Data Classification: 6 Proven Steps for ISO 27001
Most schemes classify confidentiality only and have no rule for mixed data. What FIPS 199 and ISO 27001…
Read More
Coordinated Vulnerability Disclosure: 7 Essential CRA Steps
The CRA requires you to put in place and enforce a CVD policy. What Annex I Part II(5),…
Read More
SBOM Requirements: 6 Proven Steps to CRA Compliance
The CRA asks for an SBOM in four separate places. What Annex I Part II(1), Annex VII, Article…
Read More
NIS2 Management Liability: Three Duties on Named People
NIS2 Article 20 makes management approve, oversee and be liable for cybersecurity measures — and Article 32(5) can…
Read More
Bridge Letter: What It Covers, and What It Does Not
A SOC 2 bridge letter is written by management, not the auditor, and nothing in it is tested.…
Read More
Complementary User Entity Controls: The Half You Must Do
A SOC 2 report lists controls the provider assumes you operate. Nobody tests them. How to extract, own…
Read More
TISAX Exchange: The Half of TISAX Suppliers Never Use
TISAX is an exchange mechanism, not a certificate. The four steps, why scope decides what customers receive, and…
Read More
SWIFT CSCF: Your Independent Assessment Can Be Internal
The SWIFT CSCF independent assessment can be performed by your own second or third line of defence, not…
Read More
PCI DSS Validation: Who Requires It, and What to Do First
PCI SSC does not require PCI DSS validation — your acquirer or payment brand does. How scope really…
Read More
NIST SP 800-30: The Three Tiers of Risk Assessment
NIST SP 800-30 explained — the three tiers a risk assessment must run at, the four-step process, and…
Read More
NIST SP 800-53: The Baselines, and Release 5.2.0
NIST SP 800-53 Rev 5 now ships patch releases. What Release 5.2.0 added, why SP 800-53B matters more…
Read More
NIST SP 800-171: Which Revision Your Contract Actually Names
NIST published SP 800-171 Rev 3 in May 2024, but CMMC still runs on Rev 2 because 32…
Read More