All posts
EU NIS2, DORA, ISO 27001, Korea's ISMS-P, Japan's APPI, Singapore's CII. The names of the documents they ask for are all different, but the underlying substance overlaps. We've laid out in a table what each regulation requires and which of those slots a risk assessment report fills.
"Your data never crosses a border" is not a story about patriotism. It is a question of whose storage the assessment results sit in and who holds the key. We unpack BYOK and adequacy decisions through the analogy of a bank safe deposit box.
It's easy to assume that inspecting something means installing something. Agentless goes the other way. Instead of searching the house, it reads the blueprint. Here's how much you can learn from a single read-only permission.
The ER doesn't call people in the order they arrived. It calls them in order of danger. When your vulnerability list runs thousands of lines long, that sorting is what EPSS does. Part 3 of the RMF·NIS2 series.
A health checkup report doesn't say 'you're healthy' — it lists numbers and grades. Risk assessment works the same way. Here's how NIST SP 800-30 and ISO 27005 turn risk into numbers. Part 2 of the RMF·NIS2 series.
Like the hygiene grade posted on a restaurant door, the EU judges security by paperwork, not by what you say. What NIS2 is, and why the word 'evidence' comes up at the contract table. Part 1 of the RMF·NIS2 series.
