Insights
DORA, NIS2, NIST CSF 2.0, SOC 2, CMMC and GDPR: who they apply to, what they require, and how they relate to ISO management systems.
SaaS is a recognised cloud service model - Recital 33 says so outright. But whether your specific product meets the operative Article 6(30) test is genuinely unsettled, and national regulators openly disagree on identical facts. Here is how to reason about it.
5 Nov 2026 · 6 min read
Until October 2025, ISO 27701 was an extension - you needed ISO 27001 to use it. The 2025 edition was redrafted as a stand-alone management system standard. Most advice has not caught up.
14 Oct 2026 · 6 min read
ISO 27001 covers a lot for CySEC-regulated FX brokers, but DORA adds four obligations it does not. Here is what carries over and what does not.
11 Oct 2026 · 6 min read
DORA has applied across EU financial entities since January 2025. Here is where its ICT risk and incident requirements map onto ISO 27001, and where genuine gaps remain.
19 Jul 2026 · 6 min read
Applicability first: DORA, NIS2, NIST CSF 2.0, SOC 2 or CMMC, read against your sector and jurisdiction.