September 2, 2026 - Governance Docs

Risk criteria under ISO 31000: the 6 decisions to make before assessing anything, how they differ from risk…

All 20 NIST 800-53 control families with their two-letter IDs, base controls versus enhancements, and the 3 families…

Critical ICT third-party providers under DORA: the 4 designation criteria, how a Lead Overseer is chosen, and the…

DORA incident reporting has 3 deadlines: 4 hours from classification, 72 hours for the intermediate report, one month…

A cybersecurity risk register in 10 elements, from NIST IR 8286 Revision 1 - what each field is…

The NIST RMF in 7 steps, from Prepare to Monitor, with the publication behind each - and how…

OPRP vs CCP under ISO 22000: a CCP has a measurable critical limit, an OPRP an action criterion.…

QHSE documentation works when the tiers are decided first: manual, procedures, work instructions, records. What belongs in each…

The COSO 17 principles listed by component, plus the present-and-functioning test, what counts as a major deficiency, and…

A HACCP plan is built from the 12 Codex steps - 5 preliminary steps then the 7 principles.…

An ISO 45001 assessment can mean 4 things: self-assessment, gap analysis, internal audit or certification audit. What each…

CIS Benchmarks are configuration guides; CIS Controls are a prioritized program. What each covers, the 3 profile levels,…

Day: September 2, 2026