SAGE
SAGE is the shared compliance knowledge base behind Command and Counsel: the laws, standards, frameworks and guidance they cite when they answer a question or write a document. It has no screens of its own. You meet it in the sources under an answer and in the frameworks you work with.
Who uses it
| Who | How they meet SAGE |
|---|---|
| Staff in Counsel | Answers in chat are grounded in SAGE, with each source shown under the answer. Knowledge › Documents lists what SAGE holds. |
| Compliance team in Command | Frameworks, the controls drafted from them and the policy documents Command writes all draw on SAGE. The policy editor's AI co-pilot looks up what a framework requires there. |
Nobody signs in to SAGE, and there is nothing to set up. Every Command and Counsel workspace uses it from the start.
What SAGE contains
SAGE holds 392 documents, grouped in twelve families. This is how Counsel lists them under Knowledge › Documents:
| Family | Documents | What it covers |
|---|---|---|
| BIO | 1 | BIO2, the Dutch government baseline for information security |
| CBW | 1 | The Cyberbeveiligingswet, the Dutch implementation of NIS2 |
| CIS | 1 | CIS Controls v8.1 |
| CRA | 6 | The Cyber Resilience Act (Regulation (EU) 2024/2847), the European Commission's guidance on applying it with its annex, and material on CRA readiness for small and medium-sized businesses, including a maturity model |
| DORA | 1 | The Digital Operational Resilience Act (Regulation (EU) 2022/2554) |
| GDPR | 1 | The General Data Protection Regulation (Regulation (EU) 2016/679) |
| IBD | 353 | Guidance, model documents, factsheets and training material for Dutch municipalities, for example on access policy, encryption, change management, continuity, telework, hardening and secure disposal of equipment |
| ISO/IEC | 4 | ISO/IEC 27000:2018, ISO/IEC 27001:2022 with Amendment 1:2024, ISO/IEC 27002:2022 and ISO/IEC 27005:2022 |
| NEN | 4 | NEN 7510-1:2024 and related material on information security in Dutch healthcare |
| NIS2 | 1 | The NIS2 Directive (Directive (EU) 2022/2555) |
| NIST | 10 | Publications including the Cybersecurity Framework (versions 1.1 and 2.0), SP 800-53 Rev. 5, SP 800-37 Rev. 2, SP 800-61 Rev. 3 and SP 800-218 |
| SOC2 | 9 | SOC 2 guidance: the description criteria, overviews for service organisations and their users, a report review checklist, policy templates and vendor management |
For many of these frameworks SAGE also holds the controls in a structured form, which Command's frameworks are built from. See Frameworks.
Missing a source you need? SAGE can be extended on request. See Adding to the knowledge.
How the knowledge is used
Adding to the knowledge
The documents above are where SAGE starts, not where it stops. New sources are added on request, and the knowledge base can be extended for specific needs: a law, standard or framework that SAGE does not hold yet, guidance for your sector, or other knowledge your teams rely on.
To request knowledge, ask your Soveryne contact or your service provider, or send your request through the contact form. Once a source is added, it appears under Knowledge › Documents in Counsel and is available to the assistants in Command and Counsel.
Need a document only for yourself? Upload it in Counsel instead. See Your uploads.
Troubleshooting
| What you see | Meaning | What to do |
|---|---|---|
| An answer does not cite a framework you expected | That family may be switched off for this chat, or for your default | Check Knowledge › Documents, or the knowledge choice of the chat |
| A framework you need is not listed under Knowledge › Documents | SAGE does not hold it yet | Ask your Soveryne contact or service provider to add it. See Adding to the knowledge |