DEV Community

Alex Kane
Alex Kane

Posted on

n8n for CyberSecurity/InfoSec SaaS: 5 Automations for SEC Cyber Disclosure, NIS2, NY DFS, and PCI DSS 4.0 Compliance

#n8n #automation #security #programming

CyberSecurity and InfoSec SaaS vendors sit at the intersection of every major incident disclosure regulation — and they all fire on different clocks. The SEC's 4-day Form 8-K rule runs in calendar days from determination of materiality. NIS2 runs in two stages: 24 hours for the initial report, 72 hours for the comprehensive one. NY DFS 23 NYCRR 500 requires notification within 72 hours. PCI DSS v4.0 reached full mandatory enforcement in March 2025. NIST CSF 2.0 added a new GOVERN function in February 2024 that most SaaS compliance programs haven't mapped yet.

If your platform routes incident telemetry, vulnerability data, or security event logs through a cloud iPaaS like Zapier or Make, you have a chain-of-custody problem: your SIEM data — including indicators of compromise, threat actor TTPs, and affected system inventories — is now in a third-party vendor's infrastructure. Self-hosted n8n inside your security perimeter keeps that data under your control and turns your workflows into auditable compliance artifacts.

Here are five n8n automations that every CyberSecurity/InfoSec SaaS vendor should have running.

Who this is for

These workflows are relevant across the entire cybersecurity SaaS stack:

Customer Tier Key Compliance Obligations
ENTERPRISE_SIEM_SAAS SEC 13a-21 material incident 4-day clock, NIS2 72h, NY DFS 72h, SOC2 Type II
MDR_MSSP_SAAS NIS2 Art.26 managed security services, NY DFS 500.17 72h, NIST CSF 2.0 DETECT/RESPOND
VULN_MGMT_SAAS PCI DSS v4.0 Req 11.3.2 internal pentest, NIS2 Art.21 vulnerability handling, CVSS scoring
ENDPOINT_SAAS ISO 27001:2022 Annex A 8.8 management of vulnerabilities, PCI DSS Req 6.3.3 patches
CLOUD_SECURITY_SAAS CSA CCM v4, SOC2 CC6.6-CC6.8, NIS2 Art.21 supply chain security
IAM_SAAS NIST CSF 2.0 PR.AA (Access Control), PCI DSS Req 8 strong authentication, GDPR Art.32
CYBERSEC_STARTUP SOC2 Type I path, ISO 27001 gap assessment, NIST CSF 2.0 GOVERN tier

Workflow 1: SEC Cyber Disclosure Rule 13a-21 — 4-Day Form 8-K Materiality Pipeline

The SEC's cybersecurity disclosure rules (effective December 2023) require public companies — and by extension any SaaS vendor whose platform handles material incident detection — to file Form 8-K under Item 1.05 within four calendar days of determining an incident is material. The clock starts at the determination, not the discovery. Delaying that determination to delay disclosure is itself an enforcement risk.

