Knowledge Hub

Practical guides and insights on information security and compliance,
from active auditors.

NIS-2: how to tell in 20 minutes whether it applies to you

NIS-2 is a directive, so the rules a German company follows are in the BSIG. No one writes to tell you that you are covered. This guide runs the three-step test: sector, size, exceptions and names the two sector entries people misread most, and covers what registration, the ten measures and the 24/72 hour/one month reporting clock require if you are in.

Governance & ComplianceNIS-2

September 3, 2026Read more

ArticleGlobal

SOC 2 Type I or Type II: What Your First Enterprise Deal Actually Requires

A SOC 2 report is an accountant's opinion, not a certificate. This guide explains the difference between a Type I and a Type II, why the timing of each is what really decides your choice, how to scope the Trust Services Criteria to what you have actually promised, and how to pick a CPA firm your enterprise buyer will trust.

Governance & ComplianceSOC 2

August 19, 2026

ArticleGlobal

Incident Management: Building a Process You'll Actually Follow

Everyone agrees incident management matters, until an incident hits and the process gets forgotten. This guide covers how to build one you'll actually follow: what counts as an incident, how to prepare, classify, respond, meet reporting obligations, preserve evidence, and learn from it.

Information SecurityNIST SP 800-61+3

July 15, 2026

ArticleGlobal

ISO 27001 Clause 8: putting the plan into action

Clause 6 gives you the plan; Clause 8 is where you run it. This guide breaks ISMS operation into four workstreams (operational plan, risk treatment, corrective actions, and general tasks) and shows how to manage each so your ISMS actually runs and holds up at Stage 2.

Governance & ComplianceISO 27001

June 30, 2026

ArticleEU

ISO 27001 Clauses 6 & 8: planning and executing your risk management

Clause 6 defines how your organisation identifies, scores, and treats information security risk. Clause 8 is where you run it and keep the evidence.

Governance & ComplianceISO 27001

June 19, 2026

ArticleGlobal

ISO 27001 Clause 10.2: nonconformity and corrective action

If you're building or running an ISMS, problems will surface. Clause 10.2 is the clause that determines whether your organisation learns from it or repeats it.

Governance & ComplianceISO 27001

May 26, 2026

GuideGlobal

How to build an asset inventory that holds up under audit

Most organisations list their tools. Auditors want documented ownership, classification, and lifecycle management. This guide shows you the difference.

Governance & ComplianceISO 27001+3

May 20, 2026

ArticleGlobal

ISO 27001 Clause 4: how to perform a context analysis

A practical guide to ISO 27001 Clause 4: how to analyse your organisation's context, define your ISMS scope, identify interested parties, and produce the documentation that auditors expect.

Governance & ComplianceISO 27001

March 3, 2026

ArticleGlobal

ISO 27001 Chapters 4-10: the first steps in setting-up your ISMS

ISO 27001 clauses 4–10 set out the mandatory structure for building, operating, and certifying an ISMS. This explains what each clause requires you to document, evidence, and maintain.

Governance & ComplianceISO 27001

March 3, 2026