Knowledge Center

    Practical guidance from the people who do the work

    Plain-English explainers on the frameworks and questions we get asked most — written by the people who do the work. More guides are on the way.

    Compliance

    ISO 27001 basics: what it is and how certification works

    The international standard for an information security management system — what it covers, the Annex A controls, and how certification actually works.

    Read guide →
    Compliance

    CMMC 2.0 Level 2: a plain-English overview

    What the US Department of Defense's Cybersecurity Maturity Model Certification Level 2 requires, who needs it, and how to prepare.

    Read guide →
    Privacy

    GDPR vs CCPA/CPRA: the practical differences

    Two of the most important privacy laws — how their scope, consent models, rights, and penalties differ, and what you need to comply with both.

    Read guide →
    Compliance

    What a readiness assessment involves

    Before a formal audit, a readiness (gap) assessment shows exactly where you stand — and what it takes to get audit-ready.

    Read guide →
    Compliance

    SOC 2 basics: Type I vs Type II and what's in scope

    What a SOC 2 report is, the Trust Services Criteria, the difference between Type I and Type II, and who needs one.

    Read guide →
    Compliance

    NCA ECC compliance checklist for Saudi organisations

    A practical walk-through of the National Cybersecurity Authority's Essential Cybersecurity Controls — the domains, who must comply, and how to prepare evidence.

    Read guide →
    Privacy

    India's DPDP Act: a compliance guide for businesses

    What the Digital Personal Data Protection Act, 2023 and the DPDP Rules require, who they apply to, and the steps to get ready.

    Read guide →
    Microsoft Security

    Entra ID audit evidence for ISO 27001 and SOC 2

    Which Microsoft Entra ID settings and reports auditors ask for, and how to collect them so access-control evidence is ready before the audit.

    Read guide →
    AI Governance

    ISO 42001 explained: the AI management system standard

    What ISO/IEC 42001 covers, how it relates to ISO 27001, and what organisations building or using AI need to put in place.

    Read guide →
    Compliance

    SAMA Cyber Security Framework: an overview

    What the Saudi Central Bank's cybersecurity framework requires of financial institutions, how maturity is assessed, and how to prepare.

    Read guide →

    Looking for a specific topic?

    Tell us which framework or question you're working on and we'll point you in the right direction.

    Get in touch