{
  "name": "SEC Cyber Disclosure Rule 13a-21 \u2014 4-Day Form 8-K Pipeline",
  "nodes": [
    {
      "id": "n1",
      "name": "Incident Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "sec-cyber-incident",
        "responseMode": "lastNode"
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "n2",
      "name": "Classify Incident Materiality",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const i = $json;\nconst MATERIAL_INDICATORS = [\n  'customer_pii_breach', 'financial_data_exfiltration', 'ransomware_operational_impact',\n  'critical_infrastructure_disruption', 'board_notification_triggered',\n  'external_counsel_engaged', 'cyber_insurance_claim_filed'\n];\nconst materialScore = [\n  i.affected_customers > 10000,\n  i.financial_exposure_usd > 100000,\n  i.operational_impact_hours > 24,\n  MATERIAL_INDICATORS.includes(i.incident_type),\n  i.ransomware === true,\n  i.nation_state_actor === true\n].filter(Boolean).length;\n\nconst determinationTs = i.determination_timestamp || new Date().toISOString();\nconst deadlineTs = new Date(new Date(determinationTs).getTime() + 4 * 24 * 60 * 60 * 1000).toISOString();\nconst hoursRemaining = (new Date(deadlineTs) - new Date()) / 3600000;\n\nreturn [{ json: {\n  ...i,\n  material_score: materialScore,\n  sec_material: materialScore >= 2,\n  determination_ts: determinationTs,\n  form_8k_deadline_ts: deadlineTs,\n  hours_remaining: Math.round(hoursRemaining * 10) / 10,\n  urgency: hoursRemaining < 24 ? 'CRITICAL' : hoursRemaining < 48 ? 'URGENT' : 'MATERIAL_TRACKED',\n  sec_rule: '17 CFR \u00a7229.106 / Rule 13a-21 Item 1.05'\n} }];"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "n3",
      "name": "Material Incident?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.sec_material }}",
              "value2": true
            }
          ]
        }
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "n4",
      "name": "Alert CISO + Legal",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "={{ $json.ciso_email }}",
        "subject": "SEC MATERIAL CYBER INCIDENT \u2014 Form 8-K deadline {{ $json.form_8k_deadline_ts }}",
        "message": "Material cybersecurity incident determined.\n\nIncident ID: {{ $json.incident_id }}\nType: {{ $json.incident_type }}\nMateriality Score: {{ $json.material_score }}/6\nDetermination: {{ $json.determination_ts }}\nForm 8-K Deadline: {{ $json.form_8k_deadline_ts }}\nHours Remaining: {{ $json.hours_remaining }}h\nRule: {{ $json.sec_rule }}\n\nEngage external counsel immediately. Board notification required before filing.",
        "additionalFields": {
          "bcc": "general-counsel@company.com"
        }
      },
      "position": [
        900,
        200
      ]
    },
    {
      "id": "n5",
      "name": "Slack #sec-cyber-critical",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#sec-cyber-critical",
        "text": "SEC MATERIAL INCIDENT | {{ $json.incident_id }} | 8-K due: {{ $json.form_8k_deadline_ts }} | {{ $json.hours_remaining }}h remaining | Rule 13a-21"
      },
      "position": [
        900,
        320
      ]
    },
    {
      "id": "n6",
      "name": "Postgres: Log SEC Disclosure",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "sec_cyber_disclosure_log",
        "columns": "incident_id,incident_type,material_score,sec_material,determination_ts,form_8k_deadline_ts,hours_remaining,urgency,created_at",
        "additionalFields": {}
      },
      "position": [
        900,
        440
      ]
    },
    {
      "id": "n7",
      "name": "Respond 200",
      "type": "n8n-nodes-base.respondToWebhook",
      "parameters": {
        "respondWith": "json",
        "responseBody": "={\"status\":\"logged\",\"sec_material\":{{ $json.sec_material }},\"deadline\":\"{{ $json.form_8k_deadline_ts }}\"}"
      },
      "position": [
        1120,
        300
      ]
    }
  ],
  "connections": {
    "Incident Webhook": {
      "main": [
        [
          {
            "node": "Classify Incident Materiality",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Incident Materiality": {
      "main": [
        [
          {
            "node": "Material Incident?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Material Incident?": {
      "main": [
        [
          {
            "node": "Alert CISO + Legal",
            "type": "main",
            "index": 0
          },
          {
            "node": "Slack #sec-cyber-critical",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres: Log SEC Disclosure",
            "type": "main",
            "index": 0
          }
        ],
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Alert CISO + Legal": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack #sec-cyber-critical": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Postgres: Log SEC Disclosure": {
      "main": [
        [
          {
            "node": "Respond 200",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Key design decisions: The determination_ts field distinguishes when the company determined materiality from when the incident was discovered. Under SEC enforcement guidance, deliberately delaying the materiality determination to avoid the 4-day clock is itself a violation. The material_score field quantifies the factors driving materiality so the rationale is documented for the 10-K annual disclosure required under Rule 13a-21.

