ITCN A/S

Denmark · www.itcn.dk · 10 vendors

Resilience scores

Technology vendors

Services catalogue

4 services in catalogue across 3 categories; runs on 10 sub-vendors.

Insights

Last updated 2026-05-25 · revision 1

10 direct vendors, 207 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Migration Readiness: 4/10

Assessed by AI based on technology stack characteristics (cloud-native vs legacy, containerization, microservices), regulatory environment, data residency requirements, financial stability, and vendor lock-in risks. The score ranges from 0-10, where higher scores indicate better readiness for technology migration.

ITCN A/S demonstrates medium migration readiness, leaning towards the lower end. The primary challenge is the core technology stack, particularly the reliance on Microsoft Dynamics NAV (Navision). This is a legacy ERP system that typically requires significant refactoring or specialized migration strategies to move to modern cloud-native environments, potentially incurring high costs and complexity. The current "Server Virtualisation & Hosting" suggests an on-premise or traditional hosted infrastructure, not inherently cloud-native. The lack of data on financial stability (revenue, growth) makes it difficult to assess the company's capacity to fund a potentially large-scale migration effort. While data residency requirements are not specified, operating solely in Denmark for Danish schools strongly implies EU data residency, which could limit cloud provider choices or add compliance layers. The "Vendor Lock-in Risk" is unknown, but deep integration with a system like Navision often implies a degree of vendor lock-in. On the positive side, ITCN A/S's strong expertise in GDPR and data protection, including DPO services, is a significant advantage, as they are well-equipped to navigate the regulatory complexities of cloud migration. Their capabilities in "Full Stack Web Development" and "Backend System Integration & Automation" could be leveraged to modernize specific applications or integrate new cloud services, even if the core ERP remains a challenge.

Compliance

5 in-scope frameworks identified; showing 3.

SOC 2 (source) — Assessment Required

As a cloud and IT service provider managing critical infrastructure for schools, SOC2 compliance would be valuable for demonstrating security controls to clients. While not legally required, it's increasingly expected by customers for service providers handling sensitive data. Medium risk due to competitive disadvantage and client requirements if not implemented.

GDPR (source) — Compliant

ITCN A/S demonstrates strong GDPR compliance with dedicated DPO (Data Protection Officer) on staff, ISAE 3000 certification specifically for personal data handling, annual revision reports, and comprehensive data processing agreements with suppliers. As an IT service provider for schools handling student and employee data, they have implemented appropriate technical and organizational measures. The risk is low due to their proactive compliance approach and specialized GDPR team.

Evidence: https://www.itcn.dk

NIS2 (source) — Assessment Required

ITCN provides critical IT infrastructure and digital services to educational institutions, which could potentially classify them as an Important Entity under NIS2 as a digital service provider. With 63 employees, they exceed the size threshold. However, the specific classification under NIS2 for educational IT service providers requires detailed assessment. Medium risk due to potential applicability and significant penalties for non-compliance if applicable.

Evidence: https://www.itcn.dk

Financials

Financial Resilience Score: 6/10

ITCN A/S operates a cooperative-style IT shared-service model for 18 Danish independent schools, generating sticky, recurring revenue from long-term service agreements. The business benefits from high switching costs reinforced by ISAE 3402 Type 2 and ISAE 3000 assurance, in-house DPO and legal capabilities, and deep domain expertise in Danish school administration systems. This compliance moat and the cooperative structure typically produce stable, predictable cash flows with low leverage, though margins are intentionally thin given the not-for-maximum-profit posture (overskudsdeling/profit sharing back to members). However, the company carries meaningful concentration risks: only 18 customers, 100% exposure to the Danish primary/secondary education sector, and Denmark-only geographic footprint. The loss of one or two member schools would materially impact revenue, and public-sector procurement rules could force competitive tendering. The cooperative pricing model also limits equity buffer accumulation. With 63 employees spread across specialist functions (development, GDPR, ops, security), key-person dependency is a realistic concern. Actual financial statements (revenue, EBIT, equity) were not retrievable in this session, so the score reflects qualitative structural assessment only. The A/S legal form appears relatively recent based on the high CVR serial number, suggesting limited filed financial history under the current entity. Overall, the business model supports moderate resilience anchored by recurring revenue and compliance barriers, offset by customer/sector/geographic concentration.

Key strengths: Recurring-revenue cooperative model with long-term service agreements, Niche specialization in Danish education IT sector, ISAE 3402 Type 2 and ISAE 3000 assurance create compliance moat, In-house DPO and legal staff increase switching costs, Sticky customer base of 18 member schools, Multi-region operational footprint (Aalborg, Copenhagen, Nordjylland)

Risk factors: High customer concentration (only 18 customers), 100% exposure to Danish primary/secondary education sector, Denmark-only geographic concentration, Cooperative pricing limits equity buffer accumulation, Key-person dependency across specialist functions in 63-person org, Public-sector procurement / EU tendering risk, Sensitivity to changes in school funding and consolidation

Revenue by geography

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report