Field notes
Operational field notes on ISO, cybersecurity, and privacy — each article is paired with a separate interactive checklist. Use the article for context; use the checklist to execute.
Filter by framework family. Each note links to its interactive checklist.
Information Security · ISO Standards
How to prepare an ISMS for ISO 27001:2022 certification in 2026 — scope, SoA, internal audit, and what registrars sample in Stage 2.
6 min read · Checklist →
Trust Services · Cybersecurity & Cloud
A practical guide to SOC 2 Type II — Trust Services Criteria, Type I vs Type II, and how to collect evidence over the observation period.
6 min read · Checklist →
Privacy Regulation · Data Privacy & Law
How web and SaaS teams operationalize GDPR — ROPA, consent UX, subprocessors, and transfers — without treating the privacy policy as the program.
6 min read · Checklist →
Healthcare Privacy · Data Privacy & Law
How HealthTech teams run a Security Rule program — risk analysis, safeguards, BAAs, and what OCR and customers actually ask for.
6 min read · Checklist →
Quality Management · ISO Standards
How to stand up a quality management system that matches how work actually happens — not a shelf manual — before an ISO 9001 Stage 2 audit.
6 min read · Checklist →
Payments · Cybersecurity & Cloud
How payment teams prepare for PCI DSS v4.0.1 — cardholder data environment, SAQ vs ROC, and what QSAs sample after the 2025 future-dated requirements.
6 min read · Checklist →
NIST CSF · Cybersecurity & Cloud
A 2026 guide to NIST Cybersecurity Framework 2.0 — the new Govern function, current vs target profiles, and how CSF sits next to ISO 27001 and SOC 2.
6 min read · Checklist →
CMMC · Cybersecurity & Cloud
How defense contractors prepare for CMMC Level 2 — CUI scoping, SPRS scores, and the gap between a self-attestation spreadsheet and a C3PAO assessment.
6 min read · Checklist →
NIST 800-53 · Cybersecurity & Cloud
How to implement NIST 800-53 Rev 5 at the Moderate baseline — selecting families, documenting overlays, and producing assessable evidence.
6 min read · Checklist →
CIS Controls · Cybersecurity & Cloud
A practical 2026 guide to CIS Controls Version 8 — Implementation Groups, Safeguards that actually reduce ransomware risk, and how CIS maps to SOC 2.
6 min read · Checklist →
FedRAMP · Cybersecurity & Cloud
What Cloud Service Providers actually do for FedRAMP Moderate — boundary, inheritance, continuous monitoring, and why a Type II report is not an ATO.
6 min read · Checklist →
PIMS · ISO Standards
How privacy teams add ISO/IEC 27701 to an existing ISO 27001 ISMS — PII roles, processors vs controllers, and what certification audits sample.
6 min read · Checklist →
Continuity · ISO Standards
How to build an ISO 22301:2019 business continuity management system — business impact analysis, strategies, tests, and certification sampling.
6 min read · Checklist →
Environment · ISO Standards
How operations and EHS teams stand up ISO 14001:2015 — environmental aspects, legal registers, and what Stage 2 auditors sample on site.
6 min read · Checklist →
OH&S · ISO Standards
How to implement ISO 45001:2018 — participation, risk, contractors, and the difference between a safety binder and an occupational health and safety MS.
6 min read · Checklist →
AI Governance · ISO Standards
How to implement ISO 42001:2023 — AI system inventory, risk, data, and what certification audits look for next to the EU AI Act.
6 min read · Checklist →
Cloud ISO · ISO Standards
How CSPs and cloud customers use ISO 27017 — shared responsibility, virtualization, and how it extends ISO 27001 for cloud services.
6 min read · Checklist →
Cloud Privacy · ISO Standards
What ISO 27018 covers for public-cloud PII processors — customer control of data, return/deletion, and how it differs from ISO 27701.
6 min read · Checklist →
ITSM · ISO Standards
How to prepare an ISO 20000-1:2018 service management system — service catalog, SLAs, and what auditors sample beyond ticket queues.
6 min read · Checklist →
MedTech QMS · ISO Standards
How MedTech teams implement ISO 13485:2016 — design and development, suppliers, and the records auditors and regulators expect.
6 min read · Checklist →
Anti-Bribery · ISO Standards
How to implement ISO 37001:2016 — due diligence, gifts, third parties, and what certification audits test in high-risk markets.
6 min read · Checklist →
Risk · ISO Standards
How to apply ISO 31000:2018 — principles, framework, and process — so risk registers drive decisions instead of decorating a board pack.
6 min read · Checklist →
Energy · ISO Standards
How facilities and operations implement ISO 50001:2018 — energy review, SEUs, baselines, and certification sampling in offices and industry.
6 min read · Checklist →
Automotive · ISO Standards
How automotive suppliers prepare for IATF 16949:2016 — core tools, customer-specific requirements, and what CB auditors sample on the line.
6 min read · Checklist →
California Privacy · Data Privacy & Law
How US-facing businesses operationalize California consumer privacy — notices, requests, service providers, and what CPRA added beyond CCPA.
6 min read · Checklist →
NIS2 · Data Privacy & Law
How in-scope entities prepare for the EU NIS2 Directive — management accountability, cybersecurity measures, and incident notification clocks.
6 min read · Checklist →
DORA · Data Privacy & Law
How financial entities operationalize the Digital Operational Resilience Act — ICT risk management, incident reporting, testing, and third-party registers.
