Practical articles on ISMS, ISO 27001, TISAX, NIS2, GDPR, risk management and GRC implementation – from the deveca editorial team.
ISO 31000, the AktG and KonTraG sound like a pile of duties. Day to day the questions are simple: which risks do we know, who owns them, are we inside appetite, and what must management see?
SOC 2 is not a certification. It is an examination report. Here is the difference between SOC 1, 2 and 3, Type 1 versus Type 2, and how a service provider becomes audit-ready.
The Cyber Resilience Act sounds like 2027. It is not: the first fine-backed reporting duty starts in September 2026. Here is the timeline and a practical checklist.
Only about two thirds of in-scope organisations were registered with the BSI by the end of May. The BSI is now applying a practical grace period until the end of July.
GRC in practice
See how deveca supports your ISMS and compliance programme.