Live since 17 Jan 2025
DORA
Financial entities, AIFMs, crypto service providers
ICT third-party risk (Art. 28–30) must be documented at closing. SPA clauses on DORA compliance becoming standard.
Bußgeldrahmen
up to 2 % of global group turnover
Current regulatory drivers
Three regulations change DD scope 2024–2026.
Cyber-DD is no longer optional. Buying a target without DORA/NIS2 check means inheriting open fine risk and personal executive liability.
Transposition Q1–Q3 2025
NIS2 (BSIG amendment)
30,000+ German companies (essential + important entities)
From 50 employees / EUR 10M turnover potentially in scope. § 38 BSIG: personal executive liability. Buyer checks threshold status in target.
Bußgeldrahmen
up to EUR 7M / 1.4 % turnover
Live since 25 May 2018, fine wave from 2024
GDPR
All companies processing personal data
Check target's fine backlog, verify DPO designation, inspect ROPA and TOM documentation. Rep & Warranty insurance requires evidence.
Bußgeldrahmen
up to 4 % of global group turnover
Sources: regulations, BSI activity reports, German Data Protection Conference (DSK).
Full deal lifecycle
Four phases, one platform.
Cyber compliance is no longer a one-off DD point. It's continuous oversight across the investment cycle. Here is what Kopexa delivers per phase.
Phase 1 · Buy-side DD14 days
Cyber-DD before LOI / SPA
Scan target against DORA, NIS2, ISO 27001 and (where applicable) TISAX. Check thresholds, quantify fine risk, surface missing structures (DPO, ISMS, vendor management).
Mit Kopexa
Standardised DD template on Pro plan. OSCAL import of target docs. SPA-ready findings report with risk score and concrete recommendations.
Phase 2 · Post-merger integration60–180 days
Roll out group standards to subsidiaries
After closing, compliance standards must apply to the new subsidiary, alongside existing portfolio companies. Painful manually, chaotic with n separate tools.
Mit Kopexa
Multi-entity platform (Enterprise plan): define group frameworks once, instantiate n times. Cross-framework mapping avoids duplicate work.
Phase 3 · Pre-sale vendor DD8–12 weeks
Cyber compliance as multiple driver
Before exit, sellers want a clean cyber story. Documented ISMS / DORA / NIS2 compliance justifies higher multiples and disarms vendor DD findings.
Mit Kopexa
Audit trail over multiple quarters, exportable compliance dossiers for the data room, auditor workspace for external confirmation.
Phase 4 · Portfolio monitoringongoing
LP reporting and risk aggregation
LPs ask for ESG, cyber and governance quarterly. An aggregated view across portfolio companies isn't possible with n separate compliance stacks.
Mit Kopexa
Aggregated dashboard across portfolio. Cyber-health score per company. Quarterly export for LP reports. Escalation workflow on incidents via § 38 BSIG / DORA reporting.
Killer argument vs DD boutiques
One control covers four regulations.
NCC, KPMG Cyber and other DD houses sell DORA, NIS2 and ISO-DD as separate workstreams. Kopexa maps them automatically: one scan, one findings report, four regulations covered.
| Control area | DORA | NIS2 | ISO 27001 | TISAX 6.0 |
|---|---|---|---|---|
| ICT third-party risk / supply chain | Art. 28–30 | Art. 21(2)(d) | A.5.19–5.23 | 8.x |
| Risk management & governance | Art. 5–15 | Art. 21(1) | A.5.7, A.6.x | 1.x |
| Incident reporting & notification | Art. 17–18 | Art. 23 | A.5.24–5.25 | 5.x |
| Executive responsibility | Art. 5 | Art. 20 (BSIG § 38) | A.5.1 | 1.1 |
| Resilience testing / pen testing | Art. 24–27 | Art. 21(2)(f) | A.8.29 | 5.2 |
| Asset & configuration management | Art. 9 | Art. 21(2)(c) | A.5.9, A.8.9 | 1.4 |
Mapping based on Kopexa cross-framework engine. Full 200+ mapping points in the Pro and Enterprise plans.
Multi-entity
Holding view. Subsidiary workspace. One platform.
