Steppe Publicationshttps://steppe.in/articlesPractical compliance guides from the Steppe team.en-in EU Cyber Resilience Act reporting is live. Indian exporters, this is your problem now.https://steppe.in/articles/eu-cyber-resilience-act-reporting-obligationshttps://steppe.in/articles/eu-cyber-resilience-act-reporting-obligationsMon, 12 Oct 2026 09:00:00 +0530Global regulationCRA Article 14 reporting has applied since 11 September 2026. The 24 hour, 72 hour and final report deadlines explained for Indian exporters. The real cost of compliance is the deals you lose without ithttps://steppe.in/articles/cost-of-compliance-revenuehttps://steppe.in/articles/cost-of-compliance-revenueSun, 11 Oct 2026 09:00:00 +0530Sales and revenueWhy the cost of not being compliant outweighs the compliance budget, how to measure it in your sales pipeline, and why regulated buyers have to ask. Your policy says one thing. Your company does another.https://steppe.in/articles/security-policy-vs-practicehttps://steppe.in/articles/security-policy-vs-practiceSat, 10 Oct 2026 09:00:00 +0530Evidence and operationsWhy security policies stop matching what your company does, how ISO 27001 and SOC 2 auditors catch it, and how to keep documents and reality aligned. SOC 2 vs ISO 27001 vs DPDP: which one do you need first?https://steppe.in/articles/soc-2-vs-iso-27001-vs-dpdphttps://steppe.in/articles/soc-2-vs-iso-27001-vs-dpdpFri, 09 Oct 2026 09:00:00 +0530Framework selectionA straight decision guide to SOC 2, ISO 27001 and India's DPDP Act: what each one is, who asks for it, and the order to do them in. ISO 42001 is becoming the SOC 2 of AI companieshttps://steppe.in/articles/iso-42001-certification-ai-companieshttps://steppe.in/articles/iso-42001-certification-ai-companiesThu, 08 Oct 2026 09:00:00 +0530AI governanceWhy enterprise buyers now ask AI vendors for ISO/IEC 42001, how it relates to ISO 27001, and what a small AI company should build first. Your compliance report is not a compliance programhttps://steppe.in/articles/compliance-report-vs-compliance-programhttps://steppe.in/articles/compliance-report-vs-compliance-programWed, 07 Oct 2026 09:00:00 +0530Consulting and program designWhy compliance consulting reports rarely become working programs, what ISO 27001 and SOC 2 require you to keep doing, and what a real handover includes. Security questionnaires are killing your sales cycle. Here's how to fix it.https://steppe.in/articles/security-questionnaires-sales-cyclehttps://steppe.in/articles/security-questionnaires-sales-cycleTue, 06 Oct 2026 09:00:00 +0530Sales and revenueWhy security questionnaires stall B2B deals, what SIG, CAIQ and custom questionnaires really ask, and how to answer them in days instead of weeks. DPDP Act deadline: what actually changes on 13 November 2026https://steppe.in/articles/dpdp-act-deadline-13-november-2026https://steppe.in/articles/dpdp-act-deadline-13-november-2026Mon, 05 Oct 2026 09:00:00 +0530India regulationThe DPDP Rules timeline explained: what switches on 13 November 2026, what applies from 13 May 2027, the proposed 12 month cut, and what to build now. The Delve scandal: what 493 identical SOC 2 reports say about compliance automationhttps://steppe.in/articles/delve-scandal-soc-2-reportshttps://steppe.in/articles/delve-scandal-soc-2-reportsSun, 04 Oct 2026 09:00:00 +0530Tools and automationWhat was alleged against Delve, why procurement teams missed it, how to check a SOC 2 auditor is legitimate, and what compliance automation should prove. How to report compliance and cyber risk to your board on one pagehttps://steppe.in/articles/board-compliance-cyber-risk-reporthttps://steppe.in/articles/board-compliance-cyber-risk-reportFri, 02 Oct 2026 09:00:00 +0530Consulting and program designA one page format for reporting compliance and cyber risk to a board: the five blocks to include, what to leave out, and