Coordinated Vulnerability Disclosure: 7 Essential CRA Steps
The CRA requires you to put in place and enforce a CVD policy. What Annex I Part II(5),…
Read More
SBOM Requirements: 6 Proven Steps to CRA Compliance
The CRA asks for an SBOM in four separate places. What Annex I Part II(1), Annex VII, Article…
Read More
Business Continuity Exercise: 6 Proven Steps to Test the Switchover
DORA requires yearly testing of continuity, recovery and crisis communication plans, including cyber-attack and switchover scenarios. How to…
Read More
Threat-Led Penetration Testing: Who DORA Actually Requires It From
DORA TLPT applies only to entities their regulator identifies. Live production systems, a scope the authority validates, and…
Read More
HIPAA Safeguards: Addressable Does Not Mean Optional
The HIPAA Security Rule labels specifications Required or Addressable. Addressable means assess, then implement or document why not…
Read More
NIS2 Management Liability: Three Duties on Named People
NIS2 Article 20 makes management approve, oversee and be liable for cybersecurity measures — and Article 32(5) can…
Read More
Bridge Letter: What It Covers, and What It Does Not
A SOC 2 bridge letter is written by management, not the auditor, and nothing in it is tested.…
Read More
Complementary User Entity Controls: The Half You Must Do
A SOC 2 report lists controls the provider assumes you operate. Nobody tests them. How to extract, own…
Read More
Prohibited AI Practices: Article 5 Is Already In Force
The EU AI Act's eight prohibited AI practices have applied since 2 February 2025, with fines up to…
Read More
Third-Party Risk Management: One Inventory, Four Regimes
DORA, NIS2, ISO 27001 and sector schemes ask about the same suppliers in different formats. Build one inventory…
Read More
Register of Information: What DORA Article 28(3) Requires
DORA's register of information carries four obligations, and the forward-looking ones get missed. All arrangements, prescribed templates, and…
Read More
Data Protection Officer: When Article 37 Makes One Mandatory
A DPO is mandatory in three cases, and all of them turn on core activities. What Article 38…
Read More