Author: Governance Docs

CCPA compliance changed on 1 January 2026. The risk assessment, ADMT and cybersecurity audit deadlines, read from the…

ISO 31000:2018 explained — the three components, why there is no certification, and the third edition now at…

A practical guide to CIS Controls v8.1 — the 18 Controls, the 153 Safeguards, and how the three…

Cyber Essentials certification explained: the five technical controls, why scope decides the outcome, and the four failures that…

FedRAMP authorization has changed. 20x is past the pilots and in wide-scale adoption, Key Security Indicators replaced yearly…

CMMC compliance explained: the three levels, the four phases, and why Phase 2 on 10 November 2026 is…

Classification decides whether you need a notified body. Article 7(1) contains the two rules that settle most cases,…

No harmonised standard has been cited under the CRA, so Article 32(2) currently sends every Annex III product…

Article 14 applies from 11 September 2026, and Article 69(3) reaches products you placed on the market years…

What Regulation (EU) 2024/2847 requires, the four dates that matter, and the provisions manufacturers reliably get wrong.

ISO 42001 vs the EU AI Act: one is a voluntary certifiable standard, the other binding law. What…