Law 25 one year on: the five gaps Quebec organizations are still missing
Full enforcement has been in effect for over a year. The CAI has issued its first enforcement actions. Here are the five most common Law 25 gaps we find in new customer assessments—and how to close them.
CPCSC explained: what Canadian defence suppliers need to know before 2027
CPCSC Level 1 became available April 1, 2026, and select defence contracts start requiring it this summer. Here is what Levels 1, 2, and 3 require, who is in scope, and how to start building toward certification now.
ISO 27001:2022 clauses explained: the requirements that actually get you certified
Clauses 4 through 10 are the certifiable requirements of ISO/IEC 27001:2022 — the ISMS itself. What each clause asks for, in plain language, and what the auditor actually checks — plus how it differs from the Annex A control catalogue.
DORA is live. Is your ICT third-party register audit-ready?
DORA enforcement started January 2025. Here is what financial entities most commonly get wrong in their first ICT third-party oversight documentation, and how to fix it before your regulator asks.
The true cost of your GRC tool stack (it is probably $640K)
Most mid-market security teams cannot tell you what they actually spend on GRC tooling across all contracts. We analyzed 200 customers’ stacks and found the same pattern everywhere: five tools, 40% feature overlap, and invoices nobody challenges.
ISO 27001:2022 vs SOC 2—which should you get first?
If your customers are asking for both, here is a decision framework for which certification to pursue first, how to structure your evidence program to satisfy both, and what the audit timelines really look like in practice.
Why your annual vendor questionnaire is security theatre
A SOC 2 report from 14 months ago tells you nothing about a vendor’s current posture. Here is why point-in-time vendor reviews fail and what continuous monitoring looks like in practice.
The evidence sprint is over. Here is what continuous compliance actually means.
Most GRC teams still run “evidence sprints” 4–6 weeks before an audit. This is a symptom of tooling that was not designed for continuous evidence collection. Here is the architecture that eliminates the sprint permanently.
How to make the ROI case for GRC automation to your CFO
The business case for GRC investment is not just about risk reduction—it is about cost elimination. Here is the framework we use to model recoverable GRC spend for every new customer, with a template you can take to your CFO today.
Stay ahead of the frameworks your auditors care about.
Practical GRC content delivered to your inbox. No marketing. Unsubscribe any time.