what RBI, ISO 27001 and the SEC expect. User access reviews: how to run one that isn't rubber stampedhttps://steppe.in/articles/user-access-review-processhttps://steppe.in/articles/user-access-review-processThu, 01 Oct 2026 09:00:00 +0530Evidence and operationsWhat ISO 27001 and SOC 2 expect from user access reviews, why most are rubber stamped, and a process with full lists, the right reviewers and dated evidence. SEBI CSCRF compliance: what fintechs and their vendors need to knowhttps://steppe.in/articles/sebi-cscrf-compliancehttps://steppe.in/articles/sebi-cscrf-complianceWed, 30 Sep 2026 09:00:00 +0530India regulationWho SEBI's Cybersecurity and Cyber Resilience Framework applies to, how its categories work, what it requires, and why vendors to brokers are in scope. Multi framework compliance: how to map once and comply with ISO 27001, SOC 2, DPDP and GDPRhttps://steppe.in/articles/multi-framework-compliance-mappinghttps://steppe.in/articles/multi-framework-compliance-mappingTue, 29 Sep 2026 09:00:00 +0530Framework selectionHow to run ISO 27001, SOC 2, DPDP and GDPR from one set of controls: example mappings, where frameworks differ, and the crosswalks that help. How to build a risk register people actually usehttps://steppe.in/articles/information-security-risk-registerhttps://steppe.in/articles/information-security-risk-registerMon, 28 Sep 2026 09:00:00 +0530Evidence and operationsWhy ISO 27001 risk registers turn into ignored spreadsheets, what clauses 6.1.2 and 8.2 require, and how to build a short register linked to real controls. Compliance software lock in: how to own your compliance datahttps://steppe.in/articles/compliance-platform-lock-inhttps://steppe.in/articles/compliance-platform-lock-inSun, 27 Sep 2026 09:00:00 +0530Tools and automationWhat to check in a compliance software contract before you sign or renew: data export, evidence history, renewal caps, Type II continuity and termination terms. DPDP consent managers explained: what they mean for your businesshttps://steppe.in/articles/dpdp-consent-manager-explainedhttps://steppe.in/articles/dpdp-consent-manager-explainedSat, 26 Sep 2026 09:00:00 +0530India regulationWhat a consent manager is under India's DPDP Act and Rule 4, who can register from 13 November 2026, and what data fiduciaries must build for consent. Can AI answer security questionnaires? Yes. Should it sign them? No.https://steppe.in/articles/ai-security-questionnaire-automationhttps://steppe.in/articles/ai-security-questionnaire-automationFri, 25 Sep 2026 09:00:00 +0530AI governanceHow AI security questionnaire tools work, where they go wrong, why answers become contractual commitments, and a safe workflow for using them. Compliance at 200 employees: too big for spreadsheets, too small for a GRC teamhttps://steppe.in/articles/compliance-ownership-mid-size-companyhttps://steppe.in/articles/compliance-ownership-mid-size-companyThu, 24 Sep 2026 09:00:00 +0530Consulting and program designWhy companies of 100 to 500 people struggle most with compliance ownership, and the real options: hire, a fractional CISO, or a platform plus a specialist. Audit evidence collection: stop taking screenshots for your auditorhttps://steppe.in/articles/audit-evidence-collectionhttps://steppe.in/articles/audit-evidence-collectionWed, 23 Sep 2026 09:00:00 +0530Evidence and operationsWhat auditors want from SOC 2 and ISO 27001 evidence, why screenshots are weak, how sampling works, and how to collect evidence as part of the work. How to review a vendor's SOC 2 report, and spot a worthless onehttps://steppe.in/articles/how-to-review-vendor-soc-2-reporthttps://steppe.in/articles/how-to-review-vendor-soc-2-reportTue, 22 Sep 2026 09:00:00 +0530Vendor riskA practical SOC 2 report review checklist for vendor risk: what each section means, the seven red flags to check, and what to ask the vendor afterwards. Does