Question 1

How does an assessment run work?

Accepted Answer

Each run uses a versioned compliance prompt pack to query your evidence with a RAG pipeline. For every control we generate a structured questionnaire, a verdict (compliant, partially compliant, non-compliant or not applicable), a freshness-scored evidence trail and a prioritized gap analysis.

Question 2

What does evidence freshness mean?

Accepted Answer

Evidence is scored against the freshness window you select. Anything older than the window is downgraded or flagged so the verdict reflects current reality, not stale documentation.

Question 3

Can I reproduce a past assessment?

Accepted Answer

Yes. Every run is linked to an immutable prompt pack version (label + SHA-256 hash). Re-running with the same pack and evidence reproduces the same reasoning and outputs.

Question 4

How are gaps prioritized?

Accepted Answer

Gaps get a 0–100 priority score combining severity (critical → low), priority tier (P0 → P3) and a verdict bump for non-compliant findings. Sort by score to get the next-best action.

Question 5

What are remediation actions?

Accepted Answer

For every open gap we draft 1–3 testable actions with acceptance criteria, a test procedure, the evidence required and a responsible role (CISO, DPO, SecOps…). Due dates are derived from priority.

Question 6

What does the Risk Register cover?

Accepted Answer

Operational, technology, third-party, data protection and information security risks — with severity, likelihood, owner, treatment and linked controls.

Question 7

How are risks linked to controls and gaps?

Accepted Answer

Risks map to controls in the catalog. When an assessment downgrades a control, related risks surface in the dashboard so mitigations stay aligned with the latest evidence.

Question 8

Do you support third-party / ICT supplier risk?

Accepted Answer

Yes. Third-party risk is a first-class object in the DORA module, with concentration analysis, criticality tiers and contractual control checks.

Question 9

Can I import risks from existing tools?

Accepted Answer

Yes — through the Linear connector and CSV import for spreadsheets. More connectors are on the roadmap.

Question 10

Which frameworks does Drimt support today?

Accepted Answer

NIS2 domains, DORA ICT risk management, ISO 27001 Annex A and SOC 2 Trust Service Criteria. Controls are cross-mapped so a single piece of evidence can satisfy multiple frameworks.

Question 11

Is Drimt a replacement for an auditor?

Accepted Answer

No. Drimt prepares your evidence, controls and gap analysis so audits move faster and with fewer surprises. The audit opinion still belongs to a qualified auditor.

Question 12

How do you handle NIS2 essential vs important entities?

Accepted Answer

The NIS2 module lets you declare your entity classification and applies the correct obligations (governance, incident reporting timelines, supply chain) to your assessments.

Question 13

Does Drimt cover DORA incident reporting?

Accepted Answer

Yes — DORA incident records, classification, resilience testing and ICT third-party registers are all tracked in the DORA module and feed your assessments.

Question 14

Where is my data stored?

Accepted Answer

All workspace data, evidence and assessment artifacts are stored on EU infrastructure with row-level security. See the Privacy page for full details.

Frequently asked questions

Assessments

Risk coverage

Compliance frameworks

Still have questions?