Blog / GRC

Risk Avoidance: What It Is, When to Avoid a Risk and Real SaaS Examples

Risk avoidance explained: when to avoid a risk instead of mitigating it, SaaS and HealthTech examples, the ISO 27001 link and how to record it in your register.

Singapore Compliance Frameworks: PDPA, CSA Marks, MAS TRM and More for SaaS and HealthTech

Singapore compliance frameworks explained for SaaS and HealthTech vendors: PDPA, CSA marks, MAS TRM and health rules, plus how to reuse SOC 2 and ISO 27001.

MDM Migration: How to Switch MDM Providers Without Breaking Compliance

Plan an MDM migration that keeps encryption, patching and audit evidence intact. A phased checklist for switching MDM providers on macOS, Windows and mobile.

EU Cybersecurity and Privacy Regulations for SaaS: Which Ones Apply to You?

A plain-English map of EU cybersecurity regulations for SaaS: GDPR, NIS 2, DORA, the AI Act, the Cyber Resilience Act and the Data Act, and who they cover.

Risk Acceptance: When to Accept a Risk, Who Signs Off and What to Document

Risk acceptance explained: when accepting a risk is appropriate, ISO 27001 acceptance criteria, what SOC 2 auditors check and the fields a form needs.

Inherent Risk vs Residual Risk: Definitions, Scoring and a Worked Example

Inherent risk vs residual risk explained with a HealthTech worked example, a comparison table and scoring tips for ISO 27001, SOC 2 and HIPAA assessments.

Japan Compliance Frameworks: A Buyer-Driven Map for SaaS and HealthTech Vendors

Japan compliance frameworks explained for SaaS and HealthTech vendors: APPI, ISMAP, ISMS, Privacy Mark and FISC, mapped to the buyers who ask for each one.

APRA CPS 234 Checklist: Requirements for Regulated Entities and Their Service Providers

A practical APRA CPS 234 checklist covering board duties, controls, testing and 72-hour notification, plus a vendor checklist for SaaS providers.

NZISM Explained: The New Zealand Information Security Manual for Cloud and SaaS Providers

Learn what the NZISM requires, how it works with the PSR, and how SaaS and cloud providers can prepare to sell to New Zealand government and health agencies.

SOCI Act CIRMP Guide: Obligations for Responsible Entities and Their Suppliers

Learn what the SOCI Act CIRMP requires, how its four hazard domains and cyber frameworks work, and the evidence suppliers to critical infrastructure need.