https://grcide.com/insights Working methods and regulatory briefings for security governance, risk and compliance practitioners. en Thu, 03 Sep 2026 00:00:00 +0000 https://grcide.com/engagement-patterns/ai-governance-standup https://grcide.com/engagement-patterns/ai-governance-standup Thu, 03 Sep 2026 00:00:00 +0000 Standing up AI governance from a blank sheet: role and classification first, then the management system, the impact work and the incident clocks. governance https://grcide.com/reference/grc-framework-selection https://grcide.com/reference/grc-framework-selection Thu, 03 Sep 2026 00:00:00 +0000 Certifiable standard, outcome framework, attestation report or sector standard: what each GRC instrument produces, and which one a given driver calls for. governance https://grcide.com/playbooks/isms-people-actually-use https://grcide.com/playbooks/isms-people-actually-use Thu, 03 Sep 2026 00:00:00 +0000 A method for standing up an ISO/IEC 27001 management system that produces evidence in daily operation instead of a binder assembled before the audit. governance https://grcide.com/engagement-patterns/iso27001-first-certification https://grcide.com/engagement-patterns/iso27001-first-certification Thu, 03 Sep 2026 00:00:00 +0000 The shape of a first certification cycle: scope, risk assessment and treatment, the operating record, and the evidence an accredited body reads. compliance https://grcide.com/briefings/nis2-for-the-security-officer https://grcide.com/briefings/nis2-for-the-security-officer Thu, 03 Sep 2026 00:00:00 +0000 Directive (EU) 2022/2555 in one pass: the scope test, the obligations by article, the reporting clock, the fine ceilings and a mapping to ISO 27001 Annex A. compliance https://grcide.com/engagement-patterns/nis2-readiness-important-entity https://grcide.com/engagement-patterns/nis2-readiness-important-entity Thu, 03 Sep 2026 00:00:00 +0000 How readiness is shaped for an entity in the important tier: the scope test, the Article 21 measures, the reporting chain and the evidence behind them. compliance https://grcide.com/engagement-patterns/product-cybersecurity-r155-cra https://grcide.com/engagement-patterns/product-cybersecurity-r155-cra Thu, 03 Sep 2026 00:00:00 +0000 One product, three instruments. How the management system, the per-product file and the reporting clocks are built so a single evidence set answers all three. compliance https://grcide.com/templates/risk-register https://grcide.com/templates/risk-register Thu, 03 Sep 2026 00:00:00 +0000 A sixteen-column information security risk register with anchored 1-5 scales, a published combination rule and two mandatory decisions on every row. risk https://grcide.com/playbooks/risk-register-people-trust https://grcide.com/playbooks/risk-register-people-trust Thu, 03 Sep 2026 00:00:00 +0000 Risk statements that name a source, an event and a consequence; scales that survive argument; and every row closed by a named approver on a dated decision. risk https://grcide.com/radar#ai-act-high-risk-deferral https://grcide.com/radar#ai-act-high-risk-deferral Mon, 27 Jul 2026 00:00:00 +0000 The Digital Omnibus on AI moves the high-risk obligations to December 2027 and August 2028, and adds two prohibited practices from December 2026. https://grcide.com/radar#cer-directive-swedish-bill https://grcide.com/radar#cer-directive-swedish-bill Tue, 14 Jul 2026 00:00:00 +0000 Sweden's bill implementing the critical entities resilience directive was laid before the Riksdag on 14 July 2026, proposing effect from 1 January 2027. https://grcide.com/briefings/r155-vs-iso21434-five-misreads https://grcide.com/briefings/r155-vs-iso21434-five-misreads Fri, 10 Jul 2026 00:00:00 +0000 R155 mandates the framework; ISO 21434 describes how to build it. Treating them as interchangeable is where most first-time audits go sideways. compliance https://grcide.com/briefings/soc2-type1-90-day-plan https://grcide.com/briefings/soc2-type1-90-day-plan Fri, 10 Jul 2026 00:00:00 +0000 A week-by-week sequence for a first SOC 2 type 1 examination: scope, policy set, evidence pipeline, risk assessment, fieldwork. compliance https://grcide.com/radar#cra-reporting-obligations https://grcide.com/radar#cra-reporting-obligations Thu, 11 Jun 2026 00:00:00 +0000 Article 14 applies from 11 September 2026, ahead of full application on 11 December 2027, and it reaches products already placed on the market. https://grcide.com/radar#nis2-swedish-cybersecurity-act https://grcide.com/radar#nis2-swedish-cybersecurity-act Thu, 15 Jan 2026 00:00:00 +0000 Cybersäkerhetslag (2025:1506) entered into force on 15 January 2026, fifteen months after the directive's transposition date of 17 October 2024. https://grcide.com/radar#gb-44495-44496-in-force https://grcide.com/radar#gb-44495-44496-in-force Thu, 01 Jan 2026 00:00:00 +0000 China's mandatory vehicle cybersecurity and software-update standards moved from issued to in force on 1 January 2026, seventeen months after publication. https://grcide.com/radar#iso-27001-2022-transition-closed https://grcide.com/radar#iso-27001-2022-transition-closed Fri, 31 Oct 2025 00:00:00 +0000 The accredited transition period set by IAF MD 26 ended on 31 October 2025; certificates naming the 2013 edition expire or are withdrawn. https://grcide.com/radar#iso-42006-certification-route https://grcide.com/radar#iso-42006-certification-route Mon, 07 Jul 2025 00:00:00 +0000 The requirements standard for bodies auditing AI management systems was published on 7 July 2025, alongside the impact-assessment standard of May 2025. https://grcide.com/radar#dora-subcontracting-rts https://grcide.com/radar#dora-subcontracting-rts Wed, 02 Jul 2025 00:00:00 +0000 Delegated Regulation (EU) 2025/532 sets what a financial entity must determine before ICT services supporting critical or important functions are subcontracted. https://grcide.com/radar#un-r155-supplement-3 https://grcide.com/radar#un-r155-supplement-3 Fri, 10 Jan 2025 00:00:00 +0000 The consolidated R155 text republished in the Official Journal as 2025/5 incorporates all valid text up to Supplement 3 to the original version. https://grcide.com/radar#nist-csf-2-0 https://grcide.com/radar#nist-csf-2-0 Mon, 26 Feb 2024 00:00:00 +0000 The Cybersecurity Framework 2.0 was published on 26 February 2024 as NIST CSWP 29, with Govern at the centre of a six-Function Core.