Guides, playbooks and field notes on getting audit-ready across every framework, written by people who've been on both sides of the audit table.
The Register of Information is the piece of DORA most teams underestimate. It is a living inventory of every ICT contract you hold, and your authority can ask for it at any time. Here is what belongs in it and how to keep it submission-ready.
When an ICT incident turns major under DORA, three reporting clocks start. Miss them and you have a reportable failure on top of the incident. Here is how classification works and what each staged report has to carry.
Evidence that collects itself only works if the platform talks to the tools you already run. Here is how Compliance One connectors work, the kinds of apps we support, a few of the most popular ones every company tends to use, and why every connector is included at no extra cost.
The world's most widely held standard just got its first refresh in over a decade. Here's the plain-English version of ISO 9001:2026 — the sixth edition — covering quality culture, the new split between risks and opportunities, stronger management of change, climate-change considerations, and what actually stays the same.
One certifies quality, the other information security — but under the hood they share the same skeleton. Here's how ISO 9001 and ISO 27001 line up, where they differ, and why running them together is far less than twice the work.
ISO 9001 keeps its documentation requirements lean, but the records it does demand are the ones auditors ask for first. Here's the complete list of documented information the 2026 edition requires — the maintained documents and the retained records — and where each one comes from.
The NIST Cybersecurity Framework 2.0 is the common language a lot of US buyers, insurers and boards reach for. Here is the plain-English version: the six Functions (including the brand-new Govern), the Tiers, the Profiles, and why it is a map rather than a checklist.
One is a voluntary US framework of outcomes, the other a globally certifiable management system. They are not rivals, they are two views of the same work. Here is how NIST CSF 2.0 and ISO 27001:2022 line up, and why most teams end up running both.
The NIST AI Risk Management Framework is the common language US buyers, insurers and boards are starting to reach for when they ask how you manage AI risk. Here is the plain-English version: the four Functions (Govern, Map, Measure, Manage), the seven trustworthy-AI characteristics, and why it is a map rather than a checklist.
One is a voluntary US framework of outcomes, the other a globally certifiable AI management system. They are not rivals, they are two views of the same work. Here is how the NIST AI RMF and ISO/IEC 42001:2023 line up, and why most teams end up running both.
Seventy-two Subcategory outcomes across four Functions sounds like a lot. It is far more manageable than it looks once you see how they group. Here is how to read the AI RMF's structure and work it one AI system at a time.
The AI RMF's Profiles are how you turn the framework into a plan. Capture where your AI risk management is today, define where it needs to be, and the gap becomes your prioritised roadmap. Here is how to build one that leadership will actually use.
Foundation models bring risks the AI RMF's authors could see coming, so NIST published a Generative AI Profile (NIST AI 600-1) to extend the framework. Here is what the GenAI Profile adds, and how to layer it on top of the RMF core.
New Zealand's Privacy Act 2020 runs on 13 Information Privacy Principles, regulated by the Office of the Privacy Commissioner. A new principle, IPP 3A, lands on 1 May 2026. Here is the plain-English tour of the principles, who is bound, and what changes.
Not every privacy breach in New Zealand has to be reported, only those likely to cause serious harm. But getting that judgement wrong is itself an offence. Here is how the serious-harm test works, who you notify, and why the clock matters.
New Zealand's Customer and Product Data Act 2025 sets up a consumer data right, with banking first in line. It sits right next to your Privacy Act obligations. Here is what the CPD Act does, how it connects to open banking, and how to get ahead of it.
India's Digital Personal Data Protection Act, 2023, with the DPDP Rules 2025, is now the law for anyone handling the personal data of people in India. Here is the plain-English version: the roles, the two lawful bases, the obligations, and the deadline that matters.
The DPDP Act's substantive obligations bite on 13 May 2027. This is the practical checklist — records of processing, notice and consent, rights, retention, breach, children and cross-border — to be ready without a last-minute scramble.
