Fragmented information
Move beyond spreadsheets, emails and documents that are difficult to keep aligned.
Dedalo GRC Advisory / CRAAM Platform
Govern organization, ICT risk, audit and resilience in one environment
CRAAM connects organization, ICT supply chain, risk, IT Audit and business continuity, turning data and evidence into accountability, priorities and measurable decisions.
Banks and financial institutionsInsurance companiesRegulated entitiesICT companiesComplex organizations
CRAAM / Executive overviewGovernance and ICT resilience
Data updatedPriority risks12
Resilience index78%
Open actions34
ICT risk heatmapProbability / impact
Operational oversightStatus by area
Third parties
86%
ICT assets
72%
Resilience
64%
DORA register
91%
Residual riskDistribution
37assessments
Critical 4High 8Medium 16Low 9
Incidents over the last 6 monthsTrend
Third partiesMonitoring
82%complete
23 questionnaires received out of 28
3 priorities require attentionActions assigned to owners and upcoming deadlines
A shared information base for decisions, accountability and evidence
RiskComplianceIT AuditSecurityResilience
Measurable governance
From fragmentation to a shared view
CRAAM makes accountability, dependencies and priorities visible when they are spread across different tools, documents and functions.
Regulatory pressure
Turn requirements into responsibilities, controls, evidence and verifiable actions.
Executive visibility
Give management, governing bodies and audit functions a reliable view of risks and priorities.
Dependencies and accountability
Understand who governs processes, services, suppliers, assets and actions across the ICT supply chain.
Regulations and frameworks
An operating model that adapts to your regulatory perimeter
Requirements, controls, evidence, assessments and reporting are connected in a coherent and maintainable model.
Digital Operational Resilience Act
Information register, ICT third-party assessment, contractual requirements and digital operational resilience.
Assess your perimeterNIS2 Directive
Cyber governance, risk management measures, incident reporting and organizational accountability.
Assess your perimeterItalian Law 90/2024
Support for managing national cybersecurity obligations.
Assess your perimeterData protection
Evidence, accountability, risks, incidents and related organizational measures.
Assess your perimeterInformation Security
Control mapping, assessments, evidence, non-conformities and treatment plans.
Assess your perimeterCybersecurity Framework
Structured assessment of identification, protection, response and recovery capabilities.
Assess your perimeterIT Governance
Governance objectives, controls and accountability for IT management.
Assess your perimeterBank of Italy Circular 285
Risk oversight, business continuity, controls and reporting for the banking sector.
Assess your perimeterBusiness Continuity
Critical processes, BIA, RTO/RPO, scenarios, tests and improvement plans.
Assess your perimeterSolution features
From organizational knowledge to decisions
CRAAM features share the same information base to govern the ICT supply chain, risk, IT Audit, resilience and obligations.
Organization and IT Assets
Build a shared view of the organization and ICT supply chain, making responsibilities, dependencies and critical issues visible.01
Organization and processes
Connect business areas, critical processes and operational responsibilities.
- Roles and responsibilities
- Critical processes
- Supporting services
02
Suppliers
Govern third parties and their role in ICT service continuity.
- Contacts and relationships
- Risk profile
- Delivered services
03
Contracts
Keep an ordered view of agreements, deadlines and contracted services.
- Dates and renewals
- Supply chain
- Linked services
04
Services
Make ICT services and the dependencies supporting the organization visible.
- Supported processes
- Accountability
- Operational dependencies
05
Technology assets
Connect assets to services, criticality and relevant exposures.
- Type and criticality
- Linked services
- Associated exposures
06
Corporate groups
Represent parent companies and group entities, distinguishing responsibilities and technology perimeters.
- Assets by entity
- Shared assets
- Group view
07
Client catalogues
Keep asset types, incident categories, threats and controls autonomous for each organization.
- Copy from the model
- Controlled comparison
- Voluntary restore
Operational IT Oversight
Continuously manage risks, incidents, business continuity, third parties and DORA obligations.01
Incident management
Centralize events, impacts, accountability and response actions.
- Service impact
- Involved responsibilities
- Response and recovery
02
ICT risk and controls
Connect threats, assets, services and controls to distinguish potential, direct and residual risk.
- Potential risk
- Control effectiveness
- Residual risk
03
BIA by process
Assess impacts on critical processes and define continuity objectives and scenarios.
- Impact over time
- RTO and priorities
- Mitigation scenarios
04
Third-party monitoring
Manage supplier campaigns, invitations and questionnaires with comparable results.
- Periodic campaigns
- Structured questionnaires
- Comparison and follow-up
05
DORA Due Diligence
Assess criticality, requirements and concentration risk before and during ICT supplier relationships.
- Ex-ante assessment
- Contractual requirements
- Concentration risk
06
DORA Register
Support the management and updating of the Register of Information.
- ICT supply chain
- Linked data
- Governed updates
07
Consolidated ROI and DORA
Manage regulatory data, direct suppliers and group relationships consistently with the organizational perimeter.
- Group data
- Direct suppliers
- Regulatory export
IT Audit
For Audit Clients, plan and conduct campaigns with structured checklists, evidence, assessments and progress indicators.01
IT Audit checklists
Manage structured control models by area, objective and safeguard.
- Reusable models
- Hierarchical structure
- Control safeguards
02
Audit campaigns
Collect assessments, evidence and operational notes across multiple checklists and perimeters.
- Multi-checklist campaigns
- Evidence provided
- Notes and assessments
03
Audit statistics
Aggregate outcomes and monitor gaps, progress, indicators and campaign trends.
- Aggregated indexes
- Gaps to address
- Trends and recommendations
Reporting
Turn operational data, evidence and audit results into views, reports and extracts for management and control functions.01
Dashboard
Review executive views of potential and residual risk, suppliers, audits and priorities.