Workflow 2: NIS2 Directive + NY DFS 23 NYCRR 500 Multi-Jurisdiction Incident Notification Pipeline

NIS2 (EU Directive 2022/2555, transposed by EU member states October 2024) requires essential and important entities — including cybersecurity SaaS vendors — to notify their national competent authority (NCA) within 24 hours of becoming aware of a significant incident (early warning), then provide a comprehensive report within 72 hours. NY DFS 23 NYCRR 500 (fully effective November 2023) independently requires notification to DFS within 72 hours of determining a cybersecurity event occurred.

{
  "name": "NIS2 + NY DFS 500.17 Multi-Jurisdiction Incident Notification Pipeline",
  "nodes": [
    {
      "id": "n1",
      "name": "SIEM Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "nis2-nyDFS-incident"
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "n2",
      "name": "Jurisdiction & Severity Classifier",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const i = $json;\nconst now = new Date();\n\nconst NIS2_SIGNIFICANT = [\n  'service_disruption_significant', 'data_breach_sensitive', 'ransomware_operational',\n  'supply_chain_compromise', 'critical_infrastructure_impact'\n];\n\nconst jurisdictions = [];\nif (i.eu_operations === true || i.eu_customers === true) {\n  jurisdictions.push({\n    jurisdiction: 'NIS2_EU',\n    authority: i.member_state_nca || 'national_competent_authority',\n    early_warning_deadline: new Date(now.getTime() + 24 * 3600000).toISOString(),\n    comprehensive_report_deadline: new Date(now.getTime() + 72 * 3600000).toISOString(),\n    final_report_deadline: new Date(now.getTime() + 30 * 24 * 3600000).toISOString(),\n    article: 'NIS2 Art.23 Directive 2022/2555'\n  });\n}\nif (i.ny_dfs_covered_entity === true) {\n  jurisdictions.push({\n    jurisdiction: 'NY_DFS_500',\n    authority: 'superintendent@dfs.ny.gov',\n    notification_deadline: new Date(now.getTime() + 72 * 3600000).toISOString(),\n    regulation: '23 NYCRR 500.17(a)'\n  });\n}\n\nconst significant = NIS2_SIGNIFICANT.includes(i.incident_type) || (i.severity || '').toUpperCase() === 'CRITICAL';\n\nreturn [{ json: { ...i, jurisdictions, significant, classified_at: now.toISOString() } }];"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "n3",
      "name": "Significant Incident?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.significant }}",
              "value2": true
            }
          ]
        }
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "n4",
      "name": "Notify Compliance Team",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "={{ $json.ciso_email }}",
        "subject": "MULTI-JURISDICTION INCIDENT \u2014 NIS2 + NY DFS notification clocks running",
        "message": "Significant cybersecurity incident classified.\n\nIncident: {{ $json.incident_id }}\nType: {{ $json.incident_type }}\nJurisdictions: {{ $json.jurisdictions.length }} active\n\nNIS2 Early Warning: {{ $json.jurisdictions[0].early_warning_deadline || 'N/A' }}\nNIS2 Comprehensive Report: {{ $json.jurisdictions[0].comprehensive_report_deadline || 'N/A' }}\nNY DFS 72h Deadline: {{ $json.jurisdictions[1].notification_deadline || 'N/A' }}\n\nEngage legal counsel for simultaneous multi-jurisdiction notification strategy."
      },
      "position": [
        900,
        200
      ]
    },
    {
      "id": "n5",
      "name": "Slack #nis2-nyDFS-alerts",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#nis2-nyDFS-alerts",
        "text": "INCIDENT {{ $json.incident_id }} | {{ $json.jurisdictions.length }} jurisdictions | NIS2 24h early warning starts now | NY DFS 72h starts now"
      },
      "position": [
        900,
        320
      ]
    },
    {
      "id": "n6",
      "name": "Postgres: Incident Audit Log",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "insert",
        "table": "multi_jurisdiction_incidents",
        "columns": "incident_id,incident_type,significant,jurisdictions,classified_at",
        "additionalFields": {}
      },
      "position": [
        900,
        440
      ]
    }
  ],
  "connections": {
    "SIEM Webhook": {
      "main": [
        [
          {
            "node": "Jurisdiction & Severity Classifier",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Jurisdiction & Severity Classifier": {
      "main": [
        [
          {
            "node": "Significant Incident?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Significant Incident?": {
      "main": [
        [
          {
            "node": "Notify Compliance Team",
            "type": "main",
            "index": 0
          },
          {
            "node": "Slack #nis2-nyDFS-alerts",
            "type": "main",
            "index": 0
          },
          {
            "node": "Postgres: Incident Audit Log",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Why this matters: NIS2 and NY DFS run on independent timers from the same underlying event. A vendor managing both EU and New York operations must produce parallel notifications to different authorities on different forms, with different content requirements. This workflow captures the classified_at timestamp that anchors both clocks and routes to the right compliance contacts.

