M
Hi there, Mikael
What would you like to do?
Ask Freda…
Set up a new framework
Review priority actions
Show what applies to us
What changed this month?
Build a report
Build an agent
Recent chats
View all
Update Risk Management Policy
1 hour ago
Implement Incident Mgmt controls
16 hours ago · ISO/IEC 27001
Perform a security diligence of new vendor
Yesterday
Assess AI Act implications on new feature
Last week
Tasks due soon
View all
Approve new Access Control Instructions
24 Sep 2026 · ISO/IEC 27001
Close gaps from cloud configuration agent
24 Sep 2026 · InfoSec
Update controls from Horizon scan findings
25 Sep 2026 · EU AI Act
Review new data processing activity for HR…
25 Sep 2026 · GDPR
M
Swedish Marketing Act (MFL)
Swedish E-Commerce Act
Artificial Intelligence Act (AI Act)
Digital Operational Resilience Act (DORA)
General Data Protection Regulation (GDPR)
ISO/IEC 42001
ISO/IEC 27001
SOC 2
Conduct internal audits of the ISMS
Third-country compelling interests inform …
DPO DPIA involvement
AI tooling resources documentation
Specify application security requirements
Integrate security into project management
AI data resources documentation
AI human resources documentation
AI lifecycle resources identification
AI system resources documentation
Control authentication information
Establish secure development rules
Data leakage prevention
Apply secure coding principles
User end point device security
Establish acceptable use rules
Manage access to external websites
Remote working security measures
Clear desk and clear screen rules
Apply secure system engineering principles
Implement security testing in development
DPO conflict interests
Data subjects views obtaining
Certification mechanism submission
DPO highest management reporting
BCRs enforceability requirements
DPO dismissal penalisation
Automated decisions prohibition
Consent request distinguishable presenta …
Special categories substantial interest
Malware protection implementation
Information processing clocks synchronization
Secure systems engineering principles
Software installation procedures implementation
Audit tests activities planning
Information services users segregation
Utility programs use restriction
Secure software systems development
Resources capacity monitoring adjustment
Data leakage prevention measures
Cryptography effective use rules
Information processing facilities redundancy
Networks systems applications monitoring
Information security requirements identification
Test information selection management
Data masking usage
Information deletion implementation
Development testing production separation
Secure coding principles application
Secure authentication technologies implementation
Networks network devices security
Backup copies maintenance testing
Configure Automated Backups
Oversee Outsourced Development and AI …
Incorporate Proportional Third-Party Aud …
Third-Party and Cloud Service Inventory
Assess Third Party Vendor Security Postu …
PII minimisation in customer data collecti …
AI provider breach notification contractu …
Candidate Screening and Competency Ve …
Maintain Competence and Training Records
Contractual advance notice for AI provid …
Conduct Security Awareness Training
Maintain Authentication and Credential S …
Configure Centralized Identity and Acces …
Establish Secure Software Development …
Maintain Acceptable Use Policy
Maintain Disciplinary Policy and Conduct …
Execute Access Provisioning and Deprovi …
Equipment Repair and Servicing Data Pro …
Integrate Security into Software Develop …
Coordinate Operational Security Testing …
Data Leakage Prevention Controls
Prompt injection penetration testing sco …
Tenant namespace isolation and cross-te …
Emergency credential rotation on suspect …
AI input and output safety screening
Conduct Independent Information Securi …
Developer OWASP security awareness tra …
Employee phishing simulation programme
Execute Vendor Offboarding and Service …
Approve Critical Vendor Security Excepti …
Evaluate Critical Vendor Regulatory Coop …
Execute Tiered Vendor Security Due Dilig …
Automated secrets scanning in repositories and pipelines
Continuous cloud storage misconfiguration monitoring
Hardened admin account configuration enforcement
IaC-enforced infrastructure provisioning with peer review
Least-privilege role-based access provisioning
Periodic data-access penetration testing
Quarterly access review across all systems
Recurring phishing simulation and remedial training
Session anomaly detection for privileged access
Encrypted backup restoration drills
Privileged session recording retention
Third-party API token rotation schedule
Container image vulnerability gating
Change advisory board approval records
Disaster recovery runbook rehearsal
Endpoint disk encryption enforcement
Security incident postmortem tracking
Log immutability and retention controls
Segregation of duties in deployment
Vault-first credential handling at developer onboarding
Frameworks
8
Sources
632
Controls
222
Help me do a summary of the status of my current program
Reviewed your program
I went through all 8 frameworks and the 222 controls under them. Here is where things stand:
GDPR
all green, every control evidenced
DORA
3 actions open, all on ICT third-party risk
Other frameworks
6 key actions, mostly stale evidence
Vendors
2 to take action on, both overdue reviews
What should I start with?
Drafted the order of play
Start with DORA. The 3 open actions are all evidence that expired this month, so they close quickly once the owners re-upload. The 6 across the other frameworks are the same shape, stale evidence rather than missing controls, so they can wait until the DORA set is clear. Want me to open the 3 DORA tasks and assign them now?
Ask Freda…
One system,
for all your compliance
Know exactly what obligations you are subject to, across any market and domain.
Learn moreGet compliant with anything - a full, audit-ready program, bespoke to your business.
Learn more
Your team, multiplied: build and deploy agents for any compliance job.
Learn more
Your entire operations, connected
Freda works where you already work, turning compliance from siloed to integrated.
Built differently
AI-native infrastructure, grounded in deep regulatory knowledge.