CIVAC Alternative: 14 evaluation criteria for compliance platforms in medium-sized companies

The search for a CIVAC alternative rarely comes from dissatisfaction, but from procurement-related care. An appointment of an agent in accordance with Section 5 BDSG, Section 22 ChemG, Section 22 ArbSchG or the NIS-2 obligations in accordance with Section 32 BSIG is a multi-year commitment with external impact towards supervisory authorities and contractual partners. Procurement departments check at least three providers before each such contract, and management expects a documented comparison process with a comprehensible evaluation matrix. However, the market itself is confusing because three very different models exist in parallel: classic law firms and consulting firms with hourly billing, pure software providers (ISMS tools, data protection client software, whistleblower systems) and integrated platform providers with officer-as-a-service.

This article is not a sales text, but a working aid for the tender. It presents 14 evaluation criteria that a reliable provider comparison must cover, classifies market prices according to model and company size and provides a decision tree for the three most common constellations in medium-sized companies. The aim is for you to have an evaluation matrix in your hand after reading it, with which you can also check providers who are not mentioned by name in this text. A representative is elected once per mandate, with a term of three to five years. The preparation is worth it and it will stand up to later scrutiny by the board of directors or supervisory board.

The first step in a reliable comparative analysis is the classification of providers according to business model. Three models dominate the German market for compliance and agent services, and they are not directly interchangeable. Anyone who compares apples with oranges wins in the price race but loses in the audit. Model one is the classic law firm or consulting firm, often with a focus on data protection, white-collar criminal law or IT law. The service is billed at hourly rates between 220 and 480 EUR, the documentation runs via email attachments, client sharepoints or self-hosted data rooms. The strength lies in the legal depth of individual questions and the quality of the written submissions to supervisory authorities. The weakness lies in the ongoing operational activity and the standardization of the templates.

Model two is pure compliance software: ISMS tools, data protection procedure directories, whistleblower systems, GRC suites. These providers provide a technical platform, but no appointment certificate and no person who is externally responsible to the supervisory authorities. You are a tool, not an agent within the meaning of Section 5 BDSG or Section 7 BSI Act. The buyer also needs an internal or external representative who maintains the software, collects evidence and reacts in the event of an incident.

Model three is the compliance platform with integrated officer-as-a-service. CIVAC works according to this model: licence the workspace for your internal representatives or have our representatives order it. Both paths use the same tenant architecture, the same appointment certificate template and the same 24h/72h reporting path according to NIS-2. A real alternative in the sense of the search query is only a provider from model three or a clearly documented combination of model one and model two, which together provides the same scope of services and can also be handed over cleanly at the end of the mandate.

A documented comparison process requires criteria that can be measured and that the losing bidder cannot successfully object to. The following 14 points have proven themselves in tenders for medium-sized businesses and cover the four clusters of legal certainty, operationality, scaling and verifiability. Legal certainty includes, firstly, the appointment certificate with a named natural person, secondly, the contractual independence clause according to Art. 38 Para. 3 GDPR or the role-specific equivalent in occupational safety or environmental law, thirdly, the proof of qualifications according to Art. 37 Para.

Operativeness includes, fifthly, the guaranteed response time to reported incidents (24 hours is the market standard for situations subject to NIS 2), sixthly, availability outside of business hours with a defined escalation path and weekend availability, seventhly, the replacement arrangement in the event of vacation or illness of the named person, eighthly, the SLA deposit in the contract with specific penalties if deadlines are exceeded.

Scaling includes ninthly the multi-client capability of the platform for group structures with separate authorizations, tenthly the location coverage in the DACH region and the EU, eleventhly the language capability for foreign subsidiaries, at least German and English. Verifiability includes twelfthly the number and timeliness of available audit templates (CIVAC: 490 ready-to-use templates), thirteenth the data residency (EU-only is standard for GDPR compliance, without sub-processing in third countries), fourteenth the audit log of the workspace with complete traceability of all accesses and changes. The auditor calls, the evidence is ready. These 14 points as a table in the RFI save later disputes about the scope of services and are available for later internal auditing. Anyone who displays the criteria as a weighted scorecard with point values ​​for each provider also has an objective basis for making decisions towards the board of directors and supervisory board.

Price comparisons often fail because the models bundle different scopes of services and individual items are only invoiced in the incident. The following price bands refer to the full scope of an appointed representative plus associated platform functions for a typical medium-sized company with 150 employees without special categories of personal data. The values ​​are monthly rents plus VAT and come from 2026 tenders in German medium-sized businesses, validated by ten comparison processes in the last 24 months.

Model one (law firm plus its own documentation storage) is typically EUR 1,800 to EUR 3,200 per month basic salary, depending on the scope of the mandate and the size of the law firm. There are also hourly packages for special situations such as data protection impact assessments, data breach reports or processor audits, which quickly add up to another EUR 400 to EUR 1,200 per month. The documentation storage is managed internally, which ties up 0.2 to 0.4 FTE at the processing level.