Workflow 3: NIST CSF 2.0 + ISO 27001:2022 Control Gap Tracker

NIST CSF 2.0 (released February 2024) added a sixth function — GOVERN — that covers organizational cybersecurity risk governance: policy, roles, supply chain risk management, and oversight. ISO 27001:2022 restructured Annex A from 114 controls in 14 domains to 93 controls in 4 themes, adding 11 new controls including threat intelligence (5.7), cloud security (5.23), and secure coding (8.28). Most SaaS compliance programs mapped to ISO 27001:2013 haven't completed the gap assessment to the 2022 revision, which was the mandatory migration deadline by October 2025.

{
  "name": "NIST CSF 2.0 + ISO 27001:2022 Control Gap Daily Tracker",
  "nodes": [
    {
      "id": "n1",
      "name": "Daily 7AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 7 * * 1-5"
            }
          ]
        }
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "n2",
      "name": "Load Control Register",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "sheetId": "YOUR_SHEET_ID",
        "range": "CSF_ISO_Controls!A:J"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "n3",
      "name": "Gap Analysis + CSF 2.0 GOVERN Check",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const controls = $input.all().map(i => i.json);\n\nconst CSF2_GOVERN_SUBCATEGORIES = [\n  'GV.OC-01', 'GV.OC-02', 'GV.OC-03', 'GV.OC-04', 'GV.OC-05',\n  'GV.RM-01', 'GV.RM-02', 'GV.RM-03', 'GV.RM-04', 'GV.RM-05', 'GV.RM-06', 'GV.RM-07',\n  'GV.RR-01', 'GV.RR-02', 'GV.RR-03', 'GV.RR-04',\n  'GV.SC-01', 'GV.SC-02', 'GV.SC-03', 'GV.SC-04', 'GV.SC-05', 'GV.SC-06', 'GV.SC-07', 'GV.SC-08',\n  'GV.PO-01', 'GV.PO-02'\n];\n\nconst ISO_27001_2022_NEW_CONTROLS = [\n  '5.7_threat_intelligence', '5.23_cloud_security', '5.30_ict_readiness_bcm',\n  '7.4_physical_security_monitoring', '8.9_config_management', '8.10_info_deletion',\n  '8.11_data_masking', '8.12_dlp', '8.16_monitoring_activities',\n  '8.23_web_filtering', '8.28_secure_coding'\n];\n\nconst gaps = controls.filter(c => c.status === 'NOT_IMPLEMENTED' || c.status === 'PARTIAL');\nconst criticalGaps = gaps.filter(c => c.priority === 'CRITICAL');\nconst governGaps = gaps.filter(c => CSF2_GOVERN_SUBCATEGORIES.includes(c.control_id));\nconst iso2022Gaps = gaps.filter(c => ISO_27001_2022_NEW_CONTROLS.includes(c.control_id));\n\nreturn [{ json: {\n  total_controls: controls.length,\n  total_gaps: gaps.length,\n  critical_gaps: criticalGaps.length,\n  govern_gaps: governGaps.length,\n  iso_2022_migration_gaps: iso2022Gaps.length,\n  gap_detail: gaps.slice(0, 10).map(c => ({ id: c.control_id, name: c.control_name, status: c.status, priority: c.priority })),\n  alert_required: criticalGaps.length > 0 || governGaps.length > 0\n} }];"
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "n4",
      "name": "Critical Gaps?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "boolean": [
            {
              "value1": "={{ $json.alert_required }}",
              "value2": true
            }
          ]
        }
      },
      "position": [
        900,
        300
      ]
    },
    {
      "id": "n5",
      "name": "Slack #infosec-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#infosec-compliance",
        "text": "CSF 2.0 + ISO 27001:2022 Gap Alert | Critical: {{ $json.critical_gaps }} | GOVERN gaps: {{ $json.govern_gaps }} | ISO 2022 migration gaps: {{ $json.iso_2022_migration_gaps }}"
      },
      "position": [
        1120,
        200
      ]
    },
    {
      "id": "n6",
      "name": "Email CISO",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "ciso@company.com",
        "subject": "NIST CSF 2.0 / ISO 27001:2022 Control Gaps \u2014 Action Required",
        "message": "Daily control gap summary:\n\nTotal Controls: {{ $json.total_controls }}\nOpen Gaps: {{ $json.total_gaps }}\nCritical Gaps: {{ $json.critical_gaps }}\nCSF 2.0 GOVERN Gaps (new function): {{ $json.govern_gaps }}\nISO 27001:2022 New Control Gaps: {{ $json.iso_2022_migration_gaps }}\n\nTop gaps: {{ JSON.stringify($json.gap_detail, null, 2) }}"
      },
      "position": [
        1120,
        340
      ]
    }
  ],
  "connections": {
    "Daily 7AM": {
      "main": [
        [
          {
            "node": "Load Control Register",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load Control Register": {
      "main": [
        [
          {
            "node": "Gap Analysis + CSF 2.0 GOVERN Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Gap Analysis + CSF 2.0 GOVERN Check": {
      "main": [
        [
          {
            "node": "Critical Gaps?",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Critical Gaps?": {
      "main": [
        [
          {
            "node": "Slack #infosec-compliance",
            "type": "main",
            "index": 0
          },
          {
            "node": "Email CISO",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 4: PCI DSS v4.0 Compliance Deadline Tracker

PCI DSS v4.0 reached full mandatory enforcement on March 31, 2025, replacing v3.2.1 entirely. The major changes that affect SaaS vendors: Requirement 6.4.3 mandates an inventory and integrity check of all payment-page scripts; Requirement 11.6.1 requires a change-and-tamper detection mechanism for payment pages, fired by unauthorized changes; Requirement 3.6.1 clarifies cryptographic key management documentation. Most SaaS companies running on PCI DSS 3.2.1 compliance programs haven't mapped to the new requirements.

