Publications
Compliance, explained plainly.
Practical guides on SOC 2, ISO 27001, DPDP, GDPR and running security at a growing company, wherever you're based.
EU Cyber Resilience Act reporting is live. Indian exporters, this is your problem now.
CRA Article 14 reporting has applied since 11 September 2026. The 24 hour, 72 hour and final report deadlines explained for Indian exporters.
· 4 min readRead Sales and revenueThe real cost of compliance is the deals you lose without it
Why the cost of not being compliant outweighs the compliance budget, how to measure it in your sales pipeline, and why regulated buyers have to ask.
· 4 min readRead Evidence and operationsYour policy says one thing. Your company does another.
Why security policies stop matching what your company does, how ISO 27001 and SOC 2 auditors catch it, and how to keep documents and reality aligned.
· 4 min readRead Framework selectionSOC 2 vs ISO 27001 vs DPDP: which one do you need first?
A straight decision guide to SOC 2, ISO 27001 and India's DPDP Act: what each one is, who asks for it, and the order to do them in.
· 5 min readRead AI governanceISO 42001 is becoming the SOC 2 of AI companies
Why enterprise buyers now ask AI vendors for ISO/IEC 42001, how it relates to ISO 27001, and what a small AI company should build first.
· 4 min readRead Consulting and program designYour compliance report is not a compliance program
Why compliance consulting reports rarely become working programs, what ISO 27001 and SOC 2 require you to keep doing, and what a real handover includes.
· 4 min readRead Sales and revenueSecurity questionnaires are killing your sales cycle. Here's how to fix it.
Why security questionnaires stall B2B deals, what SIG, CAIQ and custom questionnaires really ask, and how to answer them in days instead of weeks.
· 4 min readRead India regulationDPDP Act deadline: what actually changes on 13 November 2026
The DPDP Rules timeline explained: what switches on 13 November 2026, what applies from 13 May 2027, the proposed 12 month cut, and what to build now.
· 5 min readRead Tools and automationThe Delve scandal: what 493 identical SOC 2 reports say about compliance automation
What was alleged against Delve, why procurement teams missed it, how to check a SOC 2 auditor is legitimate, and what compliance automation should prove.
· 5 min readRead Consulting and program designHow to report compliance and cyber risk to your board on one page
A one page format for reporting compliance and cyber risk to a board: the five blocks to include, what to leave out, and what RBI, ISO 27001 and the SEC expect.
· 4 min readRead Evidence and operationsUser access reviews: how to run one that isn't rubber stamped
What ISO 27001 and SOC 2 expect from user access reviews, why most are rubber stamped, and a process with full lists, the right reviewers and dated evidence.
· 4 min readRead India regulationSEBI CSCRF compliance: what fintechs and their vendors need to know
Who SEBI's Cybersecurity and Cyber Resilience Framework applies to, how its categories work, what it requires, and why vendors to brokers are in scope.
· 4 min readRead Framework selectionMulti framework compliance: how to map once and comply with ISO 27001, SOC 2, DPDP and GDPR
How to run ISO 27001, SOC 2, DPDP and GDPR from one set of controls: example mappings, where frameworks differ, and the crosswalks that help.
· 5 min readRead Evidence and operationsHow to build a risk register people actually use
Why ISO 27001 risk registers turn into ignored spreadsheets, what clauses 6.1.2 and 8.2 require, and how to build a short register linked to real controls.
· 4 min readRead Tools and automationCompliance software lock in: how to own your compliance data
What to check in a compliance software contract before you sign or renew: data export, evidence history, renewal caps, Type II continuity and termination terms.
· 4 min readRead India regulationDPDP consent managers explained: what they mean for your business
What a consent manager is under India's DPDP Act and Rule 4, who can register from 13 November 2026, and what data fiduciaries must build for consent.
· 4 min readRead AI governanceCan AI answer security questionnaires? Yes. Should it sign them? No.
How AI security questionnaire tools work, where they go wrong, why answers become contractual commitments, and a safe workflow for using them.
· 4 min readRead Consulting and program designCompliance at 200 employees: too big for spreadsheets, too small for a GRC team
Why companies of 100 to 500 people struggle most with compliance ownership, and the real options: hire, a fractional CISO, or a platform plus a specialist.
· 4 min readRead Evidence and operationsAudit evidence collection: stop taking screenshots for your auditor
What auditors want from SOC 2 and ISO 27001 evidence, why screenshots are weak, how sampling works, and how to collect evidence as part of the work.
· 4 min readRead Vendor riskHow to review a vendor's SOC 2 report, and spot a worthless one
A practical SOC 2 report review checklist for vendor risk: what each section means, the seven red flags to check, and what to ask the vendor afterwards.
· 5 min readRead Global regulationDoes GDPR apply to Indian companies? Yes, and here's when.
When GDPR applies to companies in India under Article 3(2), what you have to do, and how GDPR and India's DPDP Act differ on consent, children and breaches.
· 5 min readRead Tools and automationCompliance software or compliance consultant? You're asking the wrong question.
Compliance automation platforms like Vanta, Drata, Sprinto and Steppe versus consultants: what each does well, where each fails, and how to combine them.
· 5 min readRead Tools and automationContinuous compliance monitoring: why annual audits are no longer enough
What continuous compliance monitoring is, why point in time audits miss control drift, what to monitor first, and what still needs human judgement.
· 4 min readRead India regulationRegulatory change management for Indian fintechs: who is reading the circulars?
How Indian fintechs can keep up with RBI, SEBI and CERT-In circulars: a simple regulatory change process with owners, applicability checks and evidence.
· 4 min readRead AI governanceAI compliance by design: why reviewing your AI feature before launch is too late
Why compliance reviews of AI features fail when they happen just before launch, and the six questions to ask at design review under DPDP, GDPR and ISO 42001.
· 4 min readRead Sales and revenueFive questions every enterprise buyer will ask you
The five questions enterprise and regulated buyers ask every vendor, why their regulators make them ask, and what a good answer with evidence looks like.
· 5 min readRead Evidence and operationsThe shadow register: the security exceptions every company has and nobody tracks
Why unrecorded security exceptions become permanent risks, what ISO 27001 and SOC 2 expect, and how to run an exception register with owners and expiry dates.
· 4 min readRead Tools and automationOpen source GRC tools: what free actually costs
An honest look at open source GRC tools like CISO Assistant, Probo and Comp AI: what they do well, what their GitHub issues reveal, and who should use them.
· 4 min readRead Consulting and program designWhy compliance programs collapse six months after the audit
A month by month look at how SOC 2 and ISO 27001 programs decay after the audit, why Type II makes that decay visible, and how to stop it.
· 4 min readRead Founder voiceWhat good compliance looks like in 2026: seven things I believe
Seven beliefs about how compliance should work in 2026: programs over reports, evidence over screenshots, continuous over annual, and frameworks built once.
· 4 min readRead