Articles about Compliance from the ConsultorIA blog: cloud, applied AI and security in production.
California set the template and a growing list of states copied it with variations. What differs from GDPR, why the browser opt-out signal is the part teams miss, and how to build once for a list that keeps growing.
Any agent that reads untrusted content and can act will eventually take instructions from that content. The defences that work are architectural, not textual.
Kyverno or Gatekeeper is a smaller decision than how you roll policy out. Audit, then warn, then enforce, with system namespaces excluded and a failure policy you have thought about.
It is not a certification of your model. It is the scaffolding that makes AI governance repeatable, and if you already run ISO 27001, most of the machinery is built.
Severity defined by criteria instead of instinct, three roles, one timeline and a named person who decides whether to notify. Everything else in an incident process is optional.
The business associate agreement is the easy part. Which services you may use, which data you can avoid holding, and the six technical safeguards that turn into actual configuration.
The auditor does not read your privacy policy. They ask which system holds personal data, how long it keeps it, who can read it and what happens when someone asks for a copy. Those are engineering questions.
They look like neighbours and they are not. One is an attestation you commission, the other is an authorisation you earn against a prescribed control baseline, and the cost difference is an order of magnitude.
Transfer mechanisms, region choice and support access are three different questions that get merged into one. How to answer a European buyer's questionnaire with facts rather than assurances.
If you sell software or connected hardware into the EU, security stops being a quality attribute and becomes a market access requirement, with a vulnerability reporting clock and a support period you must declare.
Most teams either assume the AI Act does not touch them or assume it bans what they are building. How to establish your role and risk tier, and what the obligations cost an engineering team.
Sigma is a vendor-neutral format for detection logic that compiles to your platform's query language. The format is the easy part. Version control, testing and a lifecycle for rules are what make detection work.
Ransomware crews go for the backups first, and cloud backups are easier to delete than tape ever was. Immutability, credential separation and a copy outside the blast radius are what turn a backup into a recovery.
GuardDuty is enabled in most accounts and read in almost none. The fix is not more tuning, it is deciding in advance which five findings wake a human and what they do next.
Public buckets are the headline and the easy part. The leaks we find now come from bucket policies, presigned URLs, replication and logs nobody reads. Here is the full pass.
ISO 27001, SOC 2, ENS and NIS2 overlap heavily. Running them as four separate projects triples the cost. How to build a single control set with a single evidence pipeline, and where the mapping genuinely breaks down.
DORA applies to banks and insurers, but its contractual and oversight provisions reach their ICT providers directly. What changes in your contracts, your exit plans and your incident reporting if your customers are regulated.
Every control in PCI DSS applies to everything in scope, so the cheapest compliance project is the one that removes systems from scope. How tokenisation, segmentation and a hosted payment page change the size of the problem.
Two supplementary standards that extend ISO 27001 into cloud services and personal data in the cloud. What each adds, who actually asks for them, and how much extra audit they cost.
The Esquema Nacional de Seguridad is not optional if you want public sector contracts in Spain. How the categories work, what the 2022 revision changed, and where a cloud-native company usually fails.
NIS2 pulled in far more companies than its predecessor, added personal liability for management, and set a 24-hour first notification. What the directive actually requires, in engineering terms.
A Type II window means proving, month after month, that controls ran. Collecting that by hand consumes an engineer. What to automate, what to buy, and what still has to be done by a person.
Type I is a photograph, Type II is a film. The choice changes your timeline by months and what a customer will accept. How to pick, how long each takes, and where the money goes.
Most ISO 27001 projects write the SoA last, as a spreadsheet of 93 rows marked "applicable". Done properly it falls out of the risk assessment, and it is what makes the rest of the audit go quickly.
A company running entirely on managed cloud services already satisfies a large part of Annex A without knowing it. The work is evidencing that, and finding the dozen controls that genuinely need building.
An open-source SIEM is a real option when the alternative is paying per gigabyte, but only if you accept the operational cost. What Wazuh gives you out of the box, what you have to build, and when to stop and buy.
SCC Premium turns on and produces thousands of findings in an hour. Here is the triage order that gets an estate from "unreadable" to "twelve open items" in about three weeks.
Dependency scanning is mature; what changed is that customers and regulators now ask for the inventory itself. How to generate SBOMs that are useful rather than ceremonial, and how to answer "are we affected?" in an hour.
IAM stops the wrong people reading your data. It does not stop the right people copying it somewhere else. Service perimeters do, and they will break things on the way in. Here is how to roll one out without an outage.
Defender has eight separately priced plans and a score that rewards volume over risk. Here is how we decide which plans earn their cost and how to triage the recommendations that matter.
Azure Policy is the strongest governance engine of the three big clouds and the easiest to misuse. Here is how we write, test and roll out policy so a Deny effect never surprises a deployment.
Most cloud security products tell you what went wrong. Security Zones refuse the misconfiguration at creation. That is a meaningful difference, and it is the OCI feature worth building around.