Author: Governance Docs

A practical guide to CIS Controls v8.1 — the 18 Controls, the 153 Safeguards, and how the three…

Cyber Essentials certification explained: the five technical controls, why scope decides the outcome, and the four failures that…

FedRAMP authorization has changed. 20x is past the pilots and in wide-scale adoption, Key Security Indicators replaced yearly…

CMMC compliance explained: the three levels, the four phases, and why Phase 2 on 10 November 2026 is…

Classification decides whether you need a notified body. Article 7(1) contains the two rules that settle most cases,…

No harmonised standard has been cited under the CRA, so Article 32(2) currently sends every Annex III product…

Article 14 applies from 11 September 2026, and Article 69(3) reaches products you placed on the market years…

What Regulation (EU) 2024/2847 requires, the four dates that matter, and the provisions manufacturers reliably get wrong.

ISO 42001 vs the EU AI Act: one is a voluntary certifiable standard, the other binding law. What…

GDPR vs HIPAA compared: scope, who they bind, consent and lawful basis, breach deadlines and penalties — and…

ISO 27001 vs ISO 22301 compared: information security versus business continuity, where the two overlap, and why 27001's…