Articles Archives - Governance Docs

NIST AI RMF templates are the question the framework will not answer. What Govern, Map, Measure and Manage…

The ISO 14971 risk management plan is written before the analysis and judged against everything after it. What…

KRI reporting fails when indicators are picked for easy data. The 4 fields every KRI needs, RAG thresholds…

ISO 27001 tools range from a spreadsheet to a GRC platform. The 4 categories, what an assessment tool…

NIST 800-171 templates must cite the right revision. Why CMMC still requires Rev 2 though NIST withdrew it,…

SOC 2 vs HIPAA compared: HIPAA is US federal law, SOC 2 is an AICPA attestation. See what…

The OTCC absorbed the ECC's industrial control systems domain in 2024. What it covers, how it differs from…

The Cloud Cybersecurity Controls split obligations between provider and tenant. CCC-2:2024, the 6 responsibility areas, and what changed…

The 7 NCA cybersecurity controls sets and their current editions, which apply to you, and why CSCC is…

ECC 2-2024 replaced ECC-1:2018 and deleted a whole domain. The 4 domains, 109 controls, where the ICS controls…

How PCI DSS scope is decided: the 3 system categories in priority order, the annual confirmation under Requirement…

What a virtual CISO does, the 5 elements of the service, how to structure and price an engagement,…

Category: Articles