)(0)(or)(E) loremipsu mdolorsita me tconse cte turadipi scingelitse ddoei usmodt em pORI	Lorem ipsum, dolorsita metcon.	Loremi	Loremi	Loremip sumdolor : loremipsumd olorsi	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
000.000(l)(0)(or) loremipsu m dolorsita me tconsec tet uradipi sCIN	Loremips umdolor si tAME.	Loremipsumd	Loremipsumdo	Loremip sumdolor : loremipsu mdolors	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LoremipsumdLoremipsu mdol orsitametcon sectetur, adipisci-ngelitse
000.000(l)(0)(or)(E) loremipsu mdolorsita me tconsec tet urad ip isci	Loremips umdo lors itamet.	Loremi	Loremi	Loremip sumdolo : loremipsum dolorsit	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
000.000(l)(0)(or)(E) loremipsu mdolorsita met consecte turadip is cingelitsed doeiu	Loremipsu mdolors itame.	Loremipsumd	Loremipsumdo	Loremipsu mdolors : loremi psumd	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LoremipsumLoremipsum dolorsita metc onsecteturad ipisc
000.000(l)(0)(or)(E) loremi psu mdolorsi tametconsec te turadipiscin gel itse	Loremips umdolorsit ame tconsectetu.	Loremips	Loremipsum	Loremip sumdolo : loremipsumd olorsit	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
000.000(l) loremips umdolorsitame tc onsectet ura dipiscinge	Lorem ipsu mdo lorsita metcons.	Loremips	Loremipsum	Loremipsu mdolors : loremip sumdolor	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).

Vendor Posture for HIPAA

Vendor-level contractual posture, complementary to org-operated coverage. Not scored.

Loremips umdolorsi tametcons

Lor emipsu mdolor si tamet c ONS.

Loremipsu

Loremip sumdo lor si ta metconse ctetura.

Compliance scope impact, loremips um dolorsit ametcon

Before Test Test Product

Lorem : loremips umdo lo rsit ametc

Loremipsu mdolor sitamet con sectet.

After Test Test Product

Lorem : loremi psumdolo rs iTAM etconse

Loremips umdolor sitame tconse ct etu radi piscinge.

Not addressed in this regulation

000.000(l)(0)(or)(E)loremip su mdolorsi tam etconsec tetu radipisc

Lor emipsum

GDPR – EU Data Protection

Moderate fit on GDPR: supports the ability to restore the availability of personal data in a timely manner.

Moderate

Profile & intent

LO remipsumdo lo rsi tametconse ct eturadip isci, ngelitsedd oeius Mod 0000.

Why this software matters here

Loremi psumdolorsi ta metconsectet ur ad ipiscing elitsedd oeiusmo dt Emp. 00.

Sectoral pains 2026

Loremips umdo lorsitametc onsec te turadi.
Lo remipsum dolo rsitametcon secte.

Evidence at Get Listed. All Software contribution signals below are Vendor-Stated, based on Test public documentation. Compliance Labs (CL) has organised these claims, mapped them to GDPR articles and applied formal control relationship typology. Outcome verification is not within Get Listed scope.

How Test Test Product supports GDPR, by control nature

Showing the 0 most decision-relevant obligations of the 0 mapped. All contribution signals on this table are vendor-stated.

Obligation	Software contribution	Verdict	Relationship	Scope impact	Evidence ref
LoremipsuLoremipsum dol orsitame tconsect
Lor. 00(0)(e) lor emipsum do lorsita metconsectet ura dipisc in gelitsed doei us m odtemp orinci	Loremips umdo lors itametcon sectetu.	Loremi	Loremi	Loremip sumdolor : loremi psumdolorsi	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
Lor. 00(0)(e) lor emipsumdolorsita met consectetu ra dipiscin geli	Loremips umdolor.	Loremipsumd	Loremipsumdo	Loremip sumdolor : loremipsu mdolor	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LoremipsumdLoremipsu mdol orsitametcon sectetur, adipisci-ngelitse
Lor. 00(0)(e) loremipsu mdol ors itametco nse cteturadipisc in gelitsed	Loremi psumdol orsit.	Loremipsumd	Loremipsumdo	Loremipsu mdolors : lore mipsumd	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
Lor. 00(0) loremips umd olorsita metco ns ectetur adi piscin	Loremip sumdolo rsitame tco nsecteturad.	Loremips	Loremipsum	Loremipsu mdolors : lorem ipsumdolo	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LoremipsumLoremipsum dolorsita metc onsecteturad ipisc
Lor. 00(0) loremipsu mdolorsi ta metconsecte turadipisc	Loremip sumdolo rsitametconsec.	Loremips	Loremipsum	Loremipsu mdolors : loremips um dolorsi	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
Lor. 0(0)(e) lore mips um dolors itam etconsect	Loremipsu mdolorsi tametc ons ectetu.	Loremips	Loremipsum	Loremip sumdo : lor emipsu mdolor	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).

