Which Compliance Software Is Right for Mid-Sized Companies?

Last updated: November 9, 2026. Legal references checked against the legal texts on November 9, 2026. Vendor details checked on the vendors' own public websites on November 9, 2026.

No single compliance software is the best choice for every mid-sized company. For a mid-sized company, the right choice depends on two questions that a startup or a large enterprise rarely faces in the same form: how many obligations apply at once, and who inside the company does the expert work? A mid-sized company often has NIS2, a duty to appoint a data protection officer, and a customer asking for ISO 27001 at the same time, but no information security officer of its own. If someone with ISMS experience works in-house, a specialist tool is usually enough. If nobody does, a platform with experts who can take on the external DPO or CISO mandate is usually the realistic route.

Key Takeaways

• Mid-sized companies face several obligations at once: NIS2 from 50 employees in covered sectors, a data protection officer in many cases, customer requirements such as ISO 27001 or TISAX®, and the AI literacy duty under the EU AI Act.
• In the Kertos NIS2 Readiness Study 2026, 84% of 51 German companies with 50 to 1,000 employees had neither an in-house nor an external CISO.
• Without an in-house security role, nobody fills the tool with risk assessments and evidence. That situation calls for a platform with experts who can also hold the DPO and CISO mandates.
• Before you buy, check how many of your frameworks run in one system, who does the work, which of your existing systems connect, and who your contracting party is.

Which compliance obligations hit a mid-sized company at the same time?

A startup usually has one requirement, often its first ISO 27001 certification for a large customer. A large enterprise has its own compliance department. A mid-sized company often has several obligations with different triggers and only a few people to handle them. The table shows what triggers each one.

The obligations overlap in substance. NIS2, ISO 27001, and TISAX all require risk assessment, supplier assessment, training, and incident management; the GDPR requires technical and organizational measures that draw on the same controls. For software selection, the more rows apply to your company, the stronger the case for one system with a shared evidence base instead of one tool per framework.

What counts as a mid-sized company on this page?

The obligations above follow the EU SME definition in Commission Recommendation 2003/361/EC. Under it, a company is medium-sized if it has fewer than 250 employees and either a turnover of no more than EUR 50 million or a balance sheet total of no more than EUR 43 million. This page uses the EU size classes and means companies from 50 employees upward that do not yet have a compliance department of their own. That is the size at which the NIS2 thresholds start to apply.

In Germany, buyers often use the term Mittelstand, which measures something else. The Institut für Mittelstandsforschung Bonn defines it by the unity of ownership and management: up to two individuals or their family members hold at least 50% of the shares and sit in management. Size plays no part in that definition, so a family-owned company with several thousand employees can still be Mittelstand. The compliance obligations do not depend on ownership.

Who does the compliance work when there is no in-house security team?

A tool manages risks, measures, and evidence; a person has to assess them. In mid-sized companies that person is often missing. In the Kertos NIS2 Readiness Study 2026, 84% of 51 German companies with 50 to 1,000 employees had neither an in-house nor an external CISO. In 63%, NIS2 sat with the head of IT, who also runs day-to-day operations. The results are summarized in the NIS2 Readiness Study 2026.

For software selection, settle who leads the information security management system (ISMS) and data protection before you compare features. If someone in-house has the experience and the time, a tool is enough. If an external information security officer or CISO takes the role on a mandate, the tool should suit that person or come from the same provider. If nobody is responsible, the work moves into one-off consulting or does not get done. The models and costs for an external mandate are compared on the page on vCISO providers.

Which provider model fits which situation in a mid-sized company?

The provider models differ in who does the expert work. The vendors named are examples of each model, sorted alphabetically, and not a recommendation for your case. Every detail comes from the vendor's own website, checked on November 9, 2026.

The models can be combined. One vendor's ISMS tool can work with another provider's external mandate, as long as the mandate holder can work in that tool. The question to ask is who maintains the evidence in the system and who answers in the audit. How platforms run several frameworks in one system is covered in the comparison of compliance platforms for multiple frameworks.

