GRC
NIS 2: who is in scope, essential vs important entities, and what management must do
Who NIS 2 applies to: Annex I and II sectors, the size-cap rule, essential versus important entities, the ten minimum measures, 24-hour incident reporting…
Blog Topic
GRC
Every Certifyi article on GRC, written by the people who run compliance programmes, newest first.
Showing 11 articles in GRC
Clear filters-
-
GRC
PCI DSS 4.0: what changed, the requirements that became mandatory in 2025, and how to prepare
PCI DSS 4.0 and 4.0.1 explained: the twelve requirements, the customized approach, targeted risk analysis, MFA for all CDE access, script management, and the…
-
GRC
Quantifying cyber risk: why Monte Carlo loss modelling beats heat maps in the boardroom
How to quantify cyber risk in currency: FAIR factors, Monte Carlo simulation, P50 and P90 loss exposure, why heat maps mislead boards, and how…
-
GRC
CMMC Level 2 requirements explained: the 110 practices, who needs a C3PAO, and the timeline
CMMC Level 2 in plain terms: the 110 NIST SP 800-171 practices, self-assessment versus C3PAO, SPRS scores, POA&M rules and the phased rollout from…
-
GRC
Evidence integrity: why hashed, versioned evidence changes what an audit can prove
What evidence integrity means, why auditors and regulators test it, how hashing and versioning work in a compliance record, and what to ask any…
-
GRC
DORA and NIS2 for SaaS vendors: what your EU customers will ask you for
DORA applies to EU financial entities and flows down to their ICT providers; NIS2 covers essential and important entities across the EU. What each…
-
GRC
What is GRC, and when does a startup actually need it?
GRC covers governance, risk and compliance as one discipline. Here is what it means practically and when it stops being premature.
-
GRC
How to write security policies people actually follow
Template policies pass a document check and fail in practice. Here is how to write a policy set that survives an audit and real…
-
GRC
How to prepare for an auditor evidence request
Fieldwork goes badly when evidence is assembled reactively. Here is how to prepare so the request list is routine.
-
GRC
Automated vs manual evidence collection: what auditors accept
Auditors accept both, but they are not equal in cost or reliability. Here is where each works and where manual evidence fails.
Have a question the guides do not answer?
Ask the person who would run your programme. Twenty minutes, no slides.