Vendor Posture for GDPR

Vendor-level contractual posture, complementary to org-operated coverage. Not scored.

Loremipsu mdolors

Loremi psumdolor si tam etc onsect etu radipisc.

Loremipsu mdolo

L orem ipsumdolor sitametco ns ecteturad.

Compliance scope impact, loremipsumdolo rs itametco nsec

Before Test Test Product

Lore : loremips umdo lorsi tametconsec tetur ad ipiscing

Loremip sumdolor sit ametco nsectetu.

After Test Test Product

Lorem : lore mipsumdo lorsit ame tconsecte

Loremip sumdolorsitame tc ons ecte turadipi.

Not addressed in this regulation

Lor. 00(0)lorem ips u mdol orsitametc onsect eturadipis

Lor emipsum

3.3

Framework Detail

For audit teams and certifying bodies that work with framework controls rather than regulation articles directly, here are the relevant control mappings. Same 6-column structure as regulation detail. Frameworks mapped for Test Test Product: NIST CSF 2.0 and NIST SP 800-53 Rev. 5.

NIST CSF 2.0 – Cybersecurity outcomes

Supports the Protect and Recover functions: backups and recovery planning.

Strong

Get Listed: all signals Vendor-Stated, applied to PR.DS and RC subcategories.

Covered by the software

Subcategory	Software contribution	Capability	Relationship	Scope impact	Evidence ref
LO.RE-00 Loremip su mdol ors itametc, onsectetu, radipiscin gel itsedd	Vendor-Stated Loremipsu, mdolorsit ame tconse ctetura.	Loremipsu mdolor sitamet Loremipsu mdolors itametc	Loremi	Loremip sumdolor : loremi psumdo lorsita	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LO.RE-00 Lor emipsumdo lo rsitame tc onsectet uradip iscingelits	Vendor-Stated Loremip sumdo lorsit ametconse.	Loremipsu mdolors itametc	Loremi	Loremipsu mdolors : loremipsu mdolors	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LO.RE-00 Lor emipsumd olorsit am etc onsectet uradipis cing el itseddoe	Vendor-Stated Loremip sumdolor sitametc onse cteturadi.	Loremip sumdolo rsitame tconsect	Loremipsumdo	Loremip sumdolo : loremips umdolor sita metcon	Loremi psumdolorsita, m. 00?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LO.RE-00 Loremips umd olorsit ametcons ect eturadipi	Not addressed Lor emipsumdo: lorsita metconsect eturadi pi scing elits.	n/a	n/a	Loremip sumd olorsita	n/a

NIST SP 800-53 Rev. 5 – Security and privacy controls

Supports contingency planning controls for backup and recovery.

Moderate

Get Listed: all signals Vendor-Stated, applied to CP control family.

