September 2, 2026 - Governance Docs

An ISO 27001 maturity assessment scores how well a control works, not whether it exists. The 6 levels,…

A corrective action program turns on one classification decision. What conditions adverse to quality require, what significant ones…

Special characteristics are one designation flowing through 6 documents. Where each must appear, what it obliges, and the…

DORA subcontracting under Regulation (EU) 2025/532: what the RTS requires, why the chain is now the unit of…

A HIPAA breach risk assessment starts with 3 exclusions, then the 4 factors in 45 CFR 164.402 -…

External providers under ISO 9001 clause 8.4: the 3 sub-clauses, how to band control by effect on conformity,…

NCA ECC implementation in 6 steps: scope, gap assessment, governance, remediation, internal review and assessment - plus the…

ISO 13485 purchasing in 3 parts: supplier evaluation, purchasing information and verification - plus the change-notification agreement most…

An AI system impact assessment looks outward, not inward. What ISO/IEC 42005:2025 asks for in 7 steps, how…

Threat intelligence under ISO 27001 control 5.7: the 3 levels, the 5 artefacts that make it auditable, and…

A plan of action and milestones in 9 fields, where the POA&M is still required in 2026, where…

A shared responsibility matrix decides who patches, configures and restores. What goes in it across IaaS, PaaS and…

Day: September 2, 2026