Three DPDP obligations trip teams up the most: what a valid notice must say, what makes consent valid (and withdrawable), and why every breach — with no harm threshold — must reach the Board within 72 hours.
If you already run a GDPR programme, DPDP will feel familiar — until it doesn't. Consent is narrower, transfers work the opposite way, breach notification has no threshold, and the fines are fixed rupee ceilings. Here is what to re-check.
Most GRC tools send you off to buy a separate training platform, with its own vendor, bill and login. Compliance One has a native LMS built in, so you can assign courses, quiz staff and issue certificates without any of that. Here is how it works and why it is part of the platform, not an add-on.
You already pay for a compliance platform. It knows your frameworks, your people and your controls. So why are you buying a second tool just to train your staff and store the certificates? A short argument for training that lives where your compliance does.
Every Compliance One account ships with a built-in Model Context Protocol server, so you can ask your AI assistant about your risks, controls, evidence and audits in plain language. Here is what MCP is, what it can and cannot do, and how to connect it safely in a minute.
If your software holds your customers' users' personal data, someone's security team will eventually ask how you protect it. ISO 27018 is the standard that turns your answer into an audited yes. Here is what it asks of a public-cloud processor.
Three ISO standards, three overlapping acronyms, one confused buyer. Here is the plain-English difference between cloud security, cloud PII protection, and a full privacy management system, and how to tell which one your deals actually need.
Everyone runs on the cloud. Almost nobody can prove they run on it securely. ISO 27017 is the standard that turns 'trust us, it is in AWS' into something an auditor will sign. Here is what it asks, and why your monitoring already does most of it.
CSC, CSP, shared. Three little labels that decide whether your next cloud audit is a formality or a fire drill. Here is what they mean, and why writing them down is the whole game.
If you already hold ISO 27001, adding a cloud-security credential sounds like another year of work. It is not. 27017's controls are the same 27002:2022 set you already run, plus four cloud-specific ones. Here is the honest gap.
'Are you GDPR compliant?' is a question with no certificate of its own. ISO 27701 is the recognised way to answer it with evidence instead of a shrug. Here is what the privacy standard actually asks of you.
Before a single privacy control applies, ISO 27701 asks one deceptively simple question: are you a controller, a processor, or both? Get the answer right and the whole programme falls into place. Get it wrong and you protect the wrong things.
Adding a privacy certification on top of your security one sounds like a second mountain. It is more like a well-marked extension of the trail you already climbed. Here is exactly what carries over and what is genuinely new.
Most 'business continuity plans' are a document nobody has opened since the last audit. ISO 22301 is the antidote. Here is what it actually asks of you, in plain English, and why your customers keep asking whether you have it.
Three acronyms, one job: telling you how bad a disruption is allowed to get before someone important starts shouting. Get these numbers right and the rest of business continuity basically writes itself.
Business continuity sounds like a whole new mountain to climb. Good news: if you already hold ISO 27001, you are further up it than you think. Here is what carries over for free and what genuinely needs building.
A passed audit proves your controls existed on paper. It says nothing about what attackers are trying this week. Here is why threat intelligence is the missing half of real security, and why we built a whole command centre for it right inside the platform.
SOC 2? ISO 27001? HIPAA? Everyone has an opinion and most of them are wrong for you. A no-nonsense guide to picking the one certificate that actually unblocks your next deal, instead of collecting all of them like Pokemon.
Spreadsheets feel free. They are not. The bill just arrives later, in the form of your best engineer's weekend and a file named evidence_final_ACTUALFINAL_v9.xlsx. Let us add it up honestly.
Nobody buys your product because you have SOC 2. But plenty of people refuse to buy because you don't. Compliance is rarely the reason you win, and often the reason you lose. Here is how to flip that.
300 questions. A spreadsheet with merged cells. A deadline of 'end of week.' The security questionnaire is where deals go to nap. Here is how to wake them up fast, without inventing answers you cannot back up.
