CIVAC Demo: From filing cabinet to audit-proof platform in 45 minutes

A CIVAC demo is not a pitch deck. It is a 45-minute tour of the workspace where CIVAC actually works as a compliance platform and officer-as-a-service. You can see the 25 representative roles, 490 ready-to-use audit templates, the appointment certificate route, the reporting line and the 24/72 reporting path according to Art. 14 NIS2UmsuCG. We open the modules live and play through your specific role question instead of showing slides that no one will find again later. This saves preparation time on both sides and provides a reliable picture of the platform.

This article explains what a productive demo contains, how you can prepare in ten minutes, which questions you should definitely ask and what the transition from demo to order looks like if you decide to introduce the platform after the 45 minutes. Licence the workspace for your internal representatives, or have our representatives order it. We show both models in the demo so that you can judge the difference not from a PDF, but from a real client setup. The appointment is free of charge and non-binding. We treat the demo like a technical workshop, not like a sales appointment, and tailor it to the urgent issues facing your company. At the end of the 45 minutes, a concrete picture remains that can be meaningfully discussed in the internal committee.

The demo immediately opens a complete client workspace with anonymized examples, without advance slides. You see the 25 representative roles as their own modules, each with an appointment certificate route, a catalogue of tasks according to the respective technical law and a link to the appropriate audit templates. We show the modules that are relevant for you: these are often DSB, ISB according to BSI-Grundschutz and NIS-2, compliance officer, ESG officer, whistleblower protection reporting centre according to HinSchG and, depending on the industry, hygiene, dangerous goods, money laundering or fire protection officer. Each role comes with its own templates, which we access and discuss live if necessary.

In the second block we open a specific audit template. In total, CIVAC provides 490 pre-filled templates that cover typical processing activities, risk analyses, NIS 2 maturity checks or whistleblower processes. You see fields, mandatory information, the logic of the completeness check and the version status. Each template is ready for immediate use and can be customized for each client without losing the standard. In the third block we show the reporting line: who signs the statement, who marks the acknowledgment, where is the trace if the management decides otherwise. The appointment certificate, signed, filed, verifiable.

The final step is the reporting path. For ISB clients the NIS 2 early warning path with 24-hour initial report and 72-hour follow-up report, for DSB clients the 72-hour path according to Art. 33 GDPR. You see how a real report is built up from the master and activity data, instead of being reconstructed from Excel tables. The auditor calls, the evidence is ready. The demo ends with an open question and answer session in which we clarify industry-specific special cases and audit requirements of your clients. We often show a specific view here for auditors who come to your company during a supplier audit, so that it becomes clear how the workspace appears from a third-party perspective.

A productive demo doesn't need much preparation. Three points are enough. First: What role is your acute pressure point today? DSB, ISB, compliance, ESG, whistleblower protection, hygiene, dangerous goods or one of the other 18 roles from the CIVAC portfolio? Secondly: What specific reason drives you to the appointment? An upcoming audit, a new client with an ISO 27001 requirement, an NIS 2 classification as an essential or important facility, a dropped internal DPO, a supervisory inquiry or a board decision to establish a compliance function?

Third: Who is at the table? Management, data protection, IT security, human resources, legal department, purchasing. A demo is more effective when the decision-makers sit together with those who will then use the system. We recommend a group of three to six participants; more than that dilutes the discussion. We use these three points to adjust the demo scenario before the appointment: which role we call up, which template we open, which reporting path constellation we run through live. This saves the 45 minutes of the general product pitch and directly provides a concrete use case.

We optionally send a short version of the appointment certificate and a sample task list for the selected role before the appointment. This allows the committee to examine, in parallel with the demo, the question of whether the internal ordering model or an external officer-as-a-service is a better fit. We don't bring a lead sheet, we want to answer your question. Others run compliance like a filing cabinet. We run it like software., and that's exactly what the demo is intended to show. Anyone who shares this in advance will win the discussion in the demo about the mandate model, not about the platform functionality. The platform functions are shown alongside, the discussion remains at the strategic level.

CIVAC operates in two models, and you see both in the same demo because the software is no different. In the first model, you licence the workspace for your internal representatives. Your DPO, ISB or compliance officer receives access, reporting lines and representation rules, and uses the platform as an operational tool. This variant is suitable if the function is already occupied internally and you want to reduce the load caused by Excel, Word and an open SharePoint folder. The licence includes all 25 roles and 490 audit templates.

