Publications
Consulting and program design
How compliance programs are built, handed over and kept running after the audit.
Consulting and program design
Your compliance report is not a compliance program
Why compliance consulting reports rarely become working programs, what ISO 27001 and SOC 2 require you to keep doing, and what a real handover includes.
· 4 min readRead Consulting and program designHow to report compliance and cyber risk to your board on one page
A one page format for reporting compliance and cyber risk to a board: the five blocks to include, what to leave out, and what RBI, ISO 27001 and the SEC expect.
· 4 min readRead Consulting and program designCompliance at 200 employees: too big for spreadsheets, too small for a GRC team
Why companies of 100 to 500 people struggle most with compliance ownership, and the real options: hire, a fractional CISO, or a platform plus a specialist.
· 4 min readRead Consulting and program designWhy compliance programs collapse six months after the audit
A month by month look at how SOC 2 and ISO 27001 programs decay after the audit, why Type II makes that decay visible, and how to stop it.
· 4 min readRead