Blog

Agentic AI Security: Threats and Controls for AI Agents That Take Action

Agentic AI security explained: the real threats to AI agents that call tools and touch data, plus the technical controls and audit evidence that stop them.

APRA CPS 234 Checklist: Requirements for Regulated Entities and Their Service Providers

A practical APRA CPS 234 checklist covering board duties, controls, testing and 72-hour notification, plus a vendor checklist for SaaS providers.

AWS Foundational Technical Review: FTR Checklist and Prep Guide for SaaS Teams

Prepare for the AWS Foundational Technical Review with a practical FTR checklist, common failure points and evidence you can reuse for SOC 2 and ISO 27001.

BSI C5 compliance checklist: how SaaS and cloud providers prepare for a C5 attestation

A practical BSI C5 compliance checklist for SaaS and cloud providers: Type 1 vs Type 2, criteria, disclosures and ISO 27001 reuse to reach attestation faster.

CRI Profile: A Practical Guide for Vendors Selling to US Banks

Learn what the CRI Profile is, how banks use it in vendor due diligence, and how fintech and SaaS vendors can map SOC 2 or ISO 27001 controls to answer it.

Cyber Essentials vs Essential Eight: UK and Australian Cyber Baselines Compared

Cyber Essentials vs Essential Eight compared for SMBs and SaaS vendors selling in the UK and Australia: scope, assessment, control overlap and how to run both.

NZISM Explained: The New Zealand Information Security Manual for Cloud and SaaS Providers

Learn what the NZISM requires, how it works with the PSR, and how SaaS and cloud providers can prepare to sell to New Zealand government and health agencies.

Shopify PCI Compliance: What Merchants Still Own Under PCI DSS

Shopify PCI compliance explained: what Shopify covers, which SAQ your store likely needs, and a practical checklist to keep your own PCI DSS scope small.

SOCI Act CIRMP Guide: Obligations for Responsible Entities and Their Suppliers

Learn what the SOCI Act CIRMP requires, how its four hazard domains and cyber frameworks work, and the evidence suppliers to critical infrastructure need.

After SOC 2: The Compliance Roadmap for HealthTech Companies

Finished SOC 2? What HealthTech companies should tackle next: HIPAA, BAAs, HITRUST and ISO 27001, in the order buyers ask, reusing your existing controls.