fortControl is a platform for risk management and information security from FortIT AG in Zurich. It combines five linked modules: risk management, reviews (audits and maturity analyses), business continuity management, supplier management and data protection. Organisations use it for an information security management system under ISO/IEC 27001, an internal control system or wider governance, risk and compliance work. Predefined control sets cover standards such as ISO/IEC 27001 and the NIST CSF and can be extended. It is delivered as a hosted web application, and FortIT also offers support with the introduction.
FortIT AG is headquartered in Zurich. According to the vendor, customer data is stored in Microsoft Azure in Switzerland, encrypted in transit and at rest, and logically separated per customer. Switzerland is not an EU member but an EFTA country with an EU adequacy decision. Because the infrastructure runs at Microsoft, a US company, it is worth asking who controls the encryption keys. The vendor states that it supports the Swiss data protection act and the GDPR. The website names no owner or parent company.