5 min read
Compliance as code: keeping ISO 27001 cheap after the certificate
Certification is a project with an end date. Maintaining it is not. The difference between a cheap certificate and an expensive one is whether the evidence collects itself.
Insights
Notes from the work
Written from engagements rather than from press releases. No vendor content, no predictions, and no article that ends by recommending a product.
5 min read
The AI Act for deployers: a 30-day plan
Most companies are deployers, not providers, and the obligations are far lighter than they fear. Here is the month of work that settles the question.
5 min read
DORA register of information: the 10 mistakes we see
The register is the first thing supervisors ask for and the easiest thing to get wrong. Ten failures we keep finding, and what each one costs to fix.
5 min read
NIS2 in 2026: what a 200-person company must have in place
Not the directive, the checklist. What an essential or important entity of around two hundred people is actually expected to hold, and the order we would build it in.
A question this raised?
If this describes a problem you are currently in, forty-five minutes on a call is usually faster than another article.