The word 'audit' triggers a very specific fear, somewhere between a tax inspection and a driving test. The reality is calmer, more human, and entirely survivable. Here is what actually happens, and how to walk in ready.
You can buy the best tools money can offer and still get undone by one tired person clicking one convincing link. Your people are either your weakest control or your strongest. The difference is almost entirely training.
The eternal question, usually answered with a shrug and a link to a comparison table. Let us skip the table and answer the real question: which one gets your specific deals unstuck faster, and why doing one makes the other easy.
The traditional compliance year has a shape, and the shape is a cliff. Eleven months of quiet drift, then one month of frantic screenshotting. There is a calmer way to live, and it does not involve screenshotting settings at midnight.
Collecting evidence by hand is the compliance equivalent of doing dishes with a single fork. It works, technically, and it will consume your entire life. Here is how to automate the boring 80 percent so your team can get back to building.
'Where does our data live?' sounds like a simple question. Then a customer in Frankfurt asks it in a contract, and suddenly it is a project. Here is what data residency really means, and why it is quietly a sales feature.
NIS2 quietly turned cybersecurity from an IT concern into a board responsibility, with personal accountability attached. If your directors think this is still someone else's problem, this one is for them.
'How do you govern your AI?' is showing up in more security questionnaires every quarter. ISO 42001 is a much better answer than a nervous shrug. Here is what the first AI management system standard actually asks for.
The world's first comprehensive AI law is here, it is long, and it is written in fluent Regulation. Here is what it actually means for your company, sorted by the only thing that matters: how risky your AI is.
You cannot comply with a 100-plus-article regulation by reading it cover to cover and hoping. You need a sequence. Here are seven concrete steps that take you from 'we should probably look at this' to a programme you could actually defend.
One is a law you must obey. The other is a certification you choose to earn. They are not competitors, they are dance partners, and running them together is far less work than running them apart.
Singapore's Cyber Security Agency offers two marks, and the names do not make the difference obvious. One is a solid baseline, the other a tiered mark of distinction. Here is which one fits where you are, without the guesswork.
Complying with Singapore's PDPA is table stakes. Proving it, visibly, to customers and partners, is a competitive advantage. That is what the DPTM is for. Here is what it takes and why it is worth the effort.
The Philippines DPA is a real law with real teeth, including personal liability and a 72-hour breach clock. The National Privacy Commission has helpfully organised compliance into five pillars. Here is how to actually stand them up.
Expanding across Southeast Asia means meeting Singapore's PDPA and DPTM, the Philippines DPA, and more, each with its own rules. Doing that as separate projects is a fast way to lose your mind. There is a much saner path.
GDPR is not a wall of legal text you memorise. It rests on seven principles and six lawful bases, and once those click, most of the regulation falls into place. Here is the plain-English version, plus the one question that decides your lawful basis.
A GDPR data-subject request is a clock starting. You have one month to respond, and the rights range from access to erasure to portability. Here is what each right actually requires, and how to answer them without dropping the deadline.
Under GDPR you have 72 hours from becoming aware of a personal-data breach to notify the supervisory authority. That is not long. Here is a runbook you can actually follow at 2am, including the one decision that determines whether you notify individuals too.
You cannot get 'GDPR certified', which frustrates every buyer who asks for proof. ISO 27701 is the closest thing there is: a certifiable privacy management system mapped to GDPR article by article. Here is how the two fit together, and why you want both.
ISO/IEC 20000-1 is the certifiable standard for running IT services well. Here's the plain-English version: what a Service Management System is, how it relates to ITIL, and the service lifecycle it asks you to run — from the service catalogue and SLAs to incidents, changes, problems, availability and continuity.
The most common question in IT service management: is ISO 20000 the same as ITIL? Short answer, no — one is a certifiable standard, the other is a body of best-practice guidance. Here's how they fit together, and why most organisations use both.
