You searched for ISO 27001

What DORA Article 12 and NIS2 require of a backup policy

Backup Policy: 6 Proven Rules DORA Article 12 Sets

Governance Docs 16th August 2026

Scope, frequency derived from classification, segregation from the source system, RTOs that hold in extreme scenarios, and reconciliation after the restore.

What DORA Articles 26 and 27 require for threat-led penetration testing

Threat-Led Penetration Testing: Who DORA Actually Requires It From

Governance Docs 16th August 2026

DORA TLPT applies only to entities their regulator identifies. Live production systems, a scope the authority validates, and an attestation that travels.

What addressable means in the HIPAA safeguards under 45 CFR 164.306

HIPAA Safeguards: Addressable Does Not Mean Optional

Governance Docs 16th August 2026

The HIPAA Security Rule labels specifications Required or Addressable. Addressable means assess, then implement or document why not and put an alternative in place.

The NIS2 management liability duties under Articles 20 and 32

NIS2 Management Liability: Three Duties on Named People

Governance Docs 16th August 2026

NIS2 Article 20 makes management approve, oversee and be liable for cybersecurity measures — and Article 32(5) can bar a CEO from managerial functions.

The three control populations in a SOC 2 report including complementary user entity controls

Complementary User Entity Controls: The Half You Must Do

Governance Docs 16th August 2026

A SOC 2 report lists controls the provider assumes you operate. Nobody tests them. How to extract, own and evidence complementary user entity controls.

What DORA Article 28(3) requires in the register of information

Register of Information: What DORA Article 28(3) Requires

Governance Docs 16th August 2026

DORA's register of information carries four obligations, and the forward-looking ones get missed. All arrangements, prescribed templates, and the criticality trigger.

GDPR breach notification thresholds, audiences and timing

Breach Notification: Two Thresholds, Two Clocks

Governance Docs 16th August 2026

GDPR breach notification is not one 72-hour rule. Two thresholds, two audiences, phased notification, and the log you must keep even when you do not notify.

TISAX Exchange steps and the active and passive participant roles

TISAX Exchange: The Half of TISAX Suppliers Never Use

Governance Docs 15th August 2026

TISAX is an exchange mechanism, not a certificate. The four steps, why scope decides what customers receive, and the passive role most suppliers never use.

The SWIFT CSCF customer security controls framework and assessment routes

SWIFT CSCF: Your Independent Assessment Can Be Internal

Governance Docs 15th August 2026

The SWIFT CSCF independent assessment can be performed by your own second or third line of defence, not only an external firm. The five-step journey explained.