NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
Cybersecurity requirements for space suppliers: NIS2, the proposed EU Space Act, ESA and prime contractors
Most space suppliers get cybersecurity requirements through customers, not regulators. What NIS2 covers in the space sector, what the proposed EU Space Act would add, what ESA, EU programme and prime contracts ask, which comes first, and what to build once.
Who is responsible for cybersecurity in an SME? (and when a vCISO makes sense)
Management is accountable, and one named person has to own the decisions. NIS2 puts approval and oversight on the management body, ISO 27001 requires the roles to be assigned, and neither requires a CISO. Where the job lands by default, what it involves, and when a vCISO fits.
How to answer a customer security questionnaire: CAIQ, SIG, VSA and the three questions behind them
Answer the three questions behind every row once, from a library keyed to your controls. A CAIQ of around 260 questions then takes 2 to 4 days, not 2 to 3 weeks. The formats, why inconsistent answers lose deals, what ISO 27001 pre-answers and what to ask back.
NIS2 for telecom suppliers: the two ways the obligations reach you, and what operators will ask for
NIS2 reaches telecom suppliers in two ways: through the operator's contracts, because operators must manage direct supplier risk, and directly if you are a medium-sized or larger MSP, cloud or data centre provider. Both routes, what operators ask for, what to build.
CRA reporting obligations: what manufacturers must report since 11 September 2026, to whom and how fast
Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe incidents in their products: early warning in 24 hours, notification in 72 hours, then a final report. What counts, who receives it, and how NIS2 fits.
EASA Part-IS explained: who it applies to, the deadlines, and what it means for aviation suppliers
EASA Part-IS requires aviation organisations to run an ISMS for information security risks to aviation safety. It has applied since 16 October 2025 or 22 February 2026, depending on the organisation. Who is in scope, what it requires, the NIS2 overlap and what suppliers must do.
Does ISO 27001 make you secure? What a certificate proves, what it leaves open, and how to check one is real
Not on its own. An ISO 27001 certificate proves a certification body audited your management system for a stated scope. It does not prove the controls work well. What it proves, where it stops, and how to check a certificate is genuine.
ISO 27001 vs NIS2: how the two map, and how to do both once
An ISO 27001 ISMS covers roughly 70 to 80 per cent of NIS2 Article 21: five of the ten measures fully, five partly. The mapping table, where partial bites, the five NIS2 obligations no ISMS contains, and how to run both as one programme.
ISO 27001 audit evidence: what auditors ask for, and how to collect it without the pre-audit scramble
ISO 27001 auditors sample dated records from across the audited period, not a snapshot taken the month before. What the standard requires as documented information, typical evidence per control area, how fast it goes stale, and how to collect it as the work happens.