Guides
Practical compliance guides, not vague advice
Straight walkthroughs of the frameworks and questions that actually come up — audits, enterprise security questionnaires, and the regulations behind them.
Data Protection
Kenya's Data Protection Act: What Businesses Need to Know
Kenya's Data Protection Act, 2019 established the ODPC and a GDPR-style compliance regime. Here's how registration, the Data Protection Officer requirement, and data subject rights actually work.
Information Security
NIS2 Explained: The EU's Expanded Cybersecurity Directive
NIS2 significantly expands which organisations must meet EU cybersecurity requirements. Here's how essential vs important entities are classified, the minimum risk-management measures, and the incident reporting timeline.
Risk Management
ISO 31000: Why There's No Such Thing as "ISO 31000 Certified"
ISO 31000 provides risk management principles and a process, not a certifiable set of requirements. Here's how it's actually structured, and why it underpins standards like ISO 27001 and ISO 22301.
IT Governance
COBIT Explained: IT Governance Beyond Just Security
COBIT is broader than a security framework — it's ISACA's model for governing and managing enterprise IT. Here's how its governance/management split and domain structure actually work.
Financial Services
DORA Explained: What the EU's Digital Operational Resilience Act Requires
DORA governs ICT risk across the EU financial sector — and its reach extends to the tech vendors that serve financial institutions. Here's what it actually requires.
AI Governance
The EU AI Act Explained: A Risk-Based Guide for Businesses
The EU AI Act is the world's first comprehensive AI law — here's how its risk-tiered approach actually works, who it applies to, and what obligations follow from each risk category.
Information Security
CSA STAR: Cloud Security Certification Explained
How the Cloud Security Alliance's STAR program works — the Cloud Controls Matrix, the free public Level 1 self-assessment, and how Level 2 certification builds on ISO 27001 or SOC 2.
Health & Safety
ISO 45001 Occupational Health & Safety: What It Actually Requires
ISO 45001 is the international standard for workplace health and safety management — here's how it's structured, why worker participation is central to it, and how the hierarchy of controls works.
South African Compliance
B-BBEE Compliance: A Practical Guide to South Africa's BEE Scorecard
How the B-BBEE scorecard actually works — the five elements, priority elements and the discounting principle, EME/QSE/Generic thresholds, sector codes, and why your BEE level affects your customers' procurement too.
Information Security
NIST Cybersecurity Framework (CSF): A Practical Overview
What the NIST CSF actually is, its six functions (including Govern, added in CSF 2.0), the four implementation tiers, and how it differs from a certifiable standard like ISO 27001.
Business Continuity
Business Continuity Planning: ISO 22301 Explained
What ISO 22301 actually requires for a Business Continuity Management System — the Business Impact Analysis, continuity strategies, exercising plans, and how it fits alongside ISO 27001.
Quality Management
ISO 9001 Quality Management: What It Actually Requires
ISO 9001 isn't just for manufacturers — here's what a Quality Management System actually involves, the seven quality management principles, risk-based thinking, and the certification process.
Data Protection
Nigeria's NDPA vs South Africa's POPIA: Comparing Africa's Two Major Data Protection Laws
Nigeria's Data Protection Act 2023 and South Africa's POPIA are Africa's two most significant data protection regimes. Here's how they actually compare.
Vendor Risk Management
How to Run a Vendor Risk Assessment (With a Practical Template)
A step-by-step approach to assessing third-party vendor risk — how to tier vendors, what to actually ask, and a practical question template you can use today.
Healthcare Compliance
HIPAA Compliance for SaaS Vendors: What Business Associates Actually Need to Know
If your SaaS product touches patient health data on behalf of a healthcare customer, you're a HIPAA Business Associate. Here's what that actually obligates you to do.
Payment Security
PCI DSS Compliance: A Practical Guide for Businesses That Handle Card Payments
What PCI DSS actually requires, how merchant levels and SAQ types work, and the single biggest lever most businesses have for cutting their compliance scope down to size.
Data Protection
GDPR vs POPIA: Key Differences for Businesses Operating Across Africa and Europe
A side-by-side look at how the EU's GDPR and South Africa's POPIA differ — scope, lawful bases, regulators, fines, and what it means to comply with both at once.
Information Security
SOC 2 Type I vs Type II: What's the Difference, and Which Do You Need?
SOC 2 Type I and Type II are not two levels of the same thing — they answer different questions. Here's what each actually tests, and how to decide which one your business needs first.
Information Security
ISO 27001 Certification: A Step-by-Step Guide to the Process
What actually happens on the way to ISO/IEC 27001 certification — scoping your ISMS, risk assessment, the Statement of Applicability, and the two-stage external audit.
Data Protection
POPIA Compliance Checklist: A Practical Guide for South African Businesses
A practical walkthrough of what POPIA actually requires — the eight conditions for lawful processing, the Information Officer role, breach notification, and where most businesses actually fall short.
Ready to put this into practice?
131 frameworks, one system of record.