Tag
Fintech
10 articles
Compliance frameworks
SOC 2 vs SOC 1: which report your customers need
SOC 1 serves your customers' financial auditors. SOC 2 serves their security teams. How to tell which one a request is really for, and when you need both.
6 min read
Compliance frameworks
DORA vs NIS2: which applies to you
How to tell whether DORA, NIS2 or both apply to your organization, how the EU resolves the overlap for financial entities, and where ICT providers sit.
6 min read
Compliance frameworks
DORA contract requirements for ICT services
The clauses DORA Article 30 requires in every ICT services contract, the extra terms for critical or important functions, and what providers should negotiate.
7 min read
Trust and sales
Answering due diligence questionnaires
What a vendor due diligence questionnaire asks beyond security, who should own each section, and how to handle financials, continuity and signed attestations.
6 min read
Compliance frameworks
DORA resilience testing and TLPT
What DORA's testing program requires every year, which entities must run threat-led penetration tests, who may test, and what ICT providers must do.
6 min read
Compliance frameworks
DORA third-party risk and the register of information
How DORA's Articles 28 and 29 govern ICT third-party risk, what the register of information must hold, and how to assess, monitor and exit ICT providers.
6 min read
Compliance frameworks
DORA incident reporting
How DORA defines a major ICT-related incident, the classification criteria, the three reports owed to supervisors, and the runbook that meets each deadline.
6 min read
Compliance frameworks
SOC 2 processing integrity: who needs it and why
Which services should include processing integrity in a SOC 2, how its five criteria turn into controls on inputs, processing, and outputs, and what it costs.
6 min read
Compliance frameworks
The DORA ICT risk management framework
What Articles 5 to 16 of DORA require in an ICT risk management framework, who must own it, how often it is reviewed, and the evidence a supervisor expects.
7 min read
Compliance frameworks
DORA explained for ICT service providers
What DORA requires of EU financial entities, how those duties reach their ICT providers through contracts, registers and testing, and what to prepare first.
7 min read