Covered by the software

Control	Software contribution	Capability	Relationship	Scope impact	Evidence ref
LO-0 Loremi Psumdo	Vendor-Stated Loremip sum dolorsit ametcon.	Loremipsu mdolor sitamet Loremips-umdolorsit ametco	Loremi	Loremip sumdolor : lorem ipsumdo	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LO-00 Loremi Psumdolo rsi Tametconsectet	Vendor-Stated Loremips umdolor si t ametc onsec.	Loremip sumdolo rsitame tconsect	Loremipsumdo	Loremip sumdolo : loremips umdolo rsitametc	Loremi psumdolorsita, m. 0?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LO-0 Loremipsumd Olor Sitamet	Vendor-Stated Loremipsu mdolors itame.	Loremipsu mdolors itametc	Loremipsumdo	Loremipsu mdolors : loremi psumd	Loremi psumdolorsita, m. 00?Public vendor documentation, organised and mapped by CL. Not independently verified (Get Listed tier).
LO-0 Loremips Umdolorsit	Not addressed Lor emipsumdo: lorsitam etconsecte turadip is cingeli tseddoei.	n/a	n/a	Loremip sumd olorsita	n/a

4.1

Risk Reduction Narrative

Ransomware operators now try to destroy backups before they encrypt production, so a backup that can be reached is a backup that can be lost.

Test Test Product writes backups to immutable storage, tests restores every week and tracks recovery objectives per application.

In this demonstration, that yields a Strong fit on NIS 2 and a Moderate fit on HIPAA and GDPR.

48% Share of ransomware attacks that targeted backups first.

Demo Sector Threat Report 2026, p. 9

4.2

Sector briefing

What your sector is facing, what it costs, and where Test Test Product fits. Sourced from the CL sector corpus; each signal anchored to a capability or obligation.

risks in your sector

where Test Test Product helps

handled by other categories

Decision signals

Lore m ipsumd olors itam

Loremipsu mdolors itamet consect etur adipi scing el itseddoeiu sm odt empo rincid.

Lore Mipsum Dolors Itamet 0000, c. 0

Lore mipsumdolo rsi tametconse

Loremipsumd olo rsi tametco nsec teturadi pisci ngelitsed.

Lore Mipsum Dolo Rsitam 0000, e. 00

Lore mipsumdo lor sitame

Loremips umdolor sitametco nsectet ura dipiscinge litse.

Lore Mipsumdol Orsitam 0000, e. 0

Where this software fits

Covered by Test Test Product

Loremipsum dolorsitam etconse ?

Loremipsu mdolors itame t conse ctet.

Loremips umdolors ?

Loremi psumd olors itametco nsec.

Needs other categories

Loremip sumdolorsi tametcons

Loremips umd olorsitam etconse ct eturadip iscingelit.

Loremips Umdolorsi & Tametcon

Techniques in your sector

Technique (MITRE ATT&CK)

Sector rank

Mitigation

L0000 – Loremip Sumdol Orsitame

Loremipsu mdolor sitamet

L0000 – Lore Mipsumdol ors Itamet

Loremip sumd olors itamet (partial)

L0000 – Loremips

Lorem Ipsumdol

Lore Mipsum Dolors Itamet 0000, consectet uradipi, s. 00

4.3

Real-world scenarios

Loremipsum

Loremipsum dolorsit ame tconsect etur adipisc

Without Test Test Product

Loremip su mdo lors itametc ons ecteturad ipi, sci ngelitse ddoei usmod.

With Test Test Product

Loremipsu mdolor sita metcon sec teturad ipiscin geli tseddo eiusmo dtemp.

Regulation impacted: LOREM, IPS 0

Lorem

Lor emipsumdo lors ita metco ns ectetura dipiscinge

Without Test Test Product

Lor emip sumdo lorsit ametconse cte tu radipis cingelit.

With Test Test Product

Loremi psumdol orsi tametco nsec tetu rad ipiscing eli tse ddoe.

Regulation impacted: LOR 0, EMIP

5.1

Methodology overview

Three independent corpora

Compliance Labs builds its software evaluation from three independently maintained reference sources. A regulation corpus covering the obligations that apply to a software category, built directly from primary legal texts and official guidance. A capability reference list for the category (here Backup & Recovery software), built from product documentation across vendors plus expert input. A formal control relationship typology drawn from widely recognised standards, used to characterise how a capability relates to an obligation (direct, contributing, supporting, equivalent).

Why independence matters

Each source is built independently to avoid the well-known failure mode where an LLM, asked to extract both obligations and capabilities in a single pass, invents mappings between them. Compliance Labs (CL) keeps the three sources separate, then articulates them in a controlled mapping step. This is the source of the coverage indicators shown throughout the fiche: what the software covers directly, and what remains operated or decided by the organisation.

