NIS2, ISO 27001 and vCISO guides.
Practical guides to NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
ISO 27001 Stage 1 vs Stage 2 audit: what the auditor checks and what they accept
Stage 1 reads your ISMS documents to check the system is designed. Stage 2 tests whether it actually ran, after around three months of operation. What the auditor checks at each stage, what they accept, and what a major or minor nonconformity costs you.
ISO 27001 certification cost for SMEs (2026): audit fees, consultants and the costs nobody quotes
For a company of 26 to 125 people, ISO 27001 costs roughly €50,000 to €150,000 in year one, all in. The certification audit is the smallest line. Every cost, the three-year view, and where the money is wasted.
ISO 27001 internal audit and management review: what clauses 9.2 and 9.3 require, how often, and what auditors check
ISO 27001 requires internal audits (9.2) and management reviews (9.3) at planned intervals. No frequency is set, but every certification visit checks both, so in practice they run at least yearly. What each clause requires, the seven review inputs and what auditors raise.
ISO 27001 Annex A controls: the 93 controls in 4 themes, grouped the way you will actually implement them
ISO 27001:2022 Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34), 11 of them new. The full list, what changed from 2013, and a grouping by the kind of work each control needs.
How long does ISO 27001 certification take? The timeline by phase, and what slows it down
Plan for nine to twelve months if you are starting from scratch. Where every month of an ISO 27001 project goes, the three-month evidence period that cannot be compressed, why Stage 2 audits get moved, and what genuinely shortens it.
ISO 27001 scope and Statement of Applicability: how to write them
The ISO 27001 scope is the boundary of your management system and appears on the certificate. The Statement of Applicability lists all 93 Annex A controls and is what you are audited against. How to draw the scope, justify exclusions and keep both current.
ISO 27001 without a security team: what a small company has to decide, build and run
A small company with no security team can pass ISO 27001, because it certifies a management system, not a security score. Who does what, the decisions only you can make, the documents and 93 controls, a nine-to-twelve-month timeline, and what the certificate leaves open.
NIS2 and ransomware: what you must report, whether you can pay, and what Article 21 expects
Ransomware that can severely disrupt your services is a significant NIS2 incident: early warning within 24 hours, notification within 72. NIS2 does not ban paying. Reporting, payment, the COM(2026) 13 proposal, Article 21, GDPR and a first-24-hours checklist.
NIS2 supply chain security: how to assess supplier risk under Article 21
NIS2 makes supply chain security one of the ten minimum measures. You must assess each direct supplier's vulnerabilities, product quality and security practices, and take EU coordinated assessments into account. The steps, the contract clauses and what Article 22 adds.