Guides
Governance, risk and compliance guides
Complete reading paths through the encyclopedia, and practical guides on what the standards and regulations ask for.
- ISO 27001 Complete GuideRead these in order and you will follow the sequence a real certification project takes, from understanding the standard to checking your own system.
- NIS2 Complete GuideThis path starts with the question most companies ask first, does NIS2 apply to them, and then goes through its duties in the order you would tackle them.
- Risk Management Complete GuideThese articles build on one another. By the end you will be able to set up a risk process that a small team can really keep running.
- Business Continuity Complete GuideContinuity planning goes wrong when it starts with the plan. This path starts with what the business actually needs, and ends with the means of recovering it.
- What is GRC? Governance, risk and compliance explainedGRC stands for governance, risk and compliance: how a company sets its rules, manages what could go wrong and proves it meets its obligations.
- How to define the scope of an ISMSThe scope states which part of the company the ISMS covers. Clause 4.3 of ISO/IEC 27001 asks you to determine its boundaries and applicability, and to keep it as documented information.
- How to run a compliance gap assessmentA gap assessment compares your current practice with a framework's requirements, to show what is missing and what to do first. It is often the first step of a compliance project.
- DORA requirements: the five pillars explainedThe Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies since 17 January 2025 to EU financial entities and sets one set of rules on ICT resilience.
- HIPAA Security Rule: safeguards and what to documentThe HIPAA Security Rule (45 CFR Part 164, Subpart C) sets US standards to protect electronic protected health information held by covered entities and their business associates.
- The 12 PCI DSS requirements explainedPCI DSS is the card industry's security standard for any company that stores, processes or transmits cardholder data. This guide follows version 4.0.1, published in June 2024: check the PCI SSC document library for the latest version.
- GDPR data breach: what to do within 72 hoursUnder Article 33 of the GDPR, a personal data breach must be notified to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people.
- SOC 2 vs ISO 27001: differences and which to chooseISO/IEC 27001 certifies a management system; a SOC 2 report gives an auditor's opinion on your controls. They overlap a great deal, and the right one depends mostly on what your customers ask for.
- Policy, procedure, standard, guideline: what is the difference?These four kinds of document answer different questions. Keeping them apart makes each one shorter, easier to approve, and easier to keep current.
- User access reviews: how to run themAn access review checks that people still need the access they hold. It is one of the most frequently tested controls, and failures here often appear in audit findings.
- How to write an incident response planAn incident response plan says who does what when something goes wrong. Written in advance, it saves the hours when decisions matter most.