Compliance intelligence, not marketing fluff.
12 flagship executive guides, 12 regulation and framework hubs, 4 implementation checklists, and real regulatory deadlines — sourced to the regulation's own text, not summarized secondhand.
Featured research
Hand-picked by our editorial team.
Why Supply-Chain Attacks Keep Working: Lessons from SolarWinds and xz-utils
Two of the most consequential software supply-chain compromises on record share a root cause that most vendor-risk programs still don't test for.
NIS2 Transposition Status: Where EU Member States Actually Stand
The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.
Trending research
Ranked by reader activity across the platform.
NIS2 Transposition Status: Where EU Member States Actually Stand
Ransomware Groups Are Shifting to Data Extortion Without Encryption
PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory
DORA Is Now Applicable: What Actually Changed on January 17, 2025
Why Supply-Chain Attacks Keep Working: Lessons from SolarWinds and xz-utils
Compliance updates
All updates →
NIS2 Transposition Status: Where EU Member States Actually Stand
The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.
DORA Is Now Applicable: What Actually Changed on January 17, 2025
Unlike NIS2, DORA needed no national transposition — it became binding across the entire EU financial sector on a single day. Here's what that actually triggers.
PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory
The subset of PCI DSS v4.0 requirements that were 'best practice until' 31 March 2025 are now simply requirements. Expanded MFA is the one most organizations still have work on.
Executive briefs
Board- and leadership-level framing on a single regulation or risk, in five minutes or less.
What the Board Actually Needs to Know About NIS2
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.
DORA for Non-Financial-Services Executives: Why Your Vendors Might Already Be In Scope
You don't have to be a bank for DORA to matter to your business. If your customers are EU financial entities, their DORA obligations are quietly becoming your contract terms.
AI Governance Is Now a Board-Level Question — Here's the 10-Minute Version
Between the EU AI Act, ISO 42001, and enterprise-buyer security questionnaires that now include AI-specific sections, 'we don't have an AI governance program' is no longer a neutral answer.
Framework & regulation library
Everything on one regulation — overview, deadlines, white papers, guides, and glossary — in one place.
NIST Cybersecurity Framework 2.0
NIST's voluntary cybersecurity risk-management framework, updated in February 2024 to add a sixth function — Govern — and to explicitly serve organizations of every size and sector, not just critical infrastructure.
CMMC 2.0
The Cybersecurity Maturity Model Certification — the US Department of Defense's framework for verifying that contractors handling Controlled Unclassified Information (CUI) actually meet NIST SP 800-171 security requirements, not just attest to them on paper.
HIPAA Security Rule
The Health Insurance Portability and Accountability Act's Security Rule sets administrative, physical, and technical safeguards for electronic protected health information (ePHI), enforced by HHS's Office for Civil Rights.
PCI DSS v4.0
The Payment Card Industry Data Security Standard — a global contractual requirement (not a law) for any organization that stores, processes, or transmits cardholder data. Version 4.0 fully retired v3.2.1 and brought its own newly-mandatory requirements into force through 2024-2025.
StateRAMP
The state-government analog to FedRAMP — a standardized cloud security verification program so US state and local governments can reuse a single security assessment instead of each running its own.
FedRAMP
The Federal Risk and Authorization Management Program — the standardized US government process for authorizing cloud services for federal agency use, built on NIST SP 800-53 controls at Low, Moderate, or High impact levels.
ISO/IEC 42001:2023
The first international management-system standard for AI — published December 2023. Structured like ISO 27001, but its Annex A controls address AI-specific risk: data quality, AI impact assessments, and transparency to affected parties.
ISO/IEC 27001:2022
The international standard for an Information Security Management System (ISMS). The 2022 revision restructured Annex A into 93 controls across 4 themes, down from 114 controls across 14 domains in the 2013 version.
SOC 2
An AICPA attestation — not a certification — in which an independent auditor reports on a service organization's controls against the Trust Services Criteria. The de facto vendor-security bar for B2B SaaS selling into the enterprise.
Digital Operational Resilience Act
Regulation (EU) 2022/2554 — applicable since 17 January 2025 — sets binding ICT risk-management, incident-reporting, resilience-testing, and third-party oversight rules for the entire EU financial sector.
NIS2 Directive
The EU's revised cybersecurity directive — Directive (EU) 2022/2555 — expands mandatory security and incident-reporting obligations to roughly 18 sectors, with real management-body liability and fines that scale with global turnover.
EU Cyber Resilience Act
The first EU law imposing mandatory cybersecurity requirements on hardware and software before it can be sold in the European market. Reporting obligations begin September 2026; full application December 2027.
Framework guides
Practitioner guides to individual frameworks and standards.
NIST CSF 2.0: What Actually Changed From Version 1.1
The first major revision since 2014 adds a sixth function — Govern — and explicitly extends the framework beyond critical infrastructure to organizations of any size or sector.
Mapping SOC 2 to ISO 27001: Where the Overlap Actually Is
Both frameworks assess similar underlying security practices, but their structures, audiences, and outputs are different enough that neither is a drop-in substitute for the other.
NIST AI RMF vs. ISO 42001: Two Different Tools for AI Governance
One is a voluntary US risk-management framework; the other is a certifiable international management-system standard. Most serious AI governance programs end up using both.
Industry research
Cross-industry patterns and trends, not tied to a single regulation.
Why Compliance and Security Teams Keep Reporting to Different Executives
The org-chart split between security (often reporting to the CTO/CIO) and compliance (often reporting to legal or the CFO) reflects a real historical divide that regulation is now quietly forcing organizations to bridge.
The Quiet Standardization Around 24-Hour Breach Notification
24 hours keeps showing up as the first-notice window across unrelated regulatory regimes. That's not coincidence — it's converging on what's actually operationally achievable.
AI Governance Roles Are Being Invented in Real Time — Here's What's Actually Emerging
Titles like 'Head of AI Governance' and 'AI Risk Officer' didn't exist five years ago. The role is still being defined, and it's landing in different places at different companies.
Interactive tools
All tools →
NIS2 Readiness Assessment
18 questions drawn directly from NIS2's own governance, risk-management, incident-reporting, and supply-chain requirements — with a domain-by-domain readiness score, not just one number.
EU CRA Readiness Assessment
18 questions drawn directly from the Cyber Resilience Act's own product-security lifecycle requirements — classification, secure-by-design, vulnerability handling, and reporting — with a domain-by-domain readiness score.
ISO 27001 Readiness Assessment
18 questions drawn directly from ISO/IEC 27001:2022's own management-system requirements and Annex A controls — with a domain-by-domain ISMS readiness score.
SOC 2 Readiness Assessment
18 questions drawn directly from the AICPA Trust Services Criteria's own Common Criteria — with a domain-by-domain readiness score for your SOC 2 attestation.
CMMC Level 2 Readiness Assessment
18 questions drawn directly from NIST SP 800-171's own control families and CMMC 2.0's program requirements — with a domain-by-domain readiness score. Not an official CMMC assessment and does not produce an SPRS score.
Compliance Penalty Exposure Calculator
Computes your maximum regulatory fine exposure directly from NIS2's and the EU CRA's own published fine structures — the higher of a fixed amount or a percentage of global annual turnover.
Compliance checklists
All →
Upcoming deadlines
Full calendar →
December 11, 2027