Posts on regulatory compliance

The cyber red flags that matter in due diligence change the price or stop the deal: hidden breaches, contested IP, regulatory exposure and deep security gaps.

Third-party cyber risk is the chance a supplier causes you a security incident. Manage it by tiering suppliers, setting requirements, contracting and checking.

DORA reaches UK tech suppliers through EU bank contracts: mandatory clauses, register data, an LEI, subcontracting controls and, for a few, direct EU oversight.

ISO 27001 is worth it when customers or tenders need it, or you need a structured way to run security. If nobody is asking yet, start with Cyber Essentials.

No UK law requires SOC 2. You need it when US customers write it into contracts. Here is what SOC 2 involves, Type 1 vs Type 2, and when ISO 27001 will do.

Most UK firms start with Cyber Essentials, add ISO 27001 when customers ask for a certified security system, and need SOC 2 only for US buyers.

Product security (ProdSec) protects a product across its whole lifecycle, design, build, supply chain and support. A practical UK guide.

NIS2, DORA, NIST CSF 2.0 and CIS Controls v8.1 are often treated as rivals. In practice they answer different questions. A mapping guide for UK financial services firms.