- Heatmap and residual risk
- Incident trends
- Third-party monitoring
02
Summary reports
Bring key indicators and results together in an immediate view for management and governing bodies.
- Key indicators
- Action priorities
- Shareable summary
03
Technical reports
Explore assessments, evidence, controls, gaps and actions with reports for operational teams.
- Outcomes and assessments
- Evidence and gaps
- Improvement actions
04
Data extraction
Export governed information for analysis, processing and sharing with business tools.
- Structured data
- Customizable analysis
- Controlled sharing
Operational benefits
More control, less scattered work
The platform creates a shared view for organization, IT, Risk, Compliance, Audit and management, turning controls and evidence into a governed process.
Integrated view
One view connects organization, ICT supply chain, risks, controls and third parties.
Auditable evidence
Assessments, decisions, evidence and actions remain organized, accessible and traceable.
Clear accountability
Owners, control functions, group entities and management work with shared, verifiable responsibilities.
Data-supported decisions
Indicators and priorities make areas requiring attention immediately visible.
Governed IT Audit
Checklists, campaigns, assessments, recommendations and gaps are managed through a structured path.
Operational resilience
Incidents, risks, suppliers, BIA and business continuity are governed within the same perimeter.
Platform security
Application controls aligned with the value of governed data
Security is part of the platform operating model: access, segregation, traceability, protection and data availability are treated as structural requirements.
Security-by-design approachConfiguration aligned with roles, responsibilities and client perimeters.
Access and segregation
Centrally managed MFA, roles, profiles, least privilege and tenant separation.
Audit and traceability
Audit logs, change history, evidence and accountability for relevant operations.
Data protection
Encryption, backup and restore, retention and data exportability.
Application security
OWASP best practices, vulnerability management and controlled updates.
Delivery models
Ready for a European cloud or dedicated environment based on business needs.
Governed integration
Architecture ready to connect with existing systems and business information sources.
The Dedalo approach
Platform, method and specialist expertise
CRAAM is built on Dedalo GRC Advisory's experience in IT governance, risk management, compliance and security.
Initial assessment
Perimeter, obligations, processes and priorities.
Configuration
Models, controls, roles and workflows aligned with the client.
Continuous operations
Assessments, monitoring, remediation and reporting.
Evolution
Adapting the model to regulatory and organizational changes.
The company
Dedalo GRC Advisory. Beyond Consulting.
Dedalo is a consulting firm specialized in Information Technology, with legal, technological and organizational expertise in IT & Security Governance, integrated risk management, Compliance and IT Audit.
CRAAM turns this experience into a structured operating capability, designed to support public and private organizations in governance, risk and resilience challenges.
Meet DedaloNews and updates
Topics turned into governed actions
A section ready for regulatory, methodological and operational insights.
DORARegulatory update
DORA and ICT contracts
From ex-ante supplier assessment to contractual requirements and concentration risk oversight.
Read moreIT AuditInsight
From checklists to evidence
A structured path for campaigns, design and implementation assessments, gaps and trends.
Read moreCorporate groupsCRAAM evolution
A consistent model for every entity
Govern assets, suppliers and regulatory data while distinguishing parent company, group entities and shared perimeters.
Read moreFAQ
Frequently asked questions
Concise answers to support an initial evaluation of the platform.
Who is the platform for?
Companies, regulated entities, banks, asset managers, investment firms, insurers, ICT companies and complex organizations that need to govern risk, compliance and resilience.
Which regulations does it support?
The platform is designed to manage models related to DORA, NIS2, Italian Law 90/2024, GDPR, ISO 27001, NIST CSF, COBIT, Bank of Italy Circular 285 and ISO 22301.
Are controls customizable?
Yes. Catalogues, hierarchies, relationships and assessments can be adapted to each client's perimeter.
Does it manage ICT suppliers and third parties?
Yes. It connects suppliers, contracts, services, processes and assets and supports monitoring campaigns and structured questionnaires.
Does it support corporate groups and financial entities?
Yes. CRAAM distinguishes parent companies, group entities and shared assets while maintaining a consistent view of accountability and technology perimeters.
Are catalogues autonomous for each client?
Yes. Asset types, incident categories, threats and controls can be copied, compared and restored from the CRAAM model without overwriting client customizations.
Does it also support IT Audit?
Yes. For Audit Clients, CRAAM provides a dedicated area with hierarchical checklists, campaigns, evidence, assessments, reports and statistics.
Does it support DORA Due Diligence for ICT contracts?
Yes. CRAAM supports assessment of supply criticality, contractual requirements and concentration risk, linking the information to suppliers, contracts and services.
How are supplier questionnaires managed?
Monitoring campaigns allow you to invite suppliers, collect responses, compare results and retain evidence of improvement areas.
Does it support consolidated ROI and group DORA data?
Yes. CRAAM connects entities, direct suppliers, services and group relationships to support regulatory data management and extraction.
Does it support the DORA Register of Information?
Yes. CRAAM supports management and updating of the Register by linking it to ICT supply chain and organizational data.
Which reports are available?
The platform offers dashboards, executive summaries, technical reports and exports to support analysis, decisions and sharing.
How are roles and security managed?
The platform provides distinct roles, tenant segregation, MFA, audit logs and change tracking.
Can it integrate with existing tools?
The architecture is ready for future integrations with data sources, workflows and business tools.
How is it kept up to date?
Dedalo combines application model updates, regulatory expertise and ongoing specialist support.
Contact
Would you like to learn more about CRAAM?
Write to Dedalo GRC Advisory for information about the platform, its features and possible adoption paths.
Write to DEDALO!