6 min read · Checklist →
EU AI Act · Data Privacy & Law
A practical guide to EU AI Act readiness — role classification, high-risk obligations, GPAI documentation, and how it sits next to ISO 42001.
6 min read · Checklist →
Cookies · Data Privacy & Law
How websites implement cookie and tracking consent that survives EU ePrivacy practice — banners, GPC, and what still goes wrong with analytics.
6 min read · Checklist →
DPIA · Data Privacy & Law
How to run a Data Protection Impact Assessment under GDPR — screening, consultation, residual risk, and when to talk to a supervisory authority.
6 min read · Checklist →
UK GDPR · Data Privacy & Law
How to run a UK data-protection program in 2026 — UK GDPR, PECR, transfers, and where EU GDPR copy-paste still fails.
6 min read · Checklist →
LGPD · Data Privacy & Law
How companies with Brazilian users operationalize LGPD — agents, rights, incidents, and ANPD expectations versus GDPR muscle memory.
6 min read · Checklist →
HITRUST · Cybersecurity & Cloud
How to prepare a HITRUST CSF assessment — scoping, control inheritance, and the difference between a self-assessment and a certified report.
6 min read · Checklist →
TISAX · Cybersecurity & Cloud
How automotive suppliers prepare for TISAX — assessment levels, prototype protection, and the ENX portal labels customers look up.
6 min read · Checklist →
SOC 1 · Cybersecurity & Cloud
How finance-adjacent processors prepare for SOC 1 Type II — control objectives, observation windows, and complementary user entity controls.
6 min read · Checklist →
Cyber Essentials · Cybersecurity & Cloud
How UK organizations prepare for Cyber Essentials Plus — scope, technical verification, and the difference from the questionnaire-only scheme.
6 min read · Checklist →
Incident Response · Cybersecurity & Cloud
How to build an operational IR program — roles, playbooks, evidence, and notification duties that span GDPR, NIS2, and customer contracts.
6 min read · Checklist →
TPRM · Cybersecurity & Cloud
How to run TPRM that scales — tiering, questionnaires vs evidence, fourth parties, and what SOC 2 and ISO actually tell you about a vendor.
6 min read · Checklist →
DR / Backup · Cybersecurity & Cloud
How to build DR that survives ransomware — immutability, RTO/RPO honesty, and why a snapshot in the same account is not a strategy.
6 min read · Checklist →
AppSec · Cybersecurity & Cloud
How engineering teams use OWASP ASVS — L1 to L3, mapping to sprint work, and what “verified” means versus a one-week pentest.
6 min read · Checklist →
Cloud Security · Cybersecurity & Cloud
How to make AWS, Azure, and GCP shared-responsibility real — identity, data, config, and what customer questionnaires get wrong.
6 min read · Checklist →
PAM · Cybersecurity & Cloud
How to implement PAM — vaulting, just-in-time, cloud admin, and the evidence SOC 2 and ISO auditors actually sample.
6 min read · Checklist →
Vuln Mgmt · Cybersecurity & Cloud
How to run vuln management that reduces risk — coverage, exception process, and why a monthly Qualys PDF is not a program.
6 min read · Checklist →
Pentest · Cybersecurity & Cloud
How to buy and survive a pentest — scope, credentials, environments, and how to use findings without treating the report as a certificate.
6 min read · Checklist →
SOX ITGC · Cybersecurity & Cloud
How public-company IT runs IT general controls for SOX — in-scope systems, IPE, and the three control families that still cause deficiencies.
6 min read · Checklist →
GLBA · Data Privacy & Law
How financial institutions under the FTC Safeguards Rule build a written program — Qualified Individual, risk assessment, encryption, and 2023+ expectations.
6 min read · Checklist →
COPPA · Data Privacy & Law
How online services handle children’s privacy under COPPA — actual knowledge, notice, consent, and what “directed to children” still means in product design.
6 min read · Checklist →
Accessibility · Data Privacy & Law
How product teams audit toward WCAG 2.2 Level AA — new success criteria, testing, and the legal/procurement reality in the US and EU.
6 min read · Checklist →
PIPEDA · Data Privacy & Law
How organizations with Canadian personal information run a PIPEDA program — ten principles, consent, and what still differs from GDPR.
6 min read · Checklist →
PDPA · Data Privacy & Law
How organizations operationalize Singapore’s PDPA — obligations, DNC, data breaches, and where GDPR templates mislead.
6 min read · Checklist →
Retention · Data Privacy & Law
How to build a retention schedule that is operational — legal hold, backup lag, and deletion that GDPR and customer DPAs can test.
6 min read · Checklist →
ROPA · Data Privacy & Law
How to keep Records of Processing Activities that match the product — systems, recipients, transfers, and what supervisory authorities sample.
6 min read · Checklist →
Transfers · Data Privacy & Law
How to run a transfer program — mapping flows, SCCs/IDTA, Transfer Impact Assessments, and supplementary measures that are not theatre.
6 min read · Checklist →
Zero Trust · Cybersecurity & Cloud
How to implement zero trust architecture as a program — PEP/PDP thinking, least privilege, and what NIST SP 800-207 actually asks for.
6 min read · Checklist →
Kubernetes · Cybersecurity & Cloud
How platform teams harden Kubernetes and containers — CIS benchmarks, admission, secrets, and what auditors sample in cloud-native shops.
6 min read · Checklist →