Most NIS2 obligations have a playbook. Supply chain security doesn't.
Supply Chain Assurance turns supplier proof into structured, audit-ready records — without the spreadsheet sprawl. Built for the mid-market that bigger players ignored, in central Europe by a cybersecurity practitioner who's been in your shoes.
Walk through the NIS2 obligations as a CISO or Head of IT. Awareness training has a playbook. Incident response has a runbook. Patch management is procedural. Supply chain security isn't. The evidence sits with external parties. It arrives in a dozen formats. It expires unevenly. And someone has to defend the decisions later. That's why Supply Chain Assurance is its own product — because the obligation deserves its own tool.
Microsoft Azure, EU regions only.
Read the long-formFull list, updated on every change. DPA template available before the deal.
Read the long-formHash-anchored, signed, decision-traced. Stands up six months later, unchanged.
Read the long-formStructured supplier evidence — without the spreadsheet sprawl.
Supply Chain Assurance turns supplier proof — certificates, audit reports, contract clauses, policy documents — into Evidence records with expiry context and a full decision trace. When a supplier has an incident, an auditor asks a hard question, or a regulator sends an inquiry, you have the answer in minutes, not hours.
- Process-driven supplier scoping
- Structured assessment with AI assist
- Evidence records with review history
- NIS2-shaped audit exports — structured, hash-anchored, defensible
When a supplier discloses an incident.
One scenario. Two ways it goes. The difference is what you signed up for the day before it happened.
Open the supplier register spreadsheet. Search SharePoint for their last assessment, your inbox for the contract clauses, a different folder for the evidence files, your calendar for the last review date. Half a day per supplier. Longer if the original reviewer has left. By the time you've reconstructed who reviewed what and when, you're not sure you have the latest version of anything.
One record per supplier. Current evidence, review history, contract clauses, in-scope services — linked, dated, exportable. The CEO gets the answer the same morning. The auditor gets the same answer six months later, unchanged.
The product nouns, plainly.
No 24/7 SOC. No managed endpoint. We build the supplier-assurance tooling that should have existed when the founder was the practitioner filling the spreadsheets — and we're honest about what it's for.
How it fits togetherSub-processor lists, certificates, audit reports — linked, dated, hash-anchored, with reviewer attribution. Always the latest version.
Every approval, rejection, and escalation timestamped and signed. Auditor asks "why was that rejected" — you hand over the trace.
Machine-readable export of every approved evidence record, every reviewer decision, every signed dossier — built to match the structure a NIS2 auditor expects.
Pavel Láska.
Built by the practitioner.
Shards Cybersecurity was founded by Pavel Láska — a CISSP- and CISM-certified cybersecurity practitioner with over a decade across banking, pharma, and education.
Eight years in the banking sector progressing from senior engineer to senior risk manager. Time on critical financial infrastructure. Reporting to board level. Then a global security services team in pharma across three continents. The credibility chain runs practitioner → witness → builder: he was the one filling the spreadsheets, defending the supplier decisions, prepping for the audits. Supply Chain Assurance is the tooling that should have existed back then.
The product was shaped by quiet conversations with practising CISOs and security leads across regulated industries — people who've sat in the audit chair, defended supplier decisions to boards, and lived with the consequences. They're not named on this page, but they're in the product.
Bratislava · CISSP · CISM · Microsoft Partner
Built on Microsoft Azure, with a Microsoft-first architecture and security model. Available on the Microsoft commercial marketplace.
Bratislava-headquartered, EU-hosted. Working with regulated buyers across the EU and UK.
Designed for NIS2 supply-chain obligations from day one — not retrofitted from a generic GRC suite.
Pilot open today. Free for the first cohort.
The pilot is open now — we are onboarding the first cohort of design partners today. The live production version (V1) is planned for Q4 2026 via the Microsoft Marketplace.
Pilot customers join free or at compute cost. Mutual exchange — we help you, you help us. The first cohort gets the lifetime of input on what we build next.