GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

NIST CSF 2.0 explained: six functions, and why Govern was added
Frameworks

NIST CSF 2.0 explained: six functions, and why Govern was added

The framework everyone quotes gained a sixth function and dropped "critical infrastructure" from its title. What Govern requires, how Tiers and Profiles actually work, and when CSF is the wrong choice.
ISO 27001 Annex A: the 93 controls, and what actually changed in 2022
Frameworks

ISO 27001 Annex A: the 93 controls, and what actually changed in 2022

Four themes instead of fourteen domains, 93 controls instead of 114, and eleven genuinely new ones. What the restructure means for your Statement of Applicability and where the new controls bite.
Securing LLM applications: prompt injection is an architecture problem
AI & Automation

Securing LLM applications: prompt injection is an architecture problem

You cannot filter your way out of prompt injection, because the model cannot reliably separate instructions from data. What that means for retrieval, tool use and agents - and the controls that actually hold.
Business continuity plan template: what goes in it, and what to leave out
Templates

Business continuity plan template: what goes in it, and what to leave out

A 200-page continuity plan nobody opens during a crisis is worse than four pages people can act on. The sections that earn their place, and the ones that exist only to satisfy a reviewer.
Cloud migration security checklist: the decisions that are expensive to reverse
Checklists

Cloud migration security checklist: the decisions that are expensive to reverse

Most cloud security problems are migration decisions that were never revisited - account structure, identity, logging, residency. A phased checklist covering what to settle before, during and after the move.
UK data protection: what differs from EU GDPR, and what the ICO actually enforces
EU & UK

UK data protection: what differs from EU GDPR, and what the ICO actually enforces

UK GDPR and EU GDPR are close but not identical, and organisations serving both need to comply with two regimes at once. The real divergences, the transfer mechanics, and where enforcement actually lands.
SEC cyber disclosure: the four-day clock starts at materiality, not detection
US & Americas

SEC cyber disclosure: the four-day clock starts at materiality, not detection

Public companies must disclose material cybersecurity incidents on a tight timeline and describe their governance annually. The subtlety everyone misses is when the clock starts - and who decides.
Energy and utilities: where a security control can be a safety hazard
Sectors

Energy and utilities: where a security control can be a safety hazard

Critical national infrastructure carries the heaviest regulatory load and the least tolerance for downtime. Why IT security practice transplanted into operational technology fails, and what replaces it.
Retail and e-commerce compliance: payment scope, skimming and the peak-season freeze
Sectors

Retail and e-commerce compliance: payment scope, skimming and the peak-season freeze

Card data drives the obligations, client-side scripts drive the breaches, and the change freeze that protects trading also blocks patching. What retail security programmes have to solve that others do not.
CMMC: what defence suppliers actually have to do
US & Americas

CMMC: what defence suppliers actually have to do

Self-attestation is being replaced by assessed certification, and it is a condition of award rather than a nice-to-have. The levels, the NIST 800-171 relationship, and why scoping CUI is the whole game.
Security in procurement: the leverage you only have before signing
Guides

Security in procurement: the leverage you only have before signing

Every security requirement is negotiable before the contract is signed and almost none afterwards. What belongs in a security schedule, which clauses actually get used, and how to stop procurement routing around you.
M&A cyber due diligence: you are buying their breaches too
Guides

M&A cyber due diligence: you are buying their breaches too

Acquisitions inherit undisclosed incidents, unpatched estates and regulatory exposure - and integration is when it detonates. What to ask before signing, and how to handle the first 100 days after.
© 2026 GRCOPILOT