ISO Compliance & Standards Insights

DORA requires yearly testing of continuity, recovery and crisis communication plans, including cyber-attack and switchover scenarios. How to…

DORA TLPT applies only to entities their regulator identifies. Live production systems, a scope the authority validates, and…

The HIPAA Security Rule labels specifications Required or Addressable. Addressable means assess, then implement or document why not…

NIS2 Article 20 makes management approve, oversee and be liable for cybersecurity measures — and Article 32(5) can…

A SOC 2 bridge letter is written by management, not the auditor, and nothing in it is tested.…

A SOC 2 report lists controls the provider assumes you operate. Nobody tests them. How to extract, own…

The EU AI Act’s eight prohibited AI practices have applied since 2 February 2025, with fines up to…

DORA, NIS2, ISO 27001 and sector schemes ask about the same suppliers in different formats. Build one inventory…

DORA’s register of information carries four obligations, and the forward-looking ones get missed. All arrangements, prescribed templates, and…

A DPO is mandatory in three cases, and all of them turn on core activities. What Article 38…

GDPR Chapter V has a strict order: adequacy, then safeguards, then situational derogations. Why the last route is…

Article 15 asks for the data plus eight further items. The extension you must claim inside month one,…