In the Enterprise plan you build group frameworks once and roll them out n times. Each portfolio company has its own workspace, the holding dashboard aggregates for LP reports.
Maintain group policies once
Holding defines cyber standards, all subsidiaries inherit automatically. No n Excel graveyards.
Aggregated LP reports
Cyber-health score across portfolio companies, exportable as PDF for quarterly LP calls.
Escalation workflow
Incidents per § 38 BSIG / DORA Art. 17 are automatically escalated to holding oversight.
Holding · Aggregated view
5 Portfolio-Companies
Ø Cyber-Score
71/100
Portfolio companies
PortCo A
SaaS · 80 employees
PortCo B
Fintech · 240 employees
PortCo C
Industrial · 450 employees
PortCo D
Maritime · 120 employees
PortCo E
Healthcare · 95 employees
Pay once, use forever
Boutique DD vs. Kopexa across 3 years.
Move the slider to your portfolio size. The comparison shows traditional DD boutique per target plus separate platform per portfolio company against an Enterprise plan covering DD and ongoing compliance.
Portfolio size
5 portfolio companies
Time horizon
3 years
DD boutique setup
593.000 EUR
- Cyber-DD boutiques3 × 95.000 EUR285.000 EUR
- GRC tools per portfolio company5 × 8.000 EUR × 3 J.120.000 EUR
- Post-merger consulting3 × 36.000 EUR108.000 EUR
- LP reporting (manual)5 × 16.000 EUR80.000 EUR
Kopexa Enterprise
52 % günstiger285.000 EUR
- Enterprise plan (scales with portfolio)90.000 EUR / Jahr270.000 EUR
- Onboarding & success managereinmalig15.000 EUR
- Cross-framework mappingim Plan enthaltenin plan
- LP reporting dashboardim Plan enthaltenin plan
- DD templates + OSCALim Plan enthaltenin plan
Difference over 3 years
308.000 EUR
Plus soft factor: documentation outlives closing, findings live outside the PDF graveyard.
Assumptions: mid-market complexity, 1 acquisition per year over the horizon. Specific Enterprise pricing on request.
FAQ for PE & M&A teams
How fast is a cyber-DD with Kopexa?
Standard DD scans against DORA, NIS2 and ISO 27001 take 10–14 working days from document handover. Traditional DD boutiques quote 6–10 weeks because they run each framework separately. With Kopexa, everything runs in one cross-framework scan.
Who runs the DD: Kopexa or our team?
Both work. You can use the platform on the Pro plan (right if you have an in-house cyber team) or bring in a certified partner from the Kopexa network. Findings are SPA-ready in both cases.
Why not just hire a specialised cyber-DD boutique?
Boutiques cost EUR 80–150k per target and deliver PDF reports that are useless after closing. With Kopexa you pay Pro/Enterprise licences and get the DD plus an ongoing compliance platform for the portfolio. Pay once, use forever.
Does this work for multi-entity structures after closing?
Yes, that's exactly the Enterprise plan use case. Define group frameworks once, instantiate them n times across subsidiaries. Each subsidiary has its own workspace, the holding dashboard aggregates across all.
What if the target uses a framework Kopexa doesn't ship out of the box?
Pro and Enterprise plans support OSCAL import. Build your own frameworks or catalogs in the Framework Builder; cross-mapping to DORA/NIS2/ISO runs automatically.
Is Kopexa also suitable for strategic acquirers (corp dev), not just PE?
Yes. Strategic acquirers often have even more complex multi-entity structures, since the target needs to be integrated into existing group compliance. Enterprise plan plus cross-framework mapping delivers exactly that.
Two entry points
Single-deal DD or portfolio rollout. Both paths start here.
Single-target DD is the fastest entry, portfolio rollout the biggest lever. Both run on the same platform.
Pro plan
DD for one target
Single workspace with unlimited frameworks, OSCAL import, SPA-ready findings report. Right for buy-side DD before LOI or pre-sale vendor DD.
599 EUR / month
See pricingEnterprise plan
Multi-entity portfolio
Define group frameworks once, instantiate n times. Aggregated dashboard for LP reporting. SSO/SAML, dedicated success manager, SLA.
custom
Request demo