Blog

NZISM Explained: The New Zealand Information Security Manual for Cloud and SaaS Providers

Learn what the NZISM requires, how it works with the PSR, and how SaaS and cloud providers can prepare to sell to New Zealand government and health agencies.

Shopify PCI Compliance: What Merchants Still Own Under PCI DSS

Shopify PCI compliance explained: what Shopify covers, which SAQ your store likely needs, and a practical checklist to keep your own PCI DSS scope small.

SOCI Act CIRMP Guide: Obligations for Responsible Entities and Their Suppliers

Learn what the SOCI Act CIRMP requires, how its four hazard domains and cyber frameworks work, and the evidence suppliers to critical infrastructure need.

After SOC 2: The Compliance Roadmap for HealthTech Companies

Finished SOC 2? What HealthTech companies should tackle next: HIPAA, BAAs, HITRUST and ISO 27001, in the order buyers ask, reusing your existing controls.

AI-Generated Code Security: How to Keep AI-Assisted Development Safe and Audit-Ready

AI-generated code security for SMB and HealthTech teams: the real risks, SDLC guardrails and what SOC 2, ISO 27001 and HIPAA auditors will ask about AI code.

Australian Privacy Principles for Small Business: Does the Privacy Act Apply to You?

Australian Privacy Principles for small business explained: the $3 million exemption, the health service exception, the 13 APPs and a practical checklist.

Your First Security Hire: When to Hire, Which Role and What the First 90 Days Should Deliver

Planning your first security hire? Learn the signals it is time, which role to hire first, interview questions and a 90-day plan for startups and HealthTech.

GraphQL Security Best Practices: A Checklist for SaaS and HealthTech Teams

GraphQL security best practices for SaaS and HealthTech teams: fix introspection, DoS, authorization and PHI exposure risks with a practical launch checklist.

Risk Taxonomy: How to Build One for Your Risk Register (With Examples)

Learn how to build a risk taxonomy that keeps your risk register clean, with steps, owners, framework mapping and a two-level example for SaaS and HealthTech.

Secure by Design Principles: How to Build a Secure SaaS Product from Day One

Secure by design principles for SaaS and HealthTech teams: secure defaults, tenant isolation, MFA, encryption and logging that also produce audit evidence.