SecCheck: Security and Compliance Analysis for Windows

How an analysis runs

1. Provide the collector. SecCheck Report™ is portable: no installation, no agent, no service. The collector is downloaded from the portal and sits on a drive, a share or in your software distribution.
2. Run the scan. Manually or automated through Intune, MECM, Group Policy or Task Scheduler. The CLI wizard in the portal builds the command line: license token, execution in computer or user context, scan mode Quick, Normal or Deep, report language, e-mail recipient, local storage path - and shows when a scan runs entirely without user interaction (zero-touch).
3. Hand over the result. Collection is strictly read-only and produces machine-readable JSON. It is transmitted directly or - without internet - stored locally and handed over later in a controlled way.
4. Report and dashboard. The portal turns every result into an HTML report, keeps the history per device and brings all devices of an organisation together in one dashboard.

CLI wizard: choose parameters, copy the command line, store it in your software distribution.

The portal

One workspace per organisation - IT service providers manage several customers separately. The dashboard shows where the fleet stands: devices, compliance rate, critical findings, endangered systems, findings by severity, compliance per chapter, the most frequently missed policies and the freshness of reports. The client list shows every device with manufacturer, model, domain, last report and report history.

• Members and roles per workspace, sign-in with Microsoft Entra ID.
• Licenses and tokens per workspace; the token controls the collector.
• History - reports are kept per device; drift analysis over time is in development.
• English and German, light and dark.

Product structure

Analysis and implementation are deliberately separated: SecCheck provides the technical basis for decisions; responsibility for assessment and implementation stays with the customer or the commissioned service provider.

SecCheck is not an EDR, SIEM or monitoring system, not a penetration test and not a vulnerability scanner, and it assesses Windows systems only; it does not replace an audit or certification but provides the technical evidence for it.

The requirements named above, in one sentence each

The tiles name the requirements each industry is measured against. Here is what they stand for, in brief. SecCheck provides the technical evidence per device for them, but does not replace a legal assessment.

NIS2

EU directive on cybersecurity, implemented in Germany through the BSI Act: important and essential entities must manage risks, report incidents and prove their measures; the management body is responsible for this.

KRITIS

Operators of critical infrastructure (energy, water, health, IT, transport and others) under the German BSI Act and the KRITIS ordinance: implement the state of the art, prove it every two years, report disruptions.

BSI IT-Grundschutz

Methodology and catalogue of building blocks by the German BSI for an information security management system; the benchmark for federal authorities and the basis of the certification "ISO 27001 based on IT-Grundschutz".

ISO 27001

International standard for information security management systems, certifiable; requires, among other things, hardened, documented and monitored system configurations.

BSI C5

Criteria catalogue of the German BSI for cloud and data centre services; providers have compliance attested by auditors.

DORA

EU regulation on digital operational resilience in the financial sector, applicable since 17 January 2025: ICT risk management, testing, incident reporting and oversight of ICT service providers.

MaRisk

BaFin circular with minimum requirements for the risk management of banks; specifies the duties for organisation, risk control and IT under the German Banking Act.

IT-Sicherheitskatalog

Catalogue of the German Federal Network Agency under section 11 of the Energy Industry Act for electricity and gas grid operators and energy plants: a certified ISMS to ISO 27001 is mandatory.

B3S

Industry-specific security standards, for example the B3S for hospitals by the German Hospital Federation; recognised by the BSI as suitable to meet the KRITIS requirements.

TISAX

Assessment and exchange mechanism of the automotive industry (ENX, based on the VDA ISA) for the information security of suppliers; assessed by accredited providers, results are shared among manufacturers.

GxP

Collective term for the good practice rules in pharma and medical technology (GMP, GLP, GCP): IT systems must be validated, traceable and tamper-proof, for example under EU GMP Annex 11 and 21 CFR Part 11.

Classified information

Rules for handling classified material under the German Security Clearance Act and the classified information directive, in industry under the Geheimschutzhandbuch; requires approved, documented and controlled IT.

DoD STIGs

Security Technical Implementation Guides by DISA (US Department of Defense): detailed hardening requirements per product, used internationally as a reference for system hardening.

GDPR

EU General Data Protection Regulation; Article 32 requires technical and organisational measures in line with the state of the art, Article 5(2) the proof that they work.

KDG und DSG-EKD

Church data protection laws of the Catholic Church (KDG) and the Protestant Church (DSG-EKD), which take the place of the GDPR for church and social welfare organisations, with their own supervisory bodies.

§ 203 StGB and professional law

Criminal provision protecting private secrets held by doctors, lawyers, tax advisors and other professionals bound to secrecy; since 2017 paragraph 3 governs the involvement of IT service providers, and the professional codes add IT security requirements.

StaRUG

German Corporate Stabilisation and Restructuring Act, in force since 1 January 2021; section 1 obliges the managing directors of limited liability companies to continuously monitor developments that could threaten the company's existence and to counteract them.

Management and IT security

A severe IT security incident can be such a development. For the managing directors of a GmbH, AG, UG, gGmbH or cooperative this means: they must know and monitor the state of IT security with the diligence of a prudent businessperson (section 43(2) GmbHG, section 93(2) AktG). The German NIS2 implementation additionally requires the management body to approve the risk management measures, to oversee their implementation and to attend training. Public authorities do not fall under the StaRUG, municipal companies in private legal form do. SecCheck provides the documented state per device for this: traceable, repeatable, as a report. It does not replace a legal assessment.