ISO/IEC 20000-1 names the documents your Service Management System must hold, and implies a set of registers an auditor will expect to see. Here's the complete checklist — the documented information from Clause 7.5.4, plus the service management registers the operational clauses require.
The UAE does not have one data-protection law, it has three, and which one applies to you depends on where your entity sits. Here is the plain-English map of the federal PDPL, the DIFC law and the ADGM regulations, how they differ, and how to run all three without three separate programmes.
If you treat the UAE's federal PDPL as GDPR with an Arabic accent, you will build it wrong. The biggest difference is that it is consent-first with no legitimate-interests basis, and several of its firm numbers are still pending. Here is what actually changes.
The Dubai International Financial Centre runs a GDPR-grade data-protection law of its own, with a few duties GDPR never had: mandatory registration, an annual DPO assessment filed to the regulator, and a dedicated regime for AI systems. Here is what the DIFC law actually requires.
Abu Dhabi Global Market runs a GDPR-aligned regime with its own twists: a two-month rights clock, a seventy-two-hour breach window, mandatory registration, impact assessments you notify to the regulator, and a single fine cap of USD 28 million. Here is the plain-English version.
Both are GDPR-grade UAE financial free zones, so people assume they are interchangeable. They are not. The rights clock, the breach standard, the AI rules and the fine ceiling all differ. Here is the side-by-side that keeps groups out of trouble.
Unlike GDPR, both UAE financial free zones make you register with the regulator and pay an annual fee. Miss the renewal and the lapse itself is a contravention. Here is the practical checklist for the registration and notification duties in the DIFC and the ADGM.
While most data-protection laws still treat AI through general automated-decision clauses, the DIFC wrote dedicated rules. Regulation 10 defines roles for autonomous systems, demands transparency and oversight, and points toward certification. Here is what it asks of you.
Saudi Arabia's Personal Data Protection Law has been fully enforceable since September 2024. Here is what it covers, who it reaches, the rights and duties it creates, and what SDAIA now expects you to have in place.
Saudi Arabia has not published an adequacy list, so transfers out of the Kingdom rely on standard contractual clauses, binding common rules or certification, each with a transfer risk assessment. Here is how to build a defensible position.
Saudi Arabia's NDMO Standards are the national data-governance rulebook for government and its vendors: 15 domains, 191 scored specifications, and a national index that grades you. Here is how they work.
NDMO scores 191 specifications pass or fail, and the priorities set a three-year plan. Here is how to sequence year one so the National Data Index grades you well from the start.
Saudi Arabia governs AI through SDAIA's AI Ethics Principles: seven principles, four risk tiers and a lifecycle. Here is what they require, what is binding, and how they line up with ISO 42001 and the EU AI Act.
SDAIA's Generative AI Guidelines for Government are mandatory for government data. Here are the hard rules, public data only, human review, no critical decisions, and how to put guardrails around them.
IT General Controls are the backbone every audit leans on: the access, change, operations and development controls that make your systems' automated controls and reports trustworthy. Here is what they are, and why they turn up in every framework.
Running SOX, SOC 2 and ISO 27001 means testing the same IT controls three times, unless you treat ITGC as a shared hub. Here is how to collect the evidence once and have it count everywhere.
Most IT general control findings cluster in a handful of places: access reviews that are rubber-stamped, reports that were never validated, and segregation-of-duties conflicts no one monitors. Here is how to get them right.
Sarbanes-Oxley makes US public-company executives personally certify that their financial reporting controls work. Here is what ICFR is, how COSO 2013 and PCAOB AS 2201 fit, and what Section 404 actually requires.
Not every control failure is a material weakness. SOX grades gaps by likelihood and magnitude, and the classification drives whether you disclose publicly. Here is the model auditors actually use.
SOX, SOC 2 and ISO 27001 test a lot of the same ground. The COSO principles map one-to-one to SOC 2, and IT general controls recur in all three. Here is how to collect once and satisfy each, without over-claiming.