{
  "name": "PCI DSS v4.0 Compliance Deadline Tracker",
  "nodes": [
    {
      "id": "n1",
      "name": "Weekdays 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1-5"
            }
          ]
        }
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "n2",
      "name": "Load PCI Deadlines",
      "type": "n8n-nodes-base.googleSheets",
      "parameters": {
        "operation": "readRows",
        "sheetId": "YOUR_SHEET_ID",
        "range": "PCI_Deadlines!A:G"
      },
      "position": [
        460,
        300
      ]
    },
    {
      "id": "n3",
      "name": "Classify Urgency",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const items = $input.all().map(i => i.json);\nconst now = new Date();\n\nconst PCI_DEADLINE_TYPES = {\n  'PCI_DSS_V4_ANNUAL_ROC': { cycle: 'annual', req: 'Req 12.3.2 targeted risk analysis' },\n  'PCI_DSS_SAQ': { cycle: 'annual', req: 'SAQ-D / SAQ-A merchant level' },\n  'PCI_DSS_ASV_SCAN': { cycle: 'quarterly', req: 'Req 11.3.2 external vulnerability scan' },\n  'PCI_DSS_INTERNAL_PENTEST': { cycle: 'annual', req: 'Req 11.4.3 internal penetration test' },\n  'PCI_DSS_PAYMENT_PAGE_SCRIPT_INVENTORY': { cycle: 'annual', req: 'Req 6.4.3 (v4.0 new)' },\n  'PCI_DSS_CHANGE_TAMPER_DETECTION': { cycle: 'annual', req: 'Req 11.6.1 (v4.0 new)' },\n  'PCI_DSS_KEY_ROTATION': { cycle: 'annual', req: 'Req 3.7.1 cryptographic key rotation' },\n  'PCI_DSS_INCIDENT_RESPONSE_REVIEW': { cycle: 'annual', req: 'Req 12.10.2' },\n  'PCI_DSS_VENDOR_RISK': { cycle: 'annual', req: 'Req 12.8.2 TPSP list' },\n  'PCI_DSS_MFA_REVIEW': { cycle: 'annual', req: 'Req 8.4.2 MFA all non-console admin' },\n  'PCI_DSS_LOG_RETENTION_90D': { cycle: 'quarterly', req: 'Req 10.7 90-day log retention check' },\n  'PCI_DSS_NETWORK_SEGMENTATION_TEST': { cycle: 'annual', req: 'Req 11.4.5 segmentation confirmation' }\n};\n\nconst classified = items.map(item => {\n  const dueDate = new Date(item.due_date);\n  const daysUntil = Math.ceil((dueDate - now) / 86400000);\n  let urgency = 'NOTICE';\n  if (daysUntil < 0) urgency = 'OVERDUE';\n  else if (daysUntil <= 7) urgency = 'CRITICAL';\n  else if (daysUntil <= 14) urgency = 'URGENT';\n  else if (daysUntil <= 30) urgency = 'WARNING';\n  else if (daysUntil <= 60) urgency = 'NOTICE';\n  const meta = PCI_DEADLINE_TYPES[item.deadline_type] || {};\n  return { ...item, days_until: daysUntil, urgency, pci_requirement: meta.req || '', cycle: meta.cycle || '' };\n}).filter(i => ['OVERDUE','CRITICAL','URGENT','WARNING'].includes(i.urgency));\n\nreturn classified.map(c => ({ json: c }));"
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "n4",
      "name": "Slack #pci-compliance",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#pci-compliance",
        "text": "={{ $json.urgency }}: {{ $json.deadline_type }} | Due: {{ $json.due_date }} | {{ $json.days_until }}d | {{ $json.pci_requirement }}"
      },
      "position": [
        900,
        300
      ]
    },
    {
      "id": "n5",
      "name": "Email QSA Contact",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "={{ $json.urgency }}",
              "operation": "equal",
              "value2": "OVERDUE"
            }
          ]
        }
      },
      "position": [
        1100,
        300
      ]
    }
  ],
  "connections": {
    "Weekdays 8AM": {
      "main": [
        [
          {
            "node": "Load PCI Deadlines",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Load PCI Deadlines": {
      "main": [
        [
          {
            "node": "Classify Urgency",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Classify Urgency": {
      "main": [
        [
          {
            "node": "Slack #pci-compliance",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Slack #pci-compliance": {
      "main": [
        [
          {
            "node": "Email QSA Contact",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

Workflow 5: Weekly CyberSec SaaS Compliance KPI Dashboard

Every Monday, pull the compliance health metrics that matter to enterprise CISOs and the board — not just uptime, but regulatory exposure: open SEC disclosure windows, NIS2 notifications pending, PCI DSS overdue items, ISO 27001:2022 control gaps.