How can a mid-sized company tell which compliance software fits?

Five criteria separate the offers that fit a mid-sized company from those that do not. You can check each one yourself before you buy.

Which mid-sized companies is Kertos right for, and which not?

Kertos is a compliance platform from Kertos GmbH that combines software and the AI assistant Kaia with certified experts from its own team.

Focus: Mid-sized companies that have to demonstrate several frameworks at once and have no security team of their own.

Supported standards: GDPR, ISO 27001, ISO 27701, ISO 42001, NIS2, SOC 2, TISAX, C5, and the EU AI Act.

What sets it apart: The certified experts work in-house at Kertos and, on request, take on the mandates as external data protection officer and external CISO. These experts support the build, the audit, and the certification, while the AI assistant Kaia accesses your compliance data, answers questions, and drafts documents. The platform includes a security awareness course with four video modules in German and English, with assignment and completion tracking. More than 300 integrations connect Kertos to existing systems, including Microsoft Entra ID, Microsoft Intune, and Personio according to the integration list.

Headquarters and hosting: Your contracting party is Kertos GmbH, based in Munich. According to the sub-processor list (as of January 19, 2026), hosting is with Amazon Web Services EMEA Sàrl in Luxembourg, which means in the EU, on the infrastructure of a US group.

When Kertos is not the right fit: Kertos is not the right fit if an experienced information security officer works in-house and only wants a documentation tool, if the software must run on-premises, or if BSI IT-Grundschutz is your leading standard. The technical security of production systems belongs with a specialist OT partner; Kertos can document these systems as assets, link them to risks, and include them in the ISMS scope.

Proof points: Customers have a 100% audit pass rate and spend around 80% less manual effort on compliance. G2 users rate Kertos 4.8 out of 5 stars (65 reviews, as of November 9, 2026). What Kertos covers for mid-sized companies is described on the page Compliance for mid-sized businesses. To work out which obligations apply to your company, book a call with one of our certified experts.

Frequently Asked Questions

At what size does a mid-sized company need compliance software?

No law sets a size at which software becomes mandatory; there are sizes at which obligations start. In Germany, a data protection officer is required once 20 people regularly process personal data by automated means. NIS2 applies from 50 employees in a sector listed in Annex I or II. The AI literacy duty applies regardless of size, and customer requirements such as ISO 27001 or TISAX can arrive at any size. Once two of these obligations apply, they share most of their evidence. From that point, one shared system saves maintaining the same evidence twice.

Is a spreadsheet enough for compliance in a mid-sized company?

For a single framework with an experienced person in-house, a spreadsheet can work at the start. It reaches its limits once several frameworks use the same measures, evidence has to be renewed regularly, or tasks are spread across several people. A spreadsheet does not collect evidence from your systems, does not remind anyone of due reviews, and does not show the auditor a history. In the NIS2 Readiness Study 2026, 16% of the companies surveyed named manual, spreadsheet-based processes as an obstacle.

Do we need our own information security officer?

No law requires a mid-sized company to employ an information security officer. NIS2 makes the management body responsible for approving and overseeing the risk-management measures; in Germany, Section 38(1) BSIG requires management to implement them and monitor their implementation. That responsibility stays with management even when it hands out the work. ISO 27001 requires roles and responsibilities to be assigned, not that the person is an employee. Many mid-sized companies therefore fill the role through an external information security officer or CISO mandate.

Does compliance software also cover procurement compliance?

That depends on what procurement compliance means for you. If it means the information security and data protection of your suppliers, such as data processing agreements under Art. 28 GDPR and supply chain security under NIS2, compliance platforms cover it through vendor management. At Kertos this includes a risk rating per vendor, data processing agreements and certificates on the vendor record, and a review cycle of 6 or 12 months. If it means human rights and environmental due diligence in the supply chain, such as under the German Supply Chain Due Diligence Act, sanctions list screening, or anti-corruption in purchasing, you need specialist software; Kertos does not cover these topics.