Compliance Strategy
The internal audit that never finds anything
ISO 19011 changed edition in May 2026. The failure mode it exists to prevent did not: the internal audit that has, by drift, stopped disagreeing with management.
·10 min read
Blog
Insights on ISO 27001, compliance automation, and information security.
Compliance Strategy
Under NIS2, "important" is not a lighter security tier
Teams read the important label as NIS2-lite and scope their controls down. The security measures in Article 21 are the same either way; the tier changes supervision, some enforcement tools, and the floor on the national fine maximum.
·10 min read
Compliance Strategy
Your ISO 27001 certificate does not start DORA's clocks
Financial entities keep mapping ISO 27001 controls onto DORA articles and calling the residue paperwork. DORA's real additions are duties that must be performed, to a specification and on a clock, that a certificate was never designed to test.
·9 min read
Compliance Strategy
The scope statement is the certificate
"ISO 27001 certified" is not a yes-or-no fact about a company. The real claim is the scope statement on the certificate, and it is checkable.
·9 min read
Compliance Strategy
The CRA is a 2026 problem, not a 2027 one
The Cyber Resilience Act's reporting duty applies from 11 September 2026, more than a year before its essential requirements. Teams planning backwards from the 2027 CE mark are sequencing the work in the wrong order.
·8 min read
Compliance Strategy
The 5x5 risk matrix survives audits, not scrutiny
ISO 27001 never asks for a heat map. What it does ask for (consistent, valid and comparable results) is the test most risk matrices fail.
·8 min read
Compliance Strategy
The AI Act high-risk delay is not a reprieve
The EU agreed to push the high-risk deadlines to December 2027 and August 2028. The reason it moved should change how you read it: this is a warning about your scope, not breathing room for your roadmap.
·6 min read
Compliance Strategy
AI for GDPR: Automating Cross-Border Data Transfers
Automate mapping, monitoring, and documentation of EU cross-border data transfers with AI—legal teams retain final decisions.
·13 min read
Compliance Strategy
Best Practices for Cross-Framework Audit Prep
Centralize controls, map overlapping requirements, and automate evidence to reduce audit time and costs across multiple compliance frameworks.
·16 min read
Compliance Strategy
Top 10 GRC Platforms with AI Reporting Features
AI-powered GRC platforms cut manual compliance work with automated evidence, cross-framework mapping, and faster audit reporting.
·25 min read
Compliance Strategy
Unified Control Mapping Across Frameworks: Best Practices
Consolidate overlapping framework requirements into a single control library to cut audit time and centralize evidence.
·15 min read
Why we pay consultants 30% recurring when the rest of the market doesn't
A founder note on alignment, distribution, and how the compliance-AI market pays the people doing the recommending
·5 min read