{
  "name": "Weekly CyberSec SaaS Compliance KPI Dashboard",
  "nodes": [
    {
      "id": "n1",
      "name": "Monday 8AM",
      "type": "n8n-nodes-base.scheduleTrigger",
      "parameters": {
        "rule": {
          "interval": [
            {
              "field": "cronExpression",
              "expression": "0 8 * * 1"
            }
          ]
        }
      },
      "position": [
        240,
        300
      ]
    },
    {
      "id": "n2",
      "name": "Query Incident Log",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) AS total_incidents, COUNT(CASE WHEN sec_material THEN 1 END) AS sec_material_incidents, COUNT(CASE WHEN sec_material AND form_8k_filed IS NULL THEN 1 END) AS sec_8k_pending, COUNT(CASE WHEN significant AND nis2_reported IS NULL THEN 1 END) AS nis2_pending, AVG(EXTRACT(EPOCH FROM (resolved_at - created_at))/3600) AS avg_resolution_hours FROM sec_cyber_disclosure_log WHERE created_at >= NOW() - INTERVAL '7 days'"
      },
      "position": [
        460,
        200
      ]
    },
    {
      "id": "n3",
      "name": "Query Control Gaps",
      "type": "n8n-nodes-base.postgres",
      "parameters": {
        "operation": "executeQuery",
        "query": "SELECT COUNT(*) AS open_gaps, COUNT(CASE WHEN priority='CRITICAL' THEN 1 END) AS critical_gaps, COUNT(CASE WHEN control_framework='NIST_CSF2_GOVERN' THEN 1 END) AS govern_gaps, COUNT(CASE WHEN control_framework='ISO_27001_2022' THEN 1 END) AS iso2022_gaps FROM control_gap_register WHERE status IN ('NOT_IMPLEMENTED','PARTIAL')"
      },
      "position": [
        460,
        400
      ]
    },
    {
      "id": "n4",
      "name": "Merge Metrics",
      "type": "n8n-nodes-base.merge",
      "parameters": {
        "mode": "combine",
        "combinationMode": "mergeByPosition"
      },
      "position": [
        680,
        300
      ]
    },
    {
      "id": "n5",
      "name": "Build HTML Dashboard",
      "type": "n8n-nodes-base.code",
      "parameters": {
        "jsCode": "const d = $json;\nconst secRisk = d.sec_8k_pending > 0 ? 'RED' : d.sec_material_incidents > 0 ? 'AMBER' : 'GREEN';\nconst pciRisk = d.critical_gaps > 2 ? 'RED' : d.critical_gaps > 0 ? 'AMBER' : 'GREEN';\nconst html = `<h2>CyberSec SaaS Weekly Compliance Dashboard</h2>\n<table border=1 cellpadding=6>\n<tr><th>Metric</th><th>Value</th><th>Status</th></tr>\n<tr><td>Total Incidents (7d)</td><td>${d.total_incidents || 0}</td><td>-</td></tr>\n<tr><td>SEC Material Incidents</td><td>${d.sec_material_incidents || 0}</td><td>${secRisk}</td></tr>\n<tr><td>Form 8-K Pending</td><td>${d.sec_8k_pending || 0}</td><td>${d.sec_8k_pending > 0 ? 