Author: Governance Docs

Seven days to acknowledge, three months to give feedback, and a reversed burden of proof that makes every…

Scope, frequency derived from classification, segregation from the source system, RTOs that hold in extreme scenarios, and reconciliation…

Article 29 calls it a preliminary assessment, so it belongs in procurement. Substitutability, closely connected providers, insolvency law…

Pseudonymised data is still personal data. What Article 4(5) requires, and the Recital 26 test — singling out,…

Article 27 falls on deployers, not providers. Who owes a FRIA, the six required elements, the duty to…

Article 28(8) requires exit plans that are documented and tested, and Article 30(3)(f) requires a mandatory transition period…

One term covers three problems: transaction level, entitlement level and function level. What SOX 404, DORA Article 6(4)…

Most schemes classify confidentiality only and have no rule for mixed data. What FIPS 199 and ISO 27001…

The CRA requires you to put in place and enforce a CVD policy. What Annex I Part II(5),…

The CRA asks for an SBOM in four separate places. What Annex I Part II(1), Annex VII, Article…

DORA requires yearly testing of continuity, recovery and crisis communication plans, including cyber-attack and switchover scenarios. How to…

DORA TLPT applies only to entities their regulator identifies. Live production systems, a scope the authority validates, and…