Articles tagged “Compliance”
How to write an ISO 27001 Statement of Applicability: step by step, with a worked example and a template
The Statement of Applicability is not a list of controls with a yes or a no. It records what you decided when you treated your risks: which controls you need, why, whether they are in place and why you exclude the rest. Five steps, a worked example with ACME and a template.
What DORA Requires of ICT Third-Party Providers, Article by Article
DORA isn't a directive waiting for national transposition — it's been directly applicable since January 2025. For covered financial entities and their ICT providers, that means a register of information to keep current, not a one-off exercise.
How to run a business continuity exercise: the tabletop exercise step by step, with a sample script
A continuity exercise is not there to pass: it is there to find what breaks before it breaks for real. Which kind of exercise to choose, how to write the scenario and the injects, how to run the session and what evidence to keep, with ACME's full script.
How to calculate RTO and RPO in a business impact analysis (BIA): step by step, with a worked example and a template
RTO and RPO are not chosen: they come out of the business impact analysis. The maximum tolerable period of disruption is when the impact becomes unacceptable; the RTO sits before it, with a margin, and the RPO is set by what the business cannot rebuild. Six steps, a full example and a template.