When it goes wrong, the clocks are already running.

CIIC — the Critical Incident Intelligence Center — knows which regulators bind you before anything happens. On incident, it hands you the plan, the clock schedule, and every regulator-ready report at once — before you've finished the first call. Licensable standalone.

Profile in. Obligations out.

You describe the business once — sectors, jurisdictions, entity types, data classes. CIIC maps that profile to every framework that binds you, against a regulatory dataset verified from primary statutory sources and carrying last-verified dates.

01 · Plan

The next-step plan for this incident, this profile, these frameworks.

02 · Clocks

Every statutory deadline, scheduled from the moment of classification.

03 · Reports

Simultaneous regulator-ready reports, one per framework, drafted in parallel.

04 · Board pack

The summary your board meeting needs — status, obligations, exposure.

The clocks CIIC keeps.

≈4h

DORA

Initial notification after major-incident classification; intermediate and final reports follow.

24h

NIS2

Early warning — then 72h incident notification and a final report within one month.

72h

GDPR

Personal-data breach notification to the supervisory authority.

EU baseline shown — national transposition varies; verify with counsel. Dataset last verified July 2026. CIIC is an operational control plane — informational, not legal advice.

Know your obligations before you need them.

Book a demo

FAQ

Common questions.

What does CIIC stand for?+

The Critical Incident Intelligence Center — Polestead’s regulatory incident-response control plane.

Can CIIC be licensed on its own?+

Yes. CIIC is licensable standalone, separate from the classification platform.

Is CIIC legal advice?+

No. It is operational tooling; its regulatory dataset is verified against primary sources and carries last-verified dates. Confirm national specifics with counsel.