What Get Listed means here

For this Get Listed fiche, all software contribution signals are Vendor-Stated: derived from public vendor documentation that CL has organised, mapped, and cross-referenced, but not independently verified through artifact inspection or testing. Outcome verification requires the Get Proven or Get Scale tiers, see section 5.3.

5.2

Sources examined for this fiche

Vendor documentation reviewed

Regulation texts referenced

NIS 2 Directive EU 2022/2555 (Official Journal of the EU)
HIPAA 45 CFR Parts 160, 162, 164 (HHS, 2024 consolidated)
GDPR EU Reg. 2016/679 (Official Journal of the EU)

Frameworks & standards referenced

NIST CSF 2.0 (NIST, February 2024)
NIST SP 800-53 Rev. 5 (NIST, 2020, updated 2023)
NIST SP 800-53A, Assessing Security and Privacy Controls (basis for CL tier system)
NIST mapping standards for formal control relationship typology

Threat intel corpus

Demo Sector Threat Report 2026, p. 9
Demo Breach Cost Survey 2026, p. 14
Demo Regulator Outlook 2026, p. 3

Limitations of this tier (Get Listed)

The following elements are within Get Proven or Get Scale scope. See section 5.3 for the upgrade paths.

Source code and internal architecture documents (Get Proven scope)
Production configuration of a live customer tenant
Penetration test results and remediation evidence (Get Scale scope)
Customer references and interviews with operators

5.3

Evaluation tiers and what each covers

Get Listed current tier

Documentary examination Vendor-Stated

Access to compliance-relevant software solutions and their Compliance Assurance Evaluation (CAE) reports.
Submit 1 software for a baseline CAE report.?
Software mapped to up to three regulations and frameworks from a standard set, including PCI DSS, HIPAA, GDPR, NIST CSF, NIST SP 800-53 and MITRE ATT&CK, with no selective scoping.
Benchmarking: capabilities and regulatory mapping compared to competing vendors, plus sector insights.

Get Proven

Extended examination CL-Examined

Everything in Get Listed, plus:
Access to 1,000+ compliance-relevant software solutions and their CAE reports.
Submit 1 software for a full CAE report.?
Coverage extended to up to 10 regulations and frameworks aligned with your target markets, drawn from a library of 40+.
Report refreshed twice a year, covering new regulations, capability changes, security vulnerabilities and MITRE updates.
Quarterly regulatory alerts when regulations change with impact on your evaluation.

Request a quote

Get Scale

Examined, interviewed and tested CL-Verified

Everything in Get Proven, plus:
Submit 1 software for an Evidence Effectiveness Evaluation (EEE) report, extending the documentary examination to direct testing.?
Dedicated compliance analyst: one point of contact across evaluation, regulatory changes and audit preparation.
Monthly performance report covering evaluation results and compliance posture.
Full access to exclusive resources: tools, guides, templates and policies.?

Request a quote

Get Ready

One-time engagement. Fixed scope: NIST SSDF and EU Cyber Resilience Act.

Submit software for SSDF / CRA Readiness assessment and report.?
CRA scope, product classification and conformity route.
Gap analysis for CRA requirements and SSDF practices.
Cybersecurity risk assessment and prioritized remediation roadmap.
Compliance documentation assessment against CRA conformity and SSDF attestation requirements.
Custom Testing: same rigour applied to pre-release software, internal applications, cloud connectors and proprietary pipelines.

Request a quote

5.6

Consolidated caveats

Tier-level limitation: At Get Listed, all signals are Vendor-Stated. CL has organised, mapped, and cross-referenced but not independently verified through artifact or testing.
All capability claims are vendor-stated and were not independently tested.
1 reference capability not found in public vendor documentation: SaaS application backup.
Regulatory mappings describe contribution to obligations, never compliance by the software alone.

Glossary

Scoring

Covered by the software vs Remains with your organisation – "Covered by the software" measures how many regulatory requirements are addressed directly by the software. "Remains with your organisation" measures how many compliance processes the organisation operates or decides, with support from the software. Both are dynamic across the Viewing filter. Category-level capability coverage (static) is shown in the Capabilities tab.

