ICT Concentration Risk: 6 Essential Checks Before You Sign
Article 29 calls it a preliminary assessment, so it belongs in procurement. Substitutability, closely connected providers, insolvency law…
Read More
Pseudonymisation vs Anonymisation: 6 Proven GDPR Rules
Pseudonymised data is still personal data. What Article 4(5) requires, and the Recital 26 test — singling out,…
Read More
Fundamental Rights Impact Assessment: 7 Proven Steps for Article 27
Article 27 falls on deployers, not providers. Who owes a FRIA, the six required elements, the duty to…
Read More
DORA Exit Strategy: 6 Proven Steps for Article 28(8)
Article 28(8) requires exit plans that are documented and tested, and Article 30(3)(f) requires a mandatory transition period…
Read More
Segregation of Duties: 6 Proven Steps for SOX and ISO 27001
One term covers three problems: transaction level, entitlement level and function level. What SOX 404, DORA Article 6(4)…
Read More
Data Classification: 6 Proven Steps for ISO 27001
Most schemes classify confidentiality only and have no rule for mixed data. What FIPS 199 and ISO 27001…
Read More
Coordinated Vulnerability Disclosure: 7 Essential CRA Steps
The CRA requires you to put in place and enforce a CVD policy. What Annex I Part II(5),…
Read More
SBOM Requirements: 6 Proven Steps to CRA Compliance
The CRA asks for an SBOM in four separate places. What Annex I Part II(1), Annex VII, Article…
Read More
Business Continuity Exercise: 6 Proven Steps to Test the Switchover
DORA requires yearly testing of continuity, recovery and crisis communication plans, including cyber-attack and switchover scenarios. How to…
Read More
Threat-Led Penetration Testing: Who DORA Actually Requires It From
DORA TLPT applies only to entities their regulator identifies. Live production systems, a scope the authority validates, and…
Read More
HIPAA Safeguards: Addressable Does Not Mean Optional
The HIPAA Security Rule labels specifications Required or Addressable. Addressable means assess, then implement or document why not…
Read More
NIS2 Management Liability: Three Duties on Named People
NIS2 Article 20 makes management approve, oversee and be liable for cybersecurity measures — and Article 32(5) can…
Read More