Compliance articles.
SOC 2, ISO 27001, third-party risk and GRC programmes.
Compliance articles
-
Compliance
ISO 27001 vs SOC 2: Which One First?
ISO 27001 and SOC 2 both show customers that you take security seriously, but they work differently. Here is how to decide which one to do first.
-
Compliance
SOC 2 Type 1 or Type 2: Which Report Closes the Deal?
A SOC 2 Type 1 report covers design at a point in time; a Type 2 covers design and operation over a period. Here is how to read what your customer is really asking for.
-
Compliance
ISO 27001:2022 After the Transition: What Auditors Expect
The transition period for ISO 27001:2013 certificates ended on 31 October 2025. Here is what certification audits now focus on, and how to show your ISMS really runs.
-
Compliance
What Drives Your SOC 2 Timeline
How long SOC 2 takes depends less on the calendar and more on scope, evidence, tooling and your auditor. Here is what really drives the timeline and how to keep it moving.
-
Compliance
Rating Suppliers by Data and Access
Not every supplier needs the same review. A simple tier model, based on the data a supplier holds and the access it has, puts your effort where the risk really is.
-
Compliance
DORA for ICT Providers: What EU Banks Will Ask You
DORA has applied since January 2025, and EU financial firms now pass many of its expectations to their ICT suppliers. Here is what to expect from the supplier side.
-
Compliance
CERT-In 6-Hour Reporting: Build the Process
The CERT-In directions of 2022 require certain cyber incidents to be reported within 6 hours. A short, practised process makes that deadline realistic.
-
Compliance
NIS2 for Non-EU Suppliers: Why Customers Are Asking
NIS2 asks many EU organisations to manage security risk in their supply chain. If you supply them from outside the EU, expect their questions to reach you.
-
Compliance
PCI DSS 4.0.1: Are Your Future-Dated Requirements Covered?
The future-dated requirements in PCI DSS v4.0.1 became mandatory on 31 March 2025. Here is a practical self-check to see whether your programme has really caught up.