Compliance, kept current
Ready-to-edit, role-split document kits for every EU regulation — built and maintained by a working CISO.
One shelf, five kits, all live: CRA, DORA, PCI DSS, NIS2 and the EU AI Act
Need the practitioner rather than the documents? Fixed-price advisory, from €750 ›
Every regulation, one shelf
See the full catalogue ›Cyber Resilience Act
Scope, technical file, vulnerability handling and Article 14 reporting — by role.
Open the kit ›Digital Operational Resilience Act
ICT risk, incident classification and the Register of Information.
Open the kit ›Payment Card Industry Data Security Standard
PCI DSS v4.0.1 starter & self-review templates — policies, procedures and an evidence structure.
Open the kit ›Network & Information Security Directive 2
NIS2 Directive starter pack — scope self-assessment and the Article 21 measures. National transposition check required.
Open the kit ›EU Artificial Intelligence Act
Risk-tiered obligations for AI systems and general-purpose AI models on the EU market.
Open the kit ›Cyber Resilience Act
Scope, technical file, vulnerability handling and Article 14 reporting — by role.
Open the kit ›Digital Operational Resilience Act
ICT risk, incident classification and the Register of Information.
Open the kit ›Payment Card Industry Data Security Standard
PCI DSS v4.0.1 starter & self-review templates — policies, procedures and an evidence structure.
Open the kit ›Network & Information Security Directive 2
NIS2 Directive starter pack — scope self-assessment and the Article 21 measures. National transposition check required.
Open the kit ›EU Artificial Intelligence Act
Risk-tiered obligations for AI systems and general-purpose AI models on the EU market.
Open the kit ›Two bad options — until now
Six-figure consultants on one side. Stale €30 template dumps on the other.
The difference is night and day
We sell maintained documents
… and we prove it
Every kit and document carries the Currency Stamp — proof a static template can’t make
Dated
The exact day it’s current as of
Versioned
With a public changelog you can actually read.
Pinned to the regulation
The precise text it tracks — article by article.
Article 14 runbook rewritten for the live ENISA reporting platform; importer and distributor checklists completed.
Re-based on the Digital Omnibus on AI: high-risk dates now 2 Dec 2027 and 2 Aug 2028.
Incident classifier corrected to the Art. 8(1) rule; Register of Information rebuilt on the ITS templates.
Your duties depend on what you do with the product
We split kits by economic operator where the obligations differ —
including the importer and distributor packs the ISMS toolkit shops never build
A real practitioner stands
behind every kit
Every VARVICO kit is built and maintained by a practicing CISO in EU-regulated fintech — someone who runs this in a regulated business, not scraped or white-labelled from a content farm. Kept anonymous by design; the work speaks for itself
From scope to filed, in four steps
Check your scope
Run the free wizard. Find out, indicatively, whether a regulation applies and which role you are
Pick your role pack
Manufacturer, importer or distributor — open manifests, so you see every document first
Edit with guidance
Each document ships with inline “what to change” notes, so you can adapt it yourself — the law translated on the page
File & keep current
Deploy your set, then let Kept Current push each update as the regulation moves
Built for the people who actually file
“A structured starting point I could actually edit — not a six-figure engagement, not a dead Word file. The inline guidance is what saved me.”
“The importer pack covered the exact obligations the generic ISMS toolkits skip. One accountable practitioner behind it is why I trusted it.”
“I run it across client engagements. The Currency Stamp means I hand over documents that track the regulation, not last year's draft.”
When the documents aren't enough, the practitioner is
Fixed-price time from the practicing CISO who maintains the kits. Quoted by written proposal, invoiced directly, never through the store.
You ran the scope check or opened the kit and are not sure which role or category you fall into — or you need the answer in writing before a customer, an auditor or a supervisor asks for it.
Details →An obligation date 6–18 months out, a customer questionnaire, or a letter from a supervisor or a notified body. Three variants, one per regulation.
Details →You have had a review and need someone to keep the risk register, the policies and the management reporting alive — without hiring a full-time security lead yet.
Details →Find the kit for your regulation
Browse the shelf, or run the free scope check —
six questions, an indicative result, and the matching kit in two minutes