'RED \u2014 FILE IMMEDIATELY' : 'GREEN'}</td></tr>\n<tr><td>NIS2 Reports Pending</td><td>${d.nis2_pending || 0}</td><td>${d.nis2_pending > 0 ? 'RED' : 'GREEN'}</td></tr>\n<tr><td>Avg Resolution (hours)</td><td>${Math.round(d.avg_resolution_hours || 0)}h</td><td>-</td></tr>\n<tr><td>Open Control Gaps</td><td>${d.open_gaps || 0}</td><td>${pciRisk}</td></tr>\n<tr><td>Critical Control Gaps</td><td>${d.critical_gaps || 0}</td><td>${pciRisk}</td></tr>\n<tr><td>NIST CSF 2.0 GOVERN Gaps</td><td>${d.govern_gaps || 0}</td><td>${d.govern_gaps > 0 ? 'AMBER' : 'GREEN'}</td></tr>\n<tr><td>ISO 27001:2022 Migration Gaps</td><td>${d.iso2022_gaps || 0}</td><td>${d.iso2022_gaps > 0 ? 'AMBER' : 'GREEN'}</td></tr>\n</table>\n<p><small>SEC Rule 13a-21 | NIS2 Directive 2022/2555 | 23 NYCRR 500 | NIST CSF 2.0 | ISO 27001:2022 | PCI DSS v4.0</small></p>`;\nreturn [{ json: { html, sec_risk: secRisk, pci_risk: pciRisk, ...d } }];"
      },
      "position": [
        900,
        300
      ]
    },
    {
      "id": "n6",
      "name": "Email CISO + Board",
      "type": "n8n-nodes-base.gmail",
      "parameters": {
        "operation": "send",
        "to": "ciso@company.com",
        "subject": "Weekly CyberSec Compliance KPI \u2014 {{ $json.sec_risk }} SEC | {{ $json.pci_risk }} PCI",
        "message": "={{ $json.html }}",
        "additionalFields": {
          "bcc": "general-counsel@company.com",
          "contentType": "html"
        }
      },
      "position": [
        1120,
        300
      ]
    }
  ],
  "connections": {
    "Monday 8AM": {
      "main": [
        [
          {
            "node": "Query Incident Log",
            "type": "main",
            "index": 0
          },
          {
            "node": "Query Control Gaps",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Incident Log": {
      "main": [
        [
          {
            "node": "Merge Metrics",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Query Control Gaps": {
      "main": [
        [
          {
            "node": "Merge Metrics",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Merge Metrics": {
      "main": [
        [
          {
            "node": "Build HTML Dashboard",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build HTML Dashboard": {
      "main": [
        [
          {
            "node": "Email CISO + Board",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}
Enter fullscreen mode Exit fullscreen mode

