One Passport, Many Stamps — One Report for Multiple Regulations

You’ve probably packed a suitcase before. Every country asks for something different. One wants a visa arranged in advance, one wants you to fill out an arrival card, one wants to see your vaccination certificate. Different counters, different shapes of stamp.

But there’s one thing you hand over at every single counter. Your passport. “Who is this person” doesn’t get proven anew in each country. You just show the same identity document, made once, six times at six countries’ counters.

Regulatory compliance has a similar shape. That’s what this post is about.

Different names don’t mean they’re asking different things

FACT The names of the documents required differ by region. The EU has the NIS2 Directive, and the financial sector has DORA. As an international standard there’s ISO 27001, and on the personal data side, GDPR Article 32 applies. Korea has ISMS-P, which becomes mandatory from 2027. Japan has APPI’s safety management measures, and Singapore has the CII provisions of its Cybersecurity Act.

INFERRED Listed by name alone, it looks like six separate assignments. But look into each counter one at a time and the substance of the questions overlaps. “How did you identify the risks in your systems, and what did you do about them and how.” The wording differs, but this is the question in the end. It’s the same structure as showing your passport six times.

What each counter asks for

FACT The left side of the table below is what each regime requires; the right side is which of those slots a risk assessment report fills. Pay attention to the right-hand column. It’s part of it, not all of it.

INFERRED Read the table vertically and the same words keep repeating in the right-hand column. Risk assessment, technical evidence, documentation. It means what six countries’ counters ask for six times is the same kind of single document.

Why one document works — because the roots are the same

FACT The RMF risk assessment report is built with the NIST SP 800-30 and ISO 27005 methodologies. Neither is specific to any one country; they are international standards that lay out how to measure risk and how to write it down. And on the NIS2 side, we work from CIR 2024/2690 (the EU implementing regulation) and the ENISA technical implementation guidance (June 2025).

INFERRED Because each country’s regime uses these standards as its base material, measuring once, well, in the standard way makes the result reusable across multiple counters. It’s like the identity information used to issue your passport working at any country’s immigration desk. Of course, the format and supplementary materials an examiner asks for can differ from counter to counter.

A passport is not an entry permit

Here the analogy needs one more push. Having a passport doesn’t mean you can enter any country you like. A passport is “a document proving who I am”, not “permission to come in”. Permission is granted by that country’s examiner.

The document looks like this. The risk rating distribution and summary come first, and you export it as PDF or DOCX to submit at the counter.

FACT The RMF report sits in the same place. It is technical supporting documentation for regulatory compliance. It does not include certificate issuance, incident reporting (NIS2 Article 23 and the like), or legal representation. Exporting scan results as PDF or DOCX to submit for an audit or certification review, or to use as supporting material for review — that is the extent of this document’s role.

FACT The stamping happens somewhere else. The EU supervisory authority and CSIRT counters and the incident reporting channels are the job of the NIS2 representative, and handling personal data inquiries is the job of the GDPR Article 27 representative. Our partner Prighter performs both of these representative roles without a local legal entity. Technical verification and legal representation cannot substitute for each other; when the two interlock, you get a structure that lets you take on EU customers without setting up an EU local entity.

Where the document lives

FACT This continues from what Part 5 covered. Scan results and reports are stored in an S3 bucket the customer designates and encrypted with a KMS key the customer owns. The data does not leave the customer’s storage boundary. For reference, Korea and Japan are EU adequacy decision countries, which puts them in a relatively favorable position on data transfers.

INFERRED It’s like not leaving your passport in someone else’s drawer. The more counters a document has to be shown at, the more it matters that it’s in your own hands.

Things to Note

• This post is not legal advice. It is not in a position to say “do this and you comply with NIS2.” Judging compliance is the job of supervisory authorities and certification bodies, and each company’s own legal counsel.
• The RMF report is not a certificate. It is technical supporting documentation for regulatory compliance. It does not include certificate issuance, incident reporting, or legal representation.
• The right-hand column of the table does not cover an entire regime. Each regime also carries requirements that a technical scan cannot verify — organizational, procedural, training, supply chain. What gets filled is the risk assessment and technical control layer.
• What format will be required in an actual audit differs from counter to counter. Even for the same supporting material, submission formats and additional explanations must be confirmed individually.
• Regimes get revised. This post was written based on documents published as of August 2026.

---

Series contents

1. Why you have to submit security paperwork to sell to the EU
2. Why “risk assessment” sounds harder than it is
3. There are 3,000 things to fix — where do I start
4. How do you assess anything without installing a thing
5. What “your data does not cross borders” actually means
6. Dealing with several countries using one document ← this post