In the second model, you have our representatives order you. CIVAC provides an external DPO, ISB, compliance officer or one of the other 25 roles with an appointment document, reporting line and representation rules. This variant is suitable if the function is vacant, if the internal position is overloaded or if audit pressure requires quick filling. The demo shows both settings side by side so that you don't answer the question abstractly, but on the concrete surface. The separation between the duty of the responsible person and the duty of the agent remains identical in both models.

A third point that is discussed in the demo: the change between the models. Companies often start with officer-as-a-service because the external officer is quickly available and move to the workspace model after twelve to 24 months as soon as a position has been created internally. The documentation does not break. The appointment certificate, signed, filed, verifiable. In the demo we show this transition using an anonymized example from our clients. If you are unclear in advance which model is suitable, you should follow this transition route carefully. It is the most important lever for making a decision about the mandate model with a long half-life.

A demo becomes productive when the questions are sharp. Seven questions are particularly worthwhile. First: Where is the data located? CIVAC operates the workspace with EU data residency and an ISMS according to ISO/IEC 27001:2022 with 93 controls, an important argument for clients with ISO requirements. Secondly, how long does it take to appoint an external representative? The CIVAC SLA sets two working days instead of the classic two to six weeks. Third: Which of the 490 audit templates suit my industry and cover my current audit pressure?

Fourth: How does the reporting line work if management decides differently than the representative? You will see the statement according to Art. 39 GDPR or § 38 BSIG documented in the demo, with date, signature and distribution list. Fifth: What does 24-hour early warning under NIS-2 look like in practice? We open the reporting path and go through the mandatory fields. Sixth: What happens if we change the model after 18 months? The platform remains, the appointment certificate is adjusted, the documentation is processed without having to set up a second system.

Seventh: What internal costs do we have left? The demo clearly shows the separation between the duty of the responsible person and the duty of the agent. CIVAC neither relieves you of management responsibility in accordance with Section 130 OWiG nor the involvement of the specialist departments. What we deliver is a platform, appointment certificate and reporting line. Anyone who asks these seven questions will avoid the typical demo trap: a good feeling, but no concrete decision. A well-run demo leaves you with a list of two to four concrete next steps, not a vague sense of excitement. This list should prepare the proposal you will receive two business days later and structure the discussion in your internal decision-making committee.

A 45-minute demo covers the platform, model and a specific use case. What it cannot provide is a complete industry analysis, an audit of your existing documentation or a technical security assessment of your IT landscape. These steps follow after the demo when both sides have confirmed the general fit. CIVAC usually then conducts a second conversation with an in-depth focus on a role, an industry or a specific audit requirement, often with the participation of your IT or legal department.

A contract negotiation is also not included in the demo. We show the licence scope and SLA in standard form, individual commercialization takes place afterwards. Anyone who already discusses pricing details in the demo will lose time for the technical examination. The situation is similar with IT integrations: We clarify single sign-on, SCIM provisioning or API connections in the technical follow-up discussion, which takes place at the request of the IT or security department. The ISO reports and the SOC 2 documents, which we provide upon request, help here.

What the demo, on the other hand, answers very well: Does the platform fit my agent's question, is the model viable for my company, and can I defend the documentation in an audit? If after 45 minutes these three questions are answered with yes, with a concrete gut feeling or with clear follow-up questions, the demo has fulfilled its purpose. Others run compliance like a filing cabinet. We run it like software., and that should become noticeable within 45 minutes. The demo is explicitly not designed as a closed sales appointment, but rather as a technical tour with a clear follow-up process that leaves time for questions.

After the demo, you will receive a written proposal within two business days. It contains three building blocks. Firstly, the scope of the licence: which representative modules, which audit templates, how many workspace places. Secondly, if relevant, the appointment documents for external representatives: name, list of tasks according to the relevant technical law, duration of appointment, rules of representation. Thirdly, the migration plan: in which weeks which modules will go live, which specialist departments will be integrated and when, and when the first complete export will be possible. The plan is concrete and not abstract.

The proposal is not binding. You check it internally, send requests for adjustments and decide in a second appointment. CIVAC does not use printing techniques here because compliance functions are long-term trust decisions. A DSB mandate typically runs for three years, an ISB mandate similar. The decision must be sustainable, not quick. If you decide too early, you will pay later with friction in your own organisation or with a tool change after 18 months.