The self-hosting argument for CyberSecurity SaaS

For cybersecurity SaaS vendors specifically, routing incident data, vulnerability telemetry, and SIEM alerts through Zapier or Make creates a secondary attack surface that regulators have begun scrutinizing:

  • SEC Rule 13a-21: Your Form 8-K must describe the 'nature, scope, and timing' of the incident. If your incident data flows through a third-party iPaaS, the scope description becomes incomplete — you don't fully know what left your perimeter.
  • NIS2 Art.21 supply chain security: NIS2 explicitly requires essential entities to assess the cybersecurity practices of their technology supply chain, including automation vendors.
  • NY DFS 23 NYCRR 500.11: Third-party service providers handling 'nonpublic information' must be covered by your vendor risk program — automation platforms that process SIEM event data qualify.
  • ISO 27001:2022 Annex A 5.23: The new cloud services security control requires policies for cloud provider selection, use, management, and exit — Zapier/Make as a compliance automation vendor needs to be in scope.

Self-hosted n8n keeps incident telemetry, vulnerability data, and compliance workflows inside your security boundary. The workflow JSON files themselves become evidence artifacts — version-controlled, auditable, and producible to examiners without redacting third-party vendor data.

Get the templates

These five workflows are part of the FlowKit n8n Automation Bundle — 15 production-ready workflows for SaaS compliance, revenue ops, and customer success automation.

Browse all templates →

Individual templates start at $12. The bundle is $97 for all 15.

Tagged: n8n, cybersecurity, compliance automation, SEC cyber disclosure, NIS2, NY DFS, PCI DSS v4.0, NIST CSF 2.0, ISO 27001:2022, InfoSec SaaS

Top comments (0)