Model two (pure compliance software) is 180 to 850 EUR per month per module (data protection, ISMS, whistleblower, ESG). For three modules, 540 to 2,550 EUR per month without a representative. An external representative adds another EUR 1,200 to EUR 2,400 per month, depending on the number of employees and risk profile. Software maintenance ties up 0.1 to 0.3 FTE because the tools are designed for administrative operation, not for content self-updating against current supervisory guidance.

Model three (platform with officer like CIVAC) is 1,400 to 2,600 EUR per month for the entire package including appointment certificate, workspace licence, 490 audit templates and 24h/72h reporting path. Maintenance requires 0.05 to 0.1 FTE because the platform covers the majority of the operational activity and keeps templates automatically versioned. Calculated over 36 months, the platform model has a cost advantage of 30 to 45 percent compared to model one with comparable audit suitability. Others run compliance like a filing cabinet. We run it like software.

The provider comparison does not end with price and criteria, but with the fit with the company constellation. Three constellations cover around 80 percent of German SME inquiries and each lead to a clear recommendation that can also be justified to the supervisory board. Constellation A is the company with fewer than 50 employees, no special data categories, no NIS 2 requirement, one or two representatives (typically data protection officer plus fire protection officer). The recommendation here is model three because the fixed costs of a platform per mandate are cheaper than law firm hourly rates for the same operational activity, and because a central workspace ensures an overview of duties even when internal resources are limited.

Constellation B is the company with 50 to 500 employees, NIS 2 obligation (essential or important), three to seven representatives across several roles (DSB, ISB, ESG, whistleblower office, money laundering officer, supply chain representative). Model three is almost mandatory here because the coordination between the roles takes place via a common workspace, with a common incident database and consolidated reporting line to management. The parallel maintenance of separate law firm mandates creates redundancies, duplicate data breach reports and contradictory files that are immediately noticeable during an audit. The appointment certificate, signed, filed, verifiable is only valid if all appointment certificates are in one system.

Constellation C is the group with more than 500 employees, several subsidiaries, possibly international positioning with subsidiaries in Austria, Switzerland or other EU member states. A hybrid solution is often optimal here: model three for the platform and the appointments of external representatives, model one for strategic legal advice in special situations such as corporate restructuring or cross-border data flows. Pure model one solutions fail due to the multi-client complexity, pure model two solutions fail due to the lack of a representative. The decision tree always ends with the question: Who takes external responsibility as the appointed person, and where is the evidence. The provider must provide both answers in writing in the contract.

Law firm models are not inherently worse, they are structured differently and optimised for other use cases. Six points are regularly overlooked in tenders and later lead to disputes about the scope of services or unexpected additional costs. First: Hourly rates apply from the first minute, even for routine activities such as updating the processing directory, creating training material or answering internal inquiries. At EUR 280 per hour, the annual mandatory update quickly becomes a three-digit item on the quarterly statement.

Secondly: The documentation is usually on the law firm's share point or with a third-party cloud provider with its own data protection declaration. At the end of the mandate, the handover must be contractually regulated, otherwise there will be gaps in the evidence provided to the subsequent representative and the supervisory authority. Third: The natural person named as data protection officer is often a counsel who looks after 40 to 80 other mandates in parallel. The individual response time to incidents is then structurally beyond the 24-hour threshold because the capacity does not scale.

Fourth: In the case of data breaches, the deadline according to Art. 33 Paragraph 1 GDPR runs from the time the person responsible is aware of it, not from the time the law firm becomes aware of it. If the lawyer doesn't come to the office until Monday morning, the deadline has already started and the person responsible bears the risk of a fine. Fifth: Law firm representation arrangements are often imprecise ("another counsel from the team") and, in the event of a crisis, lead to loss of handover between people who do not know the client. Sixth: Audit templates are rarely standardised; Each law firm uses its own templates that cannot be migrated. Anyone who wants to change after three years will receive their documents in a form that the subsequent system cannot adopt 1:1 and will pay for the migration. Deadline begins as soon as we become aware of it. This also applies to handover deadlines at the end of the mandate and to informing the supervisory authority about the change.

Pure compliance software has its market and its functions, but it is not a complete CIVAC alternative because it leaves an essential gap: the appointed natural person with external influence. Seven functions are missing from most software-only offerings and must be purchased separately, often with additional contractual partners and corresponding interfaces. First: There is no certificate of appointment because no person is appointed. The software is a tool, not an agent in the legal sense.

Secondly: There is no external contact person for the supervisory authority. The person responsible's obligation to publish in accordance with Article 37 (7) GDPR must be resolved internally or via an external representative, which requires a second procurement. Third: In the event of data breaches, there is no triage path with a clearly defined contact person and protective clause for affected employees; All escalations run via internal mailboxes, which overflow in the event of a crisis or are read too late.

Fourth: Audit support using the software alone is not possible. An auditor from the BNetzA, the BfDI or a state supervisory authority sits with a person, not with a piece of software. The person must be able to explain and defend the templates from within the software. Fifth: The maintenance of the templates is the responsibility of the buyer; Updates to the software provide technical patches, but no content updates to new supervisory guidance from the BfDI or BSI. Sixth: Multilingualism and country-specific adaptation are rarely fully available in German ISMS tools.

