GRC: articles and guides

Ransomware readiness assessment tools compared by what they test: CISA RRA, KnowBe4 RanSim and PlayCISO. Facts read on their pages, 4 Nov 2026.

SOC 2 and ISO 27001 rarely buy a fixed discount. The levers that do move a cyber premium, the mistakes that raise it, and the evidence to bring.

Cyber risk management and GRC courses ranked for 2026: ISACA CRISC and CISM, ISC2 CGRC, ISO 27001 Lead Implementer and Lead Auditor, NIST CSF 2.0 courses and SANS LDR519, with prices as of October 2026, formats, drawbacks and where hands-on practice fits.

What ISO/IEC 27001:2022, SOC 2 and PCI DSS v4.0.1 actually require about training, what auditors ask to see, and how to replace slide decks with short, scenario-based training people remember. With a comparison table and a checklist.

A crosswalk from AIBOM, model card and dataset card fields to the EU AI Act, ISO/IEC 42001 Annex A and NIST AI RMF, plus what the AIBOM cannot prove.

Security questionnaires are the backbone of third-party risk management — when they are focused. What to include, how to avoid questionnaire fatigue, and how to turn answers into decisions.

A practical breakdown of the new Govern function in NIST CSF 2.0, its six categories, and how it reshapes the other five Functions.

NIST CSF 2.0 added Govern as a sixth Function in February 2024 — here's what it covers, why it wraps the other five, and how to operationalize it.

A concrete, no-fluff way for small businesses to adopt NIST CSF 2.0 — starting with the new Govern function and a right-sized subset of controls.

A CISO guide to the OWASP MCP Governance and Risk Project: the four gates (owner, logging, scope, review), Tier 0-4 tiers and the risk model.

Cyber readiness assessment tools compared for 2026: free self-assessments (CISA CSET, CISA Cyber Resilience Review, NIST CSF 2.0 resources, PlayCISO scorecards), open-source GRC (SimpleRisk, eramba) and commercial platforms (Vanta, Drata, Cyberbit, Immersive), with prices as of October 2026.