GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

All AI & Automation 13 Audit 20 Australia & APAC 15 Buyer Guides 16 Checklists 16 Comparisons 19 EU & UK 16 Frameworks 20 GRC Fundamentals 21 Guides 26 Saudi & GCC 19 Sectors 16 Security Practices 33 Templates 13 US & Americas 15

GDPR security controls: what Article 32 actually requires

GDPR security controls: what Article 32 actually requires

GDPR names only four measures and then hands you a risk test. What appropriate technical and organisational measures mean in practice, the controls regulators look for, and the evidence that survives a breach investigation.

How to prepare for NIS2 in 30 days: a week-by-week plan

How to prepare for NIS2 in 30 days: a week-by-week plan

A realistic four-week sprint for entities that have just discovered they are in scope: determine status and register, close the reporting gap, get board approval on record, then evidence the ten measures.

Cyber Essentials Plus: what the hands-on assessment actually tests

Cyber Essentials Plus: what the hands-on assessment actually tests

The self-assessed version relies on your answers. Plus sends an assessor to verify them technically. What is tested, where organisations fail, and whether the step up is worth it.

eIDAS and the EU Digital Identity Wallet: what it means for relying parties

eIDAS and the EU Digital Identity Wallet: what it means for relying parties

A European framework for digital identity and trust services, moving toward a wallet citizens control. What changes for organisations that verify identity or accept electronic signatures.

The UK Telecommunications (Security) Act: duties for network and service providers

The UK Telecommunications (Security) Act: duties for network and service providers

A specific, enforceable security regime for UK public telecoms providers, with a code of practice, tiered expectations and Ofcom enforcement. Who it binds and what it requires.

EU AI Act: working out whether your system is high-risk

EU AI Act: working out whether your system is high-risk

Classification decides almost everything about your obligations, and the decision is harder than the tiers suggest. How the categories work, the provider and deployer split, and what high-risk classification actually commits you to.

TIBER-EU and threat-led penetration testing: what advanced testing actually involves

TIBER-EU and threat-led penetration testing: what advanced testing actually involves

Not a bigger penetration test. A controlled, intelligence-led red team exercise against live production systems, run under regulator oversight, testing whether your defenders detect and respond.

NIS2 national transpositions: why one directive means many rulebooks

NIS2 national transpositions: why one directive means many rulebooks

A directive is transposed into national law, and member states differ on scope, registration, reporting channels and penalties. What that means for organisations operating in several EU countries.

PSD2 and strong customer authentication: the rules behind payment friction

PSD2 and strong customer authentication: the rules behind payment friction

Two-factor authentication for payments, with a long list of exemptions that determine whether your customers see friction. What SCA requires, when it does not apply, and where implementations go wrong.

The EU Data Act: what it means if you make connected products or sell cloud services

The EU Data Act: what it means if you make connected products or sell cloud services

Users get rights over the data their connected products generate, and cloud providers face switching obligations. Two very different compliance problems in one regulation - and both are engineering work, not policy.

UK data protection: what differs from EU GDPR, and what the ICO actually enforces

UK data protection: what differs from EU GDPR, and what the ICO actually enforces

UK GDPR and EU GDPR are close but not identical, and organisations serving both need to comply with two regimes at once. The real divergences, the transfer mechanics, and where enforcement actually lands.

EU Cyber Resilience Act: security obligations that ship with the product

EU Cyber Resilience Act: security obligations that ship with the product

The CRA regulates products with digital elements sold in the EU - imposing secure development, vulnerability handling and support-period obligations on manufacturers. What changes, and who is affected.

EU AI Act: risk tiers, roles and what to do now

EU AI Act: risk tiers, roles and what to do now

The EU AI Act regulates AI by risk level rather than by technology. How the tiers work, the difference between providers and deployers, and the preparation that is useful regardless of your final classification.

Cyber Essentials and Cyber Essentials Plus: the fastest credential to earn

Cyber Essentials and Cyber Essentials Plus: the fastest credential to earn

The UK government-backed baseline covering five technical controls. What it requires, how Plus differs, why it is often a contract prerequisite, and where it stops short of ISO 27001.

DORA compliance: operational resilience for EU financial entities

DORA compliance: operational resilience for EU financial entities

The Digital Operational Resilience Act sets binding ICT risk requirements for EU financial entities and their technology providers - covering governance, incident reporting, resilience testing and third-party oversight.

NIS2 Directive: who it covers and what it demands

NIS2 Directive: who it covers and what it demands

The EU NIS2 Directive widens cybersecurity obligations across sectors, adds strict incident reporting deadlines, and makes management personally accountable. What it requires and how to prepare.