Tag: compliance
All the articles with the tag "compliance".
DORA, and the supplier your regulator now supervises
The EU's operational resilience regulation for financial services does something new. It reaches past the regulated firm and supervises its cloud providers directly, nineteen of them, including all three hyperscalers. What that changes, and what it does not.
Mapping cloud certifications to your own controls
AWS, Azure and Google Cloud hold near identical certificate lists and materially different scopes. A side by side comparison, a control by control mapping of what you still owe, and the three places the mapping usually goes wrong.
Security Critical Functions, and the things that control them
UK telecoms security regulation defines two categories of system, one nested inside the other. The distinction is better thinking than most security frameworks manage, and it applies well outside telecoms.
Measuring a control you cannot see failing
Most detection tools report what they found and say nothing about what they missed. Planting known records is how you get the number nobody will give you.
Macie and the hard problem of finding PII
Macie cannot reliably tell a payment card number from one of your own reference numbers. The privacy argument explains why that is hard to fix with your data, and not why it remains unfixed.
ISO 42001, ISO 27001 and the AI rulebook
What ISO 42001 actually is, how AI stresses an existing ISO 27001 management system, and where the rules stand across the EU, US, UK, Asia and the Gulf as of late 2026.