GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

Cyber Essentials Plus: what the hands-on assessment actually tests
EU & UK

Cyber Essentials Plus: what the hands-on assessment actually tests

The self-assessed version relies on your answers. Plus sends an assessor to verify them technically. What is tested, where organisations fail, and whether the step up is worth it.
AI incident response: when the model is the problem
AI & Automation

AI incident response: when the model is the problem

Traditional incident response assumes an attacker. AI incidents often have none - the system worked as built and produced harm anyway. What that changes about detection, containment and disclosure.
Secure release checklist: gates worth having in the pipeline
Checklists

Secure release checklist: gates worth having in the pipeline

Security checks that run before a release only work if they are automated, fast and rarely wrong. Which gates earn their place, which belong earlier, and what to check before a significant deployment.
Pre-audit evidence checklist: what to assemble before fieldwork
Checklists

Pre-audit evidence checklist: what to assemble before fieldwork

Audits go badly when evidence is assembled during them. What to gather in advance, what cannot be produced late, and the dry run that finds gaps while you can still fix them.
Supplier security schedule template: the clauses worth negotiating
Templates

Supplier security schedule template: the clauses worth negotiating

Every security requirement is negotiable before signature and almost none afterwards. The clauses that get used in anger, the ones vendors concede easily, and how to handle a refusal.
ISAE 3402, ISAE 3000 and SOC reports compared
Comparisons

ISAE 3402, ISAE 3000 and SOC reports compared

European and international customers frequently ask for ISAE reports where US customers ask for SOC. What each covers, how they relate, and whether you need more than one.
CJIS Security Policy: what contractors handling criminal justice data must do
US & Americas

CJIS Security Policy: what contractors handling criminal justice data must do

Any organisation touching criminal justice information inherits a prescriptive control set, personnel screening obligations and audit exposure - usually through a contract with an agency.
Pharma and life sciences: where cybersecurity meets validated systems
Sectors

Pharma and life sciences: where cybersecurity meets validated systems

Systems that affect product quality or patient safety are validated, and validation constrains how you patch, change and secure them. How security and GxP obligations coexist without either being ignored.
eIDAS and the EU Digital Identity Wallet: what it means for relying parties
EU & UK

eIDAS and the EU Digital Identity Wallet: what it means for relying parties

A European framework for digital identity and trust services, moving toward a wallet citizens control. What changes for organisations that verify identity or accept electronic signatures.
Governing AI agents: autonomy is a control decision, not a feature
AI & Automation

Governing AI agents: autonomy is a control decision, not a feature

An agent that can act rather than answer changes the risk entirely. How to decide what an agent may do unsupervised, contain the blast radius, and keep accountability with a person.
SaaS approval checklist: a review fast enough that people use it
Checklists

SaaS approval checklist: a review fast enough that people use it

If approving a tool takes six weeks, teams stop asking. A tiered checklist that clears low-risk tools in a day and reserves real scrutiny for the ones that matter.
Data retention schedule template
Templates

Data retention schedule template

A retention policy nobody can implement is worse than none. The columns a schedule needs to actually execute, how to set periods defensibly, and the trigger definition that decides whether it works.
© 2026 GRCOPILOT