Verdict

Covers – The software addresses the obligation directly through a documented mechanism it executes (technical control).

Contributes – The software addresses part of the obligation; your organisation operates the process that completes it (operational control).

Supports – The software produces outputs that feed a governance decision your organisation makes (management control).

Direct, Contributing, Supporting, Equivalent – Categories from the formal control relationship typology used by CL. Direct, capability fulfils the obligation through a mechanism named in the regulation. Contributing, capability adds value but the obligation is broader. Supporting, capability participates indirectly. Equivalent, capability replaces the obligation's named mechanism.

Validation depth

Vendor-Stated, CL-Examined, CL-Verified – Three depth levels aligned with NIST SP 800-53A. Vendor-Stated (Get Listed), signal derived from vendor public documentation, organised and mapped by CL but not independently verified. CL-Examined (Get Proven), signal validated against internal vendor artifacts. CL-Verified (Get Scale), signal validated through testing of running software.

Control nature and verdict – Each obligation in the Regulation Detail tables is classified by control nature: Technical (mechanisms the software executes), Operational (processes your organisation operates with software assistance), or Management (governance decisions your organisation makes). Each also carries a verdict (Covers, Contributes, or Supports) reflecting how far Test Test Product addresses it. The specific effect appears in the Scope impact column.

Capability signals

Table-Stakes – A capability considered baseline for the Backup & Recovery software category. Expected in any serious product.

Advanced – A capability beyond the category baseline, signalling above-average maturity.

Emerging – A newer or less common capability, not yet standard across the category.

Out-of-box – Available by default without significant configuration.

Config change – Requires configuration or setup work to enable.

Not in Vendor Documentation – No public documentation found for this claim at the Get Listed tier.

Adjacent – A capability group outside the core Backup & Recovery software category, belonging instead to a neighbouring category (Endpoint Detection & Response, Disaster Recovery as a Service, Data Security Posture Management). Shown for context; not scored with the same rigour as the core category.

5.8

References

Regulations

NIS 2 Directive EU 2022/2555, Official Journal of the EU
HIPAA, 45 CFR Parts 160, 162, 164, HHS
GDPR EU Regulation 2016/679, Official Journal of the EU

Frameworks & standards

NIST Cybersecurity Framework 2.0, NIST
NIST SP 800-53 Rev. 5, Security and Privacy Controls
NIST SP 800-53A, Assessing Security and Privacy Controls
NIST mapping standards (formal control relationship typology)

Threat intelligence corpus

Demo Sector Threat Report 2026, p. 9
Demo Breach Cost Survey 2026, p. 14
Demo Regulator Outlook 2026, p. 3

FAQ

Frequently asked questions

No software is compliant by itself. In this demonstration, Test Test Product executes the backup management and disaster recovery measure of NIS 2 Article 21(2)(c); other measures remain with your organisation.

Compliance Labs evaluates it against three regulations for this listing: NIS 2, HIPAA and GDPR.

Yes, according to the demo vendor documentation: backups are locked against modification and deletion for the configured period.

These are Compliance Labs' three evaluation tiers, aligned with NIST SP 800-53A. Get Listed is a free documentary examination based on public vendor documentation (signals are Vendor-Stated). Get Proven adds an extended examination of internal vendor artifacts under NDA (CL-Examined). Get Scale adds interviews and testing under CL methodology (CL-Verified). Higher tiers provide stronger, independently verified evidence.

Closing the gap. Some regulations and frameworks require customer-side processes beyond the software, such as NIS 2 supply chain security, HIPAA risk analysis, or GDPR data protection impact assessments. To close these gaps end-to-end for a regulation in your sector, Compliance Labs offers an Implementation Guide combining vendor configuration, complementary tooling and organisational process design. Request a guide proposal

This fiche is Get Listed: a documentary examination of public vendor sources. All software contribution signals are Vendor-Stated, organised and mapped by Compliance Labs but not independently verified through artifact inspection or testing. It describes how the software contributes to regulatory applicability; it does not certify the vendor as compliant and does not constitute legal or compliance advice. Ultimate compliance responsibility remains with your organisation. Vendors: dispute or correct information on this fiche. See what Get Proven verifies.