GDPR apply to Indian companies? Yes, and here's when.https://steppe.in/articles/does-gdpr-apply-to-indian-companieshttps://steppe.in/articles/does-gdpr-apply-to-indian-companiesMon, 21 Sep 2026 09:00:00 +0530Global regulationWhen GDPR applies to companies in India under Article 3(2), what you have to do, and how GDPR and India's DPDP Act differ on consent, children and breaches. Compliance software or compliance consultant? You're asking the wrong question.https://steppe.in/articles/compliance-software-vs-consultanthttps://steppe.in/articles/compliance-software-vs-consultantSun, 20 Sep 2026 09:00:00 +0530Tools and automationCompliance automation platforms like Vanta, Drata, Sprinto and Steppe versus consultants: what each does well, where each fails, and how to combine them. Continuous compliance monitoring: why annual audits are no longer enoughhttps://steppe.in/articles/continuous-compliance-monitoringhttps://steppe.in/articles/continuous-compliance-monitoringSat, 19 Sep 2026 09:00:00 +0530Tools and automationWhat continuous compliance monitoring is, why point in time audits miss control drift, what to monitor first, and what still needs human judgement. Regulatory change management for Indian fintechs: who is reading the circulars?https://steppe.in/articles/regulatory-change-management-india-fintechhttps://steppe.in/articles/regulatory-change-management-india-fintechFri, 18 Sep 2026 09:00:00 +0530India regulationHow Indian fintechs can keep up with RBI, SEBI and CERT-In circulars: a simple regulatory change process with owners, applicability checks and evidence. AI compliance by design: why reviewing your AI feature before launch is too latehttps://steppe.in/articles/ai-compliance-by-designhttps://steppe.in/articles/ai-compliance-by-designThu, 17 Sep 2026 09:00:00 +0530AI governanceWhy compliance reviews of AI features fail when they happen just before launch, and the six questions to ask at design review under DPDP, GDPR and ISO 42001. Five questions every enterprise buyer will ask youhttps://steppe.in/articles/enterprise-security-review-questionshttps://steppe.in/articles/enterprise-security-review-questionsWed, 16 Sep 2026 09:00:00 +0530Sales and revenueThe five questions enterprise and regulated buyers ask every vendor, why their regulators make them ask, and what a good answer with evidence looks like. The shadow register: the security exceptions every company has and nobody trackshttps://steppe.in/articles/security-exception-processhttps://steppe.in/articles/security-exception-processTue, 15 Sep 2026 09:00:00 +0530Evidence and operationsWhy unrecorded security exceptions become permanent risks, what ISO 27001 and SOC 2 expect, and how to run an exception register with owners and expiry dates. Open source GRC tools: what free actually costshttps://steppe.in/articles/open-source-grc-tools-costhttps://steppe.in/articles/open-source-grc-tools-costMon, 14 Sep 2026 09:00:00 +0530Tools and automationAn honest look at open source GRC tools like CISO Assistant, Probo and Comp AI: what they do well, what their GitHub issues reveal, and who should use them. Why compliance programs collapse six months after the audithttps://steppe.in/articles/why-compliance-programs-fail-after-audithttps://steppe.in/articles/why-compliance-programs-fail-after-auditSun, 13 Sep 2026 09:00:00 +0530Consulting and program designA month by month look at how SOC 2 and ISO 27001 programs decay after the audit, why Type II makes that decay visible, and how to stop it. What good compliance looks like in 2026: seven things I believehttps://steppe.in/articles/what-good-compliance-looks-likehttps://steppe.in/articles/what-good-compliance-looks-likeSat, 12 Sep 2026 09:00:00 +0530Founder voiceSeven beliefs about how compliance should work in 2026: programs over reports, evidence over screenshots, continuous over annual, and frameworks built once.