CyphrQISO 22301 Business Continuity Explained: BIA, Recovery, Certification
ISO 22301 explained: what the business continuity standard covers, how a BIA and recovery objectives work, and how certification goes.
Knowledge
Standards and frameworks explained: what each covers, who it applies to, and a link to the official text.
ISO/IEC 27701 Explained: Privacy Management, GDPR and 2025 Edition
ISO/IEC 27701 explained: the privacy management standard for controllers and processors, how it relates to GDPR, and what the 2025 edition changed.
NIST CSF 2.0 Explained: Six Functions, Profiles and Tiers
What NIST CSF 2.0 is, its six functions including the new Govern function, how Profiles and Tiers work, and why you cannot be certified.
ISO/IEC 27001 Explained: What It Requires and How Audits Work
ISO/IEC 27001 explained: what the ISMS standard requires, how certification and surveillance audits work, and what changed in 2022.
ISO 31000 Risk Management Explained: Principles and Process
ISO 31000:2018 is risk management guidance, not a certificate. What its principles, framework and process cover, and how it sits above ISO/IEC 27005.
COBIT 2019 Explained: Objectives, Design Factors and Audits
COBIT 2019 is ISACA's IT governance framework. What its 40 objectives and design factors are, whether you can be certified, and how auditors use it.
ISO/IEC 20000-1 Explained: IT Service Management, ITIL and Certification
ISO/IEC 20000-1 is the certifiable standard for IT service management. What it requires, how it differs from ITIL, and how certification works.
ISO/IEC 27035 Explained: Incident Management, NIST and Deadlines
ISO/IEC 27035 is guidance for handling security incidents. Its parts, lifecycle, how it compares with NIST SP 800-61, and reporting clocks.
What Does ENISA Do? The EU Cybersecurity Agency Explained
ENISA is the EU Agency for Cybersecurity. What it does under the Cybersecurity Act, how EU certification schemes (EUCC, EUCS) work, and its reports.
ISO 27017 vs 27018: Cloud Security and Privacy Standards Explained
ISO/IEC 27017 covers cloud security controls; ISO/IEC 27018 covers personal data in public clouds. What each adds and what to ask providers.
ISO/IEC 27002:2022 Explained: The Security Controls Guide
ISO/IEC 27002:2022 is guidance on security controls, not a certificate. How it relates to 27001 Annex A, its themes and attributes, and how to use it.
ISO/IEC 27005 Risk Management Explained: Process and Approaches
ISO/IEC 27005:2022 is guidance, not a certificate. What its risk process covers, event-based vs asset-based approaches, and how it supports ISO 27001.
CSA CCM and STAR Explained: How Buyers Vet Cloud Providers
The Cloud Security Alliance's CCM is a cloud control framework; STAR is the registry where providers publish proof. Levels, versions and reading an entry.
PCI DSS 4.0 Requirements Explained (v4.0.1): Scope and Assessments
PCI DSS v4.0.1 in plain terms: who it applies to, the 12 requirements, the 31 March 2025 deadline, and how SAQs, ROCs and merchant levels fit together.