Practical articles on ISMS, ISO 27001, TISAX, NIS2, GDPR, risk management and GRC implementation – from the deveca editorial team.
Mid-market rollouts rarely fail on the licence. They fail when someone asks for bonus clauses or salary agreements and Copilot answers, because the shares were already too wide.
ISO 31000, the AktG and KonTraG sound like a pile of duties. Day to day the questions are simple: which risks do we know, who owns them, are we inside appetite, and what must management see?
SOC 2 is not a certification. It is an examination report. Here is the difference between SOC 1, 2 and 3, Type 1 versus Type 2, and how a service provider becomes audit-ready.
The Cyber Resilience Act sounds like 2027. It is not: the first fine-backed reporting duty starts in September 2026. Here is the timeline and a practical checklist.
Only about two thirds of in-scope organisations were registered with the BSI by the end of May. The BSI is now applying a practical grace period until the end of July.
GRC in practice
See how deveca supports your ISMS and compliance programme.