Notes on building compliance that does not pretend.
Not a newsletter. Not content marketing. Just what we learned along the way, and what someone should know earlier.
The DORA Article 30 addendum. 12 clauses you will sign as an ICT provider
Your bank sent a DORA contract addendum? We break Article 30 of Regulation 2022/2554 down into the 12 clauses you will find in it, and show what you can negotiate and what you need in place before you sign.
Read →Gap analysis for ISO 27001, DORA and NIS2. A free tool and how to get the most out of it.
We are releasing three free gap analysis tools: ISO 27001, DORA and NIS2. Fifteen minutes of questions, an instant score, and a report with the ten gaps worth tackling first.
Read →AI Act. Obligations, fines, and what your company needs to do.
About a regulation many firms still treat as science fiction. Penalties for prohibited practices have been enforceable since February 2025. For real, not someday.
Read →Risk analysis per ISO 27005. Step by step, without the spreadsheet horror.
Let's dig into the foundation of all security. Risk analysis sounds intimidating; it comes down to three questions: what can happen, how badly would it hurt, and what do we do about it.
Read →Business continuity (BCMS). Where to start with ISO 22301.
About something everyone only thinks about after an outage. A business continuity plan is not a thick binder; it is the answer to one question: what do we do when things go down.
Read →What DORA and NIS2 implementation actually costs. Honest numbers, no fluff.
The million-dollar question: what does it cost. Every consultant will say 'it depends' and run. We break down 'it depends' into concrete line items.
Read →ISO 27001 step by step. How long it takes, what it costs, where to start.
Let's demystify ISO 27001. Not a certificate for the wall; a system that actually has to work. And yes, it is manageable without panic.
Read →Records of Processing Activities (RoPA). How to build one and what it must contain.
Let's take a look at the document the Polish DPA checks first. A RoPA is not hard; it is just tedious when you do it by hand.
Read →Secure SDLC. Security built in, not bolted on.
About something that at many firms is stuck in the past: security tacked on at the end, right before the release. A Secure SDLC does the opposite; which is exactly why it works.
Read →Data processing agreement. Template, Art. 28, and the pitfalls.
About the document most firms sign blindly because the vendor sent their own version. And that is exactly where the most common GDPR gaps in the supply chain hide.
Read →DPIA step by step. When it is required and how to do one.
Half of firms do DPIAs on everything just in case, the other half never do them at all. Both groups have a problem; just a different one.
Read →NIS2 and the Polish Cybersecurity Act 2.0. Who it applies to and what actually needs to happen.
NIS2 is not just a topic for infrastructure operators. And that is exactly the trap most firms fall into.
Read →DORA step by step. Where to start and what you cannot skip.
DORA has been in force since January 2025, and half of firms are still treating it like three spreadsheets and a prayer. So let's go through what actually needs to happen.
Read →Why we built a separate RoPA register even though we already had ProcessingActivity
We had ProcessingActivity from Sprint D and RcpEntry from the main GDPR module. Two models, the same data, zero synchronization. After a year, we made a call.
Read →The Signal Engine is not a cron job. Here is why.
Most 'compliance engines' are a cron that checks a checklist once a day. Ours is not a cron. Here is why.
Read →The Polish DPA blacklist vs WP248. Two tests, not alternatives.
The M.P. 2019 item 666 catalogue and the 10 EDPB criteria are two independent tests. Not alternatives. Here is why clients keep mixing them up.
Read →