Articles
Plain-English guides to the regulations and standards we cover — CRA, DORA, NIS2, ISO 27001 and supplier risk.
Best CRA compliance software in 2026: an honest buying guide
The Cyber Resilience Act has no established software category yet. What CRA compliance tools must actually do, who the real options are, and what they cost.
Should you build your own compliance AI, or buy?
32% of organizations now skip buying software they can build with agentic coding tools. For compliance AI, the build is the easy part — here's the real math.
CRA vs NIS2 vs DORA: which applies to you
CRA, NIS2 and DORA compared: scope, who they bind, deadlines and where the requirements overlap. Work out which apply to your organization.
ISO 27002 vs ISO 27001: what's the difference
ISO 27001 is the certifiable standard; ISO 27002 is the implementation guidance behind it. What each covers, what changed in 2022, and which you need.
Supplier risk management software: how to choose
What supplier risk management software does, what to look for, how the main platforms compare and what it costs. Written for EU and UK compliance teams.
Vendor risk management platforms that publish their pricing
Almost every vendor risk and compliance platform hides its pricing behind a sales call. Here's who publishes list prices, who doesn't, and why it matters.
What is an ISMS?
An ISMS is the framework behind ISO 27001 certification. What it contains, how to build one, how long it takes, and where teams usually go wrong.
CRA reporting obligations: what changes on 11 September 2026
From 11 September 2026 manufacturers must report actively exploited vulnerabilities and severe incidents under the CRA. What that requires and how to prepare.
What is the Cyber Resilience Act?
The EU Cyber Resilience Act explained: who it applies to, the essential requirements, and the deadlines that matter — for product and security teams.