Blog / GRC

Risk Acceptance: When to Accept a Risk, Who Signs Off and What to Document

Risk acceptance explained: when accepting a risk is appropriate, ISO 27001 acceptance criteria, what SOC 2 auditors check and the fields a form needs.

Inherent Risk vs Residual Risk: Definitions, Scoring and a Worked Example

Inherent risk vs residual risk explained with a HealthTech worked example, a comparison table and scoring tips for ISO 27001, SOC 2 and HIPAA assessments.

Japan Compliance Frameworks: A Buyer-Driven Map for SaaS and HealthTech Vendors

Japan compliance frameworks explained for SaaS and HealthTech vendors: APPI, ISMAP, ISMS, Privacy Mark and FISC, mapped to the buyers who ask for each one.

APRA CPS 234 Checklist: Requirements for Regulated Entities and Their Service Providers

A practical APRA CPS 234 checklist covering board duties, controls, testing and 72-hour notification, plus a vendor checklist for SaaS providers.

NZISM Explained: The New Zealand Information Security Manual for Cloud and SaaS Providers

Learn what the NZISM requires, how it works with the PSR, and how SaaS and cloud providers can prepare to sell to New Zealand government and health agencies.

SOCI Act CIRMP Guide: Obligations for Responsible Entities and Their Suppliers

Learn what the SOCI Act CIRMP requires, how its four hazard domains and cyber frameworks work, and the evidence suppliers to critical infrastructure need.

Your First Security Hire: When to Hire, Which Role and What the First 90 Days Should Deliver

Planning your first security hire? Learn the signals it is time, which role to hire first, interview questions and a 90-day plan for startups and HealthTech.

Risk Taxonomy: How to Build One for Your Risk Register (With Examples)

Learn how to build a risk taxonomy that keeps your risk register clean, with steps, owners, framework mapping and a two-level example for SaaS and HealthTech.

Free and low-cost MDM solutions: what sysadmins should actually evaluate

Free MDM solutions compared, plus SecureSlate Lite with MDM and Trust Center free for 1 year for teams that need enforcement and proof.

ITDR for SOC 2 and ISO 27001: Identity Controls Evidence Map

Map ITDR for SOC 2 and ISO 27001 identity controls evidence: detection signals, response workflows, and audit-ready artifacts you can reuse across frameworks.