GRC: articles and guides.
Every CloudSoul article on GRC, newest first.
How to answer a customer security questionnaire: CAIQ, SIG, VSA and the three questions behind them
Answer the three questions behind every row once, from a library keyed to your controls. A CAIQ of around 260 questions then takes 2 to 4 days, not 2 to 3 weeks. The formats, why inconsistent answers lose deals, what ISO 27001 pre-answers and what to ask back.
ISO 27001 vs NIS2: how the two map, and how to do both once
An ISO 27001 ISMS covers roughly 70 to 80 per cent of NIS2 Article 21: five of the ten measures fully, five partly. The mapping table, where partial bites, the five NIS2 obligations no ISMS contains, and how to run both as one programme.
ISO 27001 internal audit and management review: what clauses 9.2 and 9.3 require, how often, and what auditors check
ISO 27001 requires internal audits (9.2) and management reviews (9.3) at planned intervals. No frequency is set, but every certification visit checks both, so in practice they run at least yearly. What each clause requires, the seven review inputs and what auditors raise.
ISO 27001 Annex A controls: the 93 controls in 4 themes, grouped the way you will actually implement them
ISO 27001:2022 Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34), 11 of them new. The full list, what changed from 2013, and a grouping by the kind of work each control needs.
ISO 27001 scope and Statement of Applicability: how to write them
The ISO 27001 scope is the boundary of your management system and appears on the certificate. The Statement of Applicability lists all 93 Annex A controls and is what you are audited against. How to draw the scope, justify exclusions and keep both current.
NIS2 Article 28: domain registration data (WHOIS) obligations for registries and registrars
NIS2 Article 28 requires TLD registries, registrars and resellers to keep accurate and complete domain registration data, verify it, publish non-personal data and answer access requests within 72 hours. Scope, data fields, GDPR and a verification checklist.
NIS2 in Germany: what the NIS2UmsuCG and the new BSIG require, who is in scope and the BSI deadlines
NIS2 has applied in Germany since 6 December 2025 through the NIS2UmsuCG and a new BSIG. Who is in scope under § 28, the § 33 registration deadline that has passed, § 32 reporting, § 30 measures, § 38 management duties and § 65 fines, mapped to NIS2.
NIS2 training requirements: who must be trained, on what, and how often
NIS2 requires members of the management body to follow cybersecurity training and makes staff training a minimum risk-management measure. It sets no hours, certificate or approved provider. What the law says, what the implementing rules add, a training plan and a record template.
NIS2 in Belgium: what the law of 26 April 2024 requires, who is in scope and the CCB deadlines
Belgium's NIS2 law, the Law of 26 April 2024, has applied since 18 October 2024, with the CCB as national authority. Scope, Safeonweb@work registration, incident reporting, the CyberFundamentals and ISO 27001 routes, the 2026 and 2027 deadlines, and fines.
NIS2 jurisdiction: which Member State supervises you, and how the main establishment rule works
Under NIS2 you are supervised by the Member State where you are established. Telecoms answer to each country they serve; cloud, MSP and other digital providers to their main establishment. The rules, the main establishment test, non-EU providers, mutual assistance and groups.
NIS2 for financial services: when DORA applies instead, and where CER fits
NIS2 lists only banks, trading venue operators and CCPs, and even for them DORA replaces the NIS2 risk and reporting rules. Insurers, investment firms, payment institutions and fund managers follow DORA alone. Who follows what, DORA's deadlines, and where CER fits.
NIS2 vs GDPR: the differences, where they overlap, and how to handle one incident under both
GDPR protects personal data; NIS2 protects the systems behind essential and important services. One incident can trigger both: a NIS2 early warning within 24 hours and a GDPR notification within 72. Side-by-side table, fines, a worked example and a joint playbook.
Who enforces NIS2? Competent authorities, CSIRTs and the EU bodies behind them
NIS2 is enforced by national competent authorities; incident reports go to a national CSIRT or the authority. What each national and EU body does, which ones a company deals with, how to find yours, and what the 2026 proposal would change for ENISA.
NIS2 fines and penalties: how much, for what, and what else regulators can do
For breaches of Article 21 or 23, national law must set NIS2 fines with a maximum of at least €10M or 2% of worldwide turnover for essential entities and €7M or 1.4% for important ones. What triggers them, group turnover, GDPR, other powers and personal liability.
NIS2 essential vs important entities: how you are classified and what changes for you
Large Annex I entities and a few named categories are essential; other in-scope Annex I and II entities are important. Both follow the same Articles 20, 21 and 23. Supervision, enforcement and fines differ. How classification works, and what changes for you.
NIS2 board duties: what Article 20 requires from management, and when directors can be held liable
Under NIS2 Article 20 the management body approves the Article 21 measures, oversees their implementation and can be held liable; its members must follow training. What each duty means, whether approval can be delegated, who is liable, and a board-pack template.
NIS2 Article 21: the 10 cybersecurity risk-management measures, explained
Article 21 of NIS2 requires appropriate and proportionate measures to manage cybersecurity risk, based on an all-hazards approach, and lists ten minimum measures. What each one means in practice, what proportionate means, and what evidence an authority will ask for.
NIS2 scope: does NIS2 apply to your company? A four-step check
NIS2 applies to entities of a type listed in Annex I or II that are at least medium-sized and active in the EU, plus a short list covered regardless of size. The four-step check, a decision table, the size rules, exclusions and registration.
NIS2 compliance: what the directive requires, who is in scope, and where to start
NIS2 applies to medium-sized and larger entities in 18 sectors. Compliance means registering, board approval and training, ten minimum security measures and incident reporting within 24 hours. Who is in scope, each duty, fines, national laws and a 90-day plan.