Compliance

What ISO/IEC 27001:2022, SOC 2 and PCI DSS v4.0.1 actually require about training, what auditors ask to see, and how to replace slide decks with short, scenario-based training people remember. With a comparison table and a checklist.

How to train staff, incident responders, the DPO and executives for GDPR breach response: what Articles 33, 34 and 39 require, a role-by-role training table, a GDPR staff training checklist, a 60-minute breach tabletop and free scenario labs.

The ISA/IEC 62443 Cybersecurity Certificate Program explained: the four certificates (IC32, IC33, IC34, IC37), the Expert designation, the IC48 fast track, which parts of the standard matter for asset owners, integrators and product suppliers, and how to practise zones, conduits and security levels free.

A plain-English explainer on HIPAA compliance: the Privacy, Security and Breach Notification Rules, who must comply (covered entities and business associates), what counts as a violation, the four penalty tiers, and why there is no official "HIPAA certification." General information, not legal advice.

A plain-English explainer on HIPAA release and authorization forms: what they are, the required elements of a valid HIPAA authorization, the difference between consent and authorization, when each is needed, and where to find official sources. We explain rather than provide a fillable legal form. General information, not legal advice.

A plain-English explainer on the HITECH Act: how it promoted electronic health records, created the Breach Notification Rule, increased HIPAA enforcement and penalties, and — through the HIPAA Omnibus Rule — made business associates directly liable. General information, not legal advice.

A plain-English explainer on the Gramm-Leach-Bliley Act: the Financial Privacy Rule, the Safeguards Rule, the Pretexting provisions, who counts as a financial institution, and what the updated Safeguards Rule now requires. General information, not legal advice.

A plain-English explainer on SOC 1 vs SOC 2: what each report covers (financial-reporting controls versus the Trust Services Criteria), Type I vs Type II, who needs which, and how SOC 3 fits in. General information, not legal advice.

A plain-English explainer on subprocessors: the GDPR controller-processor-subprocessor chain, fourth-party risk, subprocessor lists, flow-down obligations, and how third-party risk management programs handle the vendors behind your vendors. General information, not legal advice.

A practical explainer on the NIST Secure Software Development Framework (SSDF, SP 800-218): its four practice groups (PO, PS, PW, RV), why it exists after Executive Order 14028 and the software supply-chain crisis, how it maps onto any SDLC, and how it connects to federal secure-development attestation.

A clear explainer of an ISMS: what an Information Security Management System is, how ISO/IEC 27001 defines it, the Plan-Do-Check-Act cycle that keeps it running, the core artefacts (scope, risk assessment, risk treatment and the Statement of Applicability), and the benefits of managing security as a system rather than a pile of controls.

A plain-English explainer on Australia's Security of Critical Infrastructure (SOCI) Act: the sectors it covers, the positive security obligations, mandatory cyber incident reporting, the risk-management program requirement, and the enhanced obligations for systems of national significance. General information, not legal advice.

A plain-English explainer on ACAS, the US Department of Defense's mandated vulnerability-scanning solution: what it is, the components it is built on, who must use it, and how it fits into DoD compliance alongside STIGs and the Risk Management Framework (RMF). Factual, defensive and without fabricated specifics.

Exactly what to capture in an AI Bill of Materials (AIBOM) — models, datasets, AI/ML dependencies, configuration, and risk metadata — mapped to CycloneDX ML-BOM and SPDX 3.0 AI Profile, with a copy-paste checklist and the free tools to generate and validate one.

Preparing for the PCI DSS v4 Qualified Security Assessor qualification. What the QSA role requires, how to study the standard, and practice-question strategy.

A practical vendor security assessment checklist: the areas to review before onboarding a third party, the evidence to ask for, and how to rank vendors by risk instead of treating them all the same.

A PCI DSS gap analysis compares your current controls against the standard's requirements before a formal assessment. How to scope it, run it, and turn the findings into a remediation plan.

NIST CSF 2.0 defines four maturity tiers — Partial, Risk-Informed, Repeatable, Adaptive. What each tier means and how to run a maturity assessment.

NIS2 doesn't name FIDO2, but Article 21 requires MFA where appropriate, and FIDO2 passkeys and security keys meet its phishing-resistant end. Rollout order.

DORA does not mandate FIDO2, but requires strong authentication and robust IAM. FIDO2 hardware keys support that for privileged access to financial systems.

NIST CSF 2.0 isn't a controls list: it has 6 Functions, 22 Categories and 106 Subcategories (outcomes) that map to SP 800-53 and CIS Controls. The breakdown.

A practical walkthrough of a NIST Cybersecurity Framework 2.0 assessment: the six functions including the new Govern, implementation tiers, profiles, and how to run the assessment end to end.

AIBOM: a machine-readable inventory of every model, dataset and dependency in an AI system, what it must include and how to generate yours free.