Resources
What we know, written down
Regulation explained by concrete obligation, audit method, and the product documentation. No forms in the way.
Filter by
Format
Topic
Profile
What counts as valid evidence in a security audit
The difference between a screenshot and evidence that holds up comes down to four properties: origin, date, integrity and scope. None of them is optional. Read the guideHow to prepare for your first ENS conformity audit
What to do in the months before a Spanish ENS certification audit, in what order, and which three documents have dates that decide the outcome. Read the guideAssessing suppliers: what they declare versus what you can observe
A security questionnaire measures what a supplier says about itself. How to build the other half of the assessment — the half you can verify without asking permission. Read the guideUsing AI in audit without breaking the chain of custody
Where a model can sit inside an audit process and where it cannot, and what has to be recorded so its involvement does not invalidate the evidence. Read the guideNIS2 — Directive (EU) 2022/2555
What NIS2 actually obliges an essential or important entity to do: management body approval, ten minimum risk-management measures, and a reporting clock of 24 hours, 72 hours and one month. See the obligationsDORA — Regulation (EU) 2022/2554
The digital operational resilience obligations that have applied to European financial entities since January 2025: an ICT risk framework reviewed yearly, major incidents reported within four hours, and a register of ICT providers. See the obligationsENS — Spanish Royal Decree 311/2022
What Spain's National Security Framework demands of a public body and of its suppliers: categorisation across five dimensions, a signed Statement of Applicability, and an audit at least every two years. See the obligationsCRA — Regulation (EU) 2024/2847
The Cyber Resilience Act binds anyone placing software or connected hardware on the EU market: an SBOM, a declared support period, actively exploited vulnerabilities reported within 24 hours, and CE marking. See the obligationsAttestation
A formal statement issued by an identifiable party asserting, on its own responsibility, that something has been checked and over what scope. See the definitionChain of custody
The continuous trail that demonstrates a piece of evidence came from where it is claimed to and was not altered at any point along the way. See the definitionControl exception
A formal, temporary and documented authorisation to operate without meeting a specific control, with reason, owner and expiry date. See the definitionCVSS
A standard for describing and scoring the intrinsic characteristics of a vulnerability, from 0 to 10, independently of where it is installed. See the definitionEPSS
A statistical model that estimates the probability of a specific vulnerability being exploited in the wild over the next thirty days. See the definitionEvidence
An artefact that lets a third party who was not present verify that a control ran, when, over what scope, and without later alteration. See the definitionExternal attack surface
The set of an organisation's assets and services reachable from the internet without prior credentials. See the definitionFalse positive
A finding reported by a tool or an analyst that, checked against the real system, does not correspond to an exploitable vulnerability. See the definitionFinding deduplication
Recognising that several results from different sources or campaigns describe the same problem, and treating them as a single entity. See the definitionGap analysis
A structured comparison between what a standard requires and what the organisation actually has in place, requirement by requirement. See the definitionIncident notification
Formal communication of an incident to the competent authority within a fixed deadline, counted from the moment the entity became aware of it. See the definitionMulti-tenant
An architecture in which a single software instance serves several customers, whose data is kept logically separate. See the definitionPentest
A security test in which a team actively attempts to exploit a system, within an agreed scope and window, to demonstrate real impact. See the definitionRemediation plan
A document assigning every open finding an owner, a concrete action and a committed date, and recording its verified closure. See the definitionRetest
Re-running the original reproduction steps for a specific finding after it has been fixed, to verify whether it is still exploitable. See the definitionRisk appetite
The level of risk management declares it is willing to accept in pursuit of its objectives, expressed so that concrete cases can be decided against it. See the definitionSecurity posture
The measurable state of an organisation's controls at a given moment, as against what its policies declare. See the definitionService level agreement
A contractual commitment on measurable service parameters, with a defined measurement method and declared consequences for missing them. See the definitionStatement of Applicability
A signed document recording, control by control, which apply to the system, which do not, and on what justification. See the definitionSupplier criticality
The classification that decides how much assessment depth and monitoring a third party warrants, based on the damage its failure would cause. See the definitionNothing matches this combination.
Try removing a filter, or searching another term.
Collections
Regulation What exactly it obliges you to do Not a summary of the directive: the concrete obligation, who it applies to, by when, and what evidence holds it up. Explore Glossary The terms, without the fog Short, honest definitions of what gets used every day in audit, compliance and incident response. Explore