Seventh: The software alone does not fulfil any ordering obligation under Section 5 BDSG, Section 22 ChemG, Section 22 ArbSchG or Section 32 BSIG. Anyone who buys software and thinks that they have fulfilled the ordering obligation has created a risk of fines, which in the worst case according to Art. 83 GDPR can reach up to EUR 20 million or 4 percent of group sales. The CIVAC workspace therefore integrates both levels: the tool and the person who can be appointed as an external data protection officer in the same tenant under EU data residency.

The market separates significantly from the second subsidiary at the latest. A CIVAC alternative for a group must cover four requirements that individual consulting firms and simple ISMS tools cannot structurally meet and cannot retrofit with add-ons. First: Multi-client architecture with separate roles and authorizations per company, but consolidated reports at group level for the supervisory board and group compliance. Eine separate Software-Instanz pro Tochter ist administrativ teuer, führt zu Datenredundanzen und erschwert konsolidierte Risikoanalysen.

Zweitens: Konsolidierte Bestellurkunden-Verwaltung. According to Art. 37 Para. 2 GDPR, a DPO may be appointed for several affiliated companies as long as he can be easily reached from each branch. This condition must be technically and organizationally verifiable, which requires central administration of the appointment certificates with proof of language and accessibility. The parallel information from several supervisory authorities in accordance with Art. 37 Para. 7 GDPR must also be clearly documented.

Third: cross-location incident management. A data breach in an Austrian subsidiary with data flow to a German corporate headquarters creates parallel reporting obligations to the Austrian data protection authority and the responsible German state supervisory authority. The workspace must support both reporting paths from an incident data record, otherwise contradictory statements of facts arise that are immediately noticeable in follow-up checks. Fourth: Language capability for internal users (templates, training, whistleblower channel, dashboards) in German, English and at least a third language, depending on geographical location. Audit-proof, documented, § 32 BSIG-proof. These four points are the sieve through which most model one and model two offers in the corporate environment fall. The CIVAC workspace is built from the start for this multi-tenant logic, without the buyer having to switch between separate instances or consolidate with their own scripts.

The change between compliance providers is regularly underestimated in cost accounting and is usually not even addressed in the first contract negotiations. Five items typically arise when you change provider and are included in every comparison calculation over the term of the mandate. First: data migration. Processing lists, DPIA documents, risk analyses, proof of training and audit reports must be transferred to the subsequent system. Without a standardised export format, costs of EUR 5,000 to EUR 25,000 arise for the migration of a medium-sized portfolio, depending on the number of procedures and the quality of the old data.

Second: updating the appointment certificates. Every existing order must be formally canceled and reissued, with date, signature and countersignature. The supervisory authority must be informed about the new representative in accordance with Article 37 (7) GDPR. Third parties such as processors and joint controllers must be informed of the changed contact person, often by updating the data protection notice on the website. Third: Rebuild the training and awareness materials if the subsequent provider uses different templates and does not allow direct adoption.

Fourth: Dual operation in the transition phase. Three to six months of parallel operation are realistic because both the old system and the new system have to be maintained until incidents, deadlines and ongoing DPIA run smoothly in the subsequent system. These double costs are often forgotten in tenders and lead to escalations at the end of the transition phase.

Fifth: training those responsible internally on the new tool and on the new reporting line. The CIVAC model reduces this risk through two mechanisms: firstly through standardised export formats from the workspace (JSON, CSV, PDF with hash stamp for protection against manipulation) and secondly through the dual model, which allows switching between internal agent use and external ordering at any time within the same tenant. If you want to structurally minimise provider risk, buy data portability as part of a contract with binding export assurances, not as a promise.

Anyone who is seriously considering a CIVAC alternative should not base the comparison on the hourly rate, but rather on the overall value proposition over the term of the mandate. Three next steps lead from the analysis to a decision that will also apply to the next internal audit. First: Define the officer roles that must be appointed in the next 24 months and add the NIS 2 classification (essential, important, not affected) as well as the number of employees per location and the type of data processed. This list is the basis of every serious provider request and protects against misunderstandings in the RFP.

Second: Based on the 14 evaluation criteria from this article, create a request to three providers, if possible one from each of the three models. Ask each provider for a sample purchase appointment certificate, a sample processing record, and a sample audit log extract. Anyone who does not deliver these three artifacts within five working days has not standardised them and will not be able to standardise them in the event of an order.

Third: Have each provider run through the process of a data breach in accordance with Art. 33 GDPR or an NIS 2 early warning in accordance with Section 32 BSIG, with concrete time stamps, escalation paths and role distribution. If you don't do this exercise at the table properly, you won't be able to do it in an emergency. CIVAC is a compliance platform and officer-as-a-service. Licence the workspace for your internal representatives, or have our representatives order it. Both models use the same tenant, the same 490 audit templates, the same 24h/72h reporting path and the same appointment certificate templates. The CIVAC SLA for the first appointment certificate is two working days, compared to six weeks in the classic approach. A test run begins with a message to info@civac.de or via the contact form on civac.de. Turn reading into an assignment.