Solutions · Regulated industries
They don’t ask whether you have threat intelligence. They ask you to show it.
Every regime on this page asks for the same things in different words: evidence that you monitor threats, evidence that you handle and report incidents on time, and evidence you can hand to an auditor. Wahukeza classifies, runs the clocks, drafts the notifications and records the evidence, from your own infrastructure. The filing and the judgement stay with you.
By regime
What each asks for, and what the platform hands you.
Not legal advice; a map from the language of each framework to the artefacts you can produce. Your compliance team decides sufficiency.
| regime | asks for | you can show |
|---|---|---|
| DORA | ICT risk management; classification of major ICT-related incidents (RTS 2024/1772) and reporting on the ITS 2025/302 templates; at least yearly reporting to the management body (Art. 13); notifying the authority of information-sharing arrangements (Art. 45). | Deterministic classification on the incident naming the criteria met; the 4-hour, 72-hour and one-month clocks with due and overdue alerts; notification drafts keyed to the Annex I fields, recorded when you file; a management-body report in English and Montenegrin; the Art. 45 membership notice for sharing groups. |
| NIS2 | Risk-management measures (Art. 21); significant-incident reporting in stages (Art. 23): early warning in 24 hours, notification in 72 hours, final report in one month. | The Art. 23(3) significance test with a recorded justification; the three clocks; stage drafts from a closed field set; a controls map to the Art. 21(2) measures. Montenegro’s Law on Information Security is handled as NIS2. |
| ISO 27001 · SOC 2 | Threat intelligence as a control (A.5.7); logging, monitoring and evidence for audit. | Documented sources with grades and licences; a hash-chained audit log with signed daily anchors and a verifiable export; an evidence pack with a controls map to ISO/IEC 27001:2022 Annex A; records of processing. |
| SEC cyber disclosure | Material incident determination and timely disclosure; description of risk management and governance. | Declared severity and phases, a hashed evidence bundle, a post-incident review on the case. |
| APRA CPS 234 | Information security capability commensurate with threats; timely notification of incidents. | Sensor-based threat evidence per asset group; notification channels; audit. |
| MAS TRM | Cyber threat intelligence and information sharing; incident management; monitoring. | Sector exchange and sharing groups, a first-party feed scorecard, saved hunts, reports. |
| HIPAA · PCI DSS | Risk analysis, monitoring, incident response procedures, evidence of controls. | Endpoint Intelligence baselines, enforcement feeds, case timelines, retention. |
| CMMC | Incident response, audit and accountability, system monitoring. | Signed images and SBOMs for supply-chain questions; audit; incident lifecycle. |
A bank in Montenegro? DORA, the national law and customer fraud, on one page. Central-bank clauses can be added to the controls map as your own references.
The artefacts
Monitor, handle, report, hand over.
quarterly · annual
Scheduled reports
Per entity, branded with your name and logo: intelligence reports on what targeted you, and the management-body report DORA Art. 13 asks for, quarterly or annually, in English or Montenegrin.
Incident · regulatory
Incident record with both clocks
Declared severity, phases with SLA timers, DORA or NIS2 classification with its reporting stages, attached evidence and a post-incident review. A timeline a supervisor can read.
evidence bundle
Hashed incident bundle
Indicators, sessions, artefacts, notes and the notification drafts with their filing record, bundled and hashed so a third party can verify it later.
evidence pack
Auditor evidence pack
One hashed export of configuration, identity, retention, regulatory records, audit-chain verification and the approval ledger, with a controls map to DORA, ISO/IEC 27001:2022 Annex A and NIS2 Art. 21(2). A mapping, not a certification.
Testing evidence
Evidence that your controls see the attacks aimed at you.
Supervisors and auditors ask how you know your detection works. Coverage-gap reports from adversary emulation are useful testing evidence: the sensor fleet shows which techniques are actually being used against you, a safe procedure exercises them on hosts you authorised, and the report records whether your controls caught them. They complement a threat-led penetration test; they are not one.
- ObservedT1105 ingress tool transfer · FortiGate CLI persona · 3 sessions · 2026-09
- Recommendedsafe procedure SP-014 (benign proxy) · reviewed 2026-08-30
- Authorisedengagement e-17 · 4 hosts · 2h window · approver: j.k.
- Resultnot detected by SIEM rule set · annotated · gap #2 in report
Data protection
A platform that handles other people’s data carefully.
Attacker IPs as personal data
Retention knobs, DSAR export and erasure with the reason recorded, refusal grounds, audit echo.
Documents in the box
Privacy notice, records of processing, DPA template, legitimate-interest assessment, breach-response runbook.
Sovereign deployment
On-prem: no call-home, an offline licence, AI local, your own key, or off; every public-data fetch can be switched off. Hosted: a database per tenant, Trony Network as processor under the DPA.
Supply chain
Signed images and charts with a published public key, CycloneDX SBOMs, upgrade and restore drills on every release.
Read the records of processing and the security & trust page.
Ask for a sample evidence pack.
A management-body report in Montenegrin, an incident bundle with its regulatory drafts and an auditor evidence pack with its controls map. Produced on a reference deployment, for your compliance team to read.