ISO 27001

PCI SSC does not require PCI DSS validation — your acquirer or payment brand does. How scope really works, and why the Prioritized Approach beats requirement 1.

NIST SP 800-30 explained — the three tiers a risk assessment must run at, the four-step process, and why most registers never change a decision.

NIST published SP 800-171 Rev 3 in May 2024, but CMMC still runs on Rev 2 because 32 CFR 170.14 incorporates it by reference. What that means for your SSP.

SAMA compliance explained — the four domains of the Cyber Security Framework, the six maturity levels you are audited against, and the level 3 to 4 gap.

BSI C5:2026 explained — the EUCS Substantial alignment, the new subcriteria structure, sharpen versus complement, and the new technical criteria.

CSA STAR explained — the Cloud Controls Matrix, the free Level 1 self-assessment, Valid-AI-ted scoring, and the new STAR for AI route through ISO 42001.