Onboarding usually starts two to four weeks after the order is placed. In medium-sized companies, the platform is productive after four to eight weeks; larger structures with several companies require three to six months. Anyone who appoints an external representative will receive the appointment certificate within two working days of order confirmation. This means that the representative function begins immediately, even if the migration of the existing documents is still ongoing. Turn reading into an assignment without the strain on the internal teams continuing unabated. This speed is particularly relevant for vacant positions, where the reporting line to those responsible would otherwise stand still for days and supervisory deadlines would go unused. The two-working day SLA also applies to module expansions during ongoing operations, for example when a new subsidiary is added or a role is subsequently activated. The platform remains available during the expansion, there is no migration standstill and no data loss for active operations.

Corporations with several companies need a different demo than a medium-sized company with one company. In this case, we open up the client structure: a central group workspace with subordinate clients per company, common templates, common TOM standards and group-wide reporting lines. You can see how a holding company coordinates its obligations under the GDPR, NIS-2 and, if applicable, LkSG, without the individual company losing its independence. The client separation is technically and organizationally implemented cleanly.

This becomes particularly relevant when the subsidiaries cover different industries, for example a parent company in mechanical engineering with a subsidiary in the healthcare sector and a subsidiary in logistics. The demo shows how different representative roles are activated per client: hygiene officer in the health segment, dangerous goods officer in logistics, data protection officer group-wide, ISB group-wide with NIS 2 constellation. Each role remains anchored in the respective client, the reporting line goes to the group compliance officer, who in turn reports to the board of directors. The reporting channels are shown graphically in the demo and can be adapted to your company's organisational chart.

We also show the NIS-2 constellation for corporations: Which company falls into the scope of application as an essential institution, which as important, which falls out. The thresholds result from Section 28 NIS2UmsuCG and the sector lists. The platform maintains this rating as a repeatable audit template so that the rating can be updated annually or when changes occur. This creates a management tool that the group management can use in the annual report and which can be presented immediately in the context of a supervisory inquiry. External auditors also recognise the uniform structure and save audit time, which measurably reduces annual audit costs and changes the perception of the compliance function in management.

A special case is the demo when a representative position is currently vacant. The internal DPO has resigned, the external service provider has dropped out, and an NIS 2 classification comes as a surprise to you as an essential facility. In this situation we show the officer-as-a-service route with a special focus on speed. The appointment certificate is available within two working days, the representative is able to report, and the reporting line is in place. The supervision request can be answered before the deadline expires.

We play through the transition in the demo. Step one: Appointment of the external representative and entry in the directory. Step two: Transfer the existing documentation, if available, into the workspace, with gaps clearly marked. Step three: Prioritize the urgent tasks, such as an open supervisory request, a pending data breach report, an ISO 27001 audit or an NIS 2 initial report. Step four: handing over to an internal representative if the position is filled again later, without breaking the documentation and without causing a loss of knowledge.

The demo shows these four steps using an anonymized real case from the clientele. Audit-proof, documented, §-38-BSIG-proof. The deadline expires as soon as it is known, so quick transition is crucial in such situations, and that is exactly what the platform demonstrates. If you find yourself in a vacant position, you should conduct the demo with the urgent deadline in mind, so that the second hour does not only follow a procurement process lasting several weeks. In urgent cases, a demo the following day is also possible, if the dates allow it, and the appointment certificate can be issued immediately afterwards, provided all mandatory information is provided. We also record the demo itself so that internal notes remain comprehensible for the decision-making committee.

A CIVAC demo is the shortest way to find out whether the platform and the Officer-as-a-Service model are right for your company. 45 minutes, live in the workspace, on a specific representative role, with a clear follow-up process. If you think the demo works, you will receive a written proposal with licence scope, appointment certificates and migration plan within two working days. If not, the effort remains at three quarters of an hour, with no follow-up costs and no commitment. A second demo is possible at any time if additional departments need to be integrated.

Licence the workspace for your internal representatives, or have our representatives order it. Both models share the same data, the same 490 audit templates and the same reporting line. You can switch between models at any time without having to migrate to a new platform. This is exactly what makes the demo more than just a sales demonstration: it shows an architecture that supports multiple audit cycles and multiple model changes, and which is conceivable in 25 representative roles.

Turn reading into a mandate. Send us a short description of your initial situation and the desired role to info@civac.de or book the appointment using the contact form on civac.de. You will receive a suggested date and a preparation checklist within one working day. The demo takes place as a 45-minute video call, optionally in person with a one-hour drive from Munich, Berlin or the Rhine-Main area. In urgent cases, appointments can also be made the following day, for example in the case of acute supervisory inquiries or vacant representative positions in which a deadline according to Section 38 BSIG or Art. 33 GDPR has already expired and the reporting line must be restored immediately.