ISO 22301 Gap Analysis: 6 Proven Rules for a Plan That Lands
Clause 8.2 carries everything built on top of it, and 8.5 cannot be closed on paper. How to…
Read More
ISO 27001 Readiness Assessment: 6 Proven Checks
A gap analysis asks what is missing. A readiness assessment asks whether you would pass Stage 2 —…
Read More
Cookie Consent: 6 Proven Rules Article 5(3) Sets
The rule never says cookies and never says personal data. What Article 5(3) covers, the two exemptions read…
Read More
Authorization Boundary: 6 Proven Steps for FedRAMP 2026
The 2026 Consolidated Rules do not define an authorization boundary. Scope now comes from the Minimum Assessment Scope…
Read More
Psychosocial Risk: 6 Proven Steps for ISO 45001
The Framework Directive named work pace and social relationships as hazards in 1989. ISO 45003 is guidance on…
Read More
Unique Device Identification: 6 Proven Rules Article 27 Sets
The UDI-DI and UDI-PI split, where carriers go and where they do not, the Basic UDI-DI on your…
Read More
Whistleblowing Policy: 6 Proven Rules the EU Directive Sets
Seven days to acknowledge, three months to give feedback, and a reversed burden of proof that makes every…
Read More
Backup Policy: 6 Proven Rules DORA Article 12 Sets
Scope, frequency derived from classification, segregation from the source system, RTOs that hold in extreme scenarios, and reconciliation…
Read More
ICT Concentration Risk: 6 Essential Checks Before You Sign
Article 29 calls it a preliminary assessment, so it belongs in procurement. Substitutability, closely connected providers, insolvency law…
Read More
Pseudonymisation vs Anonymisation: 6 Proven GDPR Rules
Pseudonymised data is still personal data. What Article 4(5) requires, and the Recital 26 test — singling out,…
Read More
Fundamental Rights Impact Assessment: 7 Proven Steps for Article 27
Article 27 falls on deployers, not providers. Who owes a FRIA, the six required elements, the duty to…
Read More
DORA Exit Strategy: 6 Proven Steps for Article 28(8)
Article 28(8) requires exit plans that are documented and tested, and Article 30(3)(f) requires a mandatory transition period…
Read More