CyphrQChinese AI Data Security: What the Laws and Privacy Policies Say
China's AI rules, PIPL and Data Security Law, what DeepSeek, Kimi and Alibaba Cloud say about data location, and the questions to ask first.
Audit
Governance, compliance and the evidence that proves controls work.
EU AI Act Timeline: What Applies When and What to Do Now
The EU AI Act timeline from 2025 to 2028, including the 2026 AI Omnibus changes, and the practical steps an organisation should have in place today.
ISO/IEC 42001 Explained: Who Needs It and How Certification Works
ISO/IEC 42001 is the AI management system standard. What it covers, who should consider it, how audit and certification work, and how it differs from NIST.
NIS2 Requirements: Who Is in Scope and the 24-Hour Reporting Clock
Who NIS2 covers, the ten Article 21 security measures, the 24-hour, 72-hour and one-month incident reporting clock, fines, and a readiness checklist.
SOC 2 vs ISO 27001: What Each Is and How to Choose
SOC 2 is an auditor's report on controls; ISO/IEC 27001 is a certified management system. How audits and proof differ, and how to pick the right one.
SOC Regulatory Requirements: What NYDFS, SEC, PCI and HIPAA Demand
What NYDFS, the SEC, PCI DSS, HIPAA and CIRCIA require for monitoring, logging and incident response, and when that means a SOC or MDR.
Third-Party Risk Management: Tiering, Contracts, Monitoring and Exit
Third-party risk management in practice: tier vendors, run due diligence, write audit, breach-notice and exit clauses, monitor, and offboard cleanly.
IT General Controls Explained: Four Areas Auditors Test
What IT general controls (ITGCs) are, the four areas auditors test, and the evidence they ask for, with a real audit finding and a prep checklist.
Auditing User Access Reviews: How to Test Recertification Works
A user access review audit tests more than a signed spreadsheet. How to check the user list, spot rubber-stamping and test leavers.
SOC Requirements in the GCC and India: Logs, Monitoring, Retention
What Saudi NCA controls, the UAE IA Regulation and RBI's bank framework require for monitoring, log retention and incident reporting, compared.
SOC 1 vs SOC 2 vs SOC 3: Which Report You Need and What to Check
SOC 1 covers financial reporting controls, SOC 2 security and trust criteria, SOC 3 is the public summary. Plus Type 1 vs 2 and what to check.