https://grcide.com/library Working methods and regulatory briefings for security governance, risk and compliance practitioners. en Mon, 07 Sep 2026 00:00:00 +0000 https://grcide.com/insights/security-ai-high-risk-changes-state https://grcide.com/insights/security-ai-high-risk-changes-state Mon, 07 Sep 2026 00:00:00 +0000 An article reading China's AI guidance for banks and insurers puts the grading line at whether a security system can act, not at whether it touches money. https://grcide.com/insights/ai-act-article-5-december https://grcide.com/insights/ai-act-article-5-december Sun, 06 Sep 2026 00:00:00 +0000 The prohibited-practice list reads as a product problem. A security function's own tooling touches three of its points, and two more start in December. https://grcide.com/insights/ai-bom-is-the-next-sbom https://grcide.com/insights/ai-bom-is-the-next-sbom Sun, 06 Sep 2026 00:00:00 +0000 Three articles in one issue argue that the supply chain is now four chains. The bill of materials that stops at code no longer describes what ships. https://grcide.com/engagement-patterns/cra-readiness https://grcide.com/engagement-patterns/cra-readiness Sun, 06 Sep 2026 00:00:00 +0000 Getting a manufacturer ready for the CRA: class, route, vulnerability handling, support period, the technical file, and a rehearsed reporting clock. governance https://grcide.com/briefings/cra-supply-chain-components https://grcide.com/briefings/cra-supply-chain-components Sun, 06 Sep 2026 00:00:00 +0000 Component due diligence under Article 13(5), the upstream vulnerability duty, open-source stewards, and the questions a component supplier has to answer. risk https://grcide.com/insights/multi-agent-governance-is-the-connection https://grcide.com/insights/multi-agent-governance-is-the-connection Sun, 06 Sep 2026 00:00:00 +0000 An Australian government report moves the governance object from the single agent to the relationship between them. The stop-point sits where control ends. https://grcide.com/briefings/remote-auditing-iso-19011-2026 https://grcide.com/briefings/remote-auditing-iso-19011-2026 Sun, 06 Sep 2026 00:00:00 +0000 What the 2026 edition changed about remote auditing, and what the auditee decides: method, virtual locations, evidence over a channel, the agreement. compliance https://grcide.com/digest/2026-09 https://grcide.com/digest/2026-09 Sat, 05 Sep 2026 00:00:00 +0000 Twenty-eight entries joined the radar this month: guidance, codes, national acts, catalogue moves and seven dated privacy instruments beyond the EU. https://grcide.com/insights/agent-governance-is-a-permissions-problem https://grcide.com/insights/agent-governance-is-a-permissions-problem Sat, 05 Sep 2026 00:00:00 +0000 Singapore's advisory on the OpenClaw agent platform moves AI risk from what a model says to what an agent can do. The controls it lists are identity controls. https://grcide.com/insights/agent-permissions-review https://grcide.com/insights/agent-permissions-review Sat, 05 Sep 2026 00:00:00 +0000 An agent reaches production on its installer's identity, holding every tool that person held. This is the review that should have run first. https://grcide.com/briefings/ai-oversight-and-logging-evidence https://grcide.com/briefings/ai-oversight-and-logging-evidence Sat, 05 Sep 2026 00:00:00 +0000 Article 14 oversight and Article 12 logging as one evidence design: who oversees, what they may do, what the logs allow, and how long they are kept. compliance https://grcide.com/templates/ai-system-register https://grcide.com/templates/ai-system-register Sat, 05 Sep 2026 00:00:00 +0000 A three-sheet register: every AI system with its two roles and its owner, one impact assessment per system, and the Annex A statement of applicability. compliance https://grcide.com/templates/ai-use-case-triage https://grcide.com/templates/ai-use-case-triage Sat, 05 Sep 2026 00:00:00 +0000 A twenty-two column form that runs the AI Act decision test over one AI use case per row and closes each row with proceed, conditions or stop. compliance https://grcide.com/playbooks/bcm-under-iso-22301 https://grcide.com/playbooks/bcm-under-iso-22301 Sat, 05 Sep 2026 00:00:00 +0000 Turning a continuity document into a management system: impact analysis, disruption risk, costed strategies, exercised plans and evaluation evidence. risk https://grcide.com/playbooks/biso-operating-model https://grcide.com/playbooks/biso-operating-model Sat, 05 Sep 2026 00:00:00 +0000 A method for designing the business information security officer role: mandate, decision rights, placement, operating rhythm, interfaces, measures and pitfalls. governance https://grcide.com/playbooks/board-reporting-for-security https://grcide.com/playbooks/board-reporting-for-security Sat, 05 Sep 2026 00:00:00 +0000 A method for putting security in front of a board and getting a decision: five to seven risks, measured controls, and an outcome that is written down. governance https://grcide.com/reference/china-eu-regulatory-bridge https://grcide.com/reference/china-eu-regulatory-bridge Sat, 05 Sep 2026 00:00:00 +0000 Which Chinese instrument answers which EU instrument for vehicles and for personal data, where the two only partly meet, and where no counterpart exists. compliance https://grcide.com/templates/control-catalogue https://grcide.com/templates/control-catalogue Sat, 05 Sep 2026 00:00:00 +0000 A sixteen-column register of the controls that actually run: owner, evidence producer, approver, reference controls served, evidence record and last test. governance https://grcide.com/playbooks/control-ownership-and-the-control-catalogue https://grcide.com/playbooks/control-ownership-and-the-control-catalogue Sat, 05 Sep 2026 00:00:00 +0000 A method for building one list of the controls that actually run, each with an owner, an evidence record and a test result, mapped to the frameworks they serve. governance https://grcide.com/templates/control-test-workpaper https://grcide.com/templates/control-test-workpaper Sat, 05 Sep 2026 00:00:00 +0000 A twenty-one-column record of one control test: the population, its completeness check, the sample, the procedure, the evidence and a conclusion two roles sign. compliance https://grcide.com/playbooks/control-testing-and-itgc https://grcide.com/playbooks/control-testing-and-itgc Sat, 05 Sep 2026 00:00:00 +0000 A method for proving controls operated over a period: the ITGC map, complete populations, risk-based samples, workpapers a second person can re-perform. compliance https://grcide.com/playbooks/cra-conformity-route https://grcide.com/playbooks/cra-conformity-route Sat, 05 Sep 2026 00:00:00 +0000 Which Article 32 procedure applies to each product, who signs the declaration, and what the chosen route must produce before 11 December 2027. governance https://grcide.com/briefings/cra-support-period-decision https://grcide.com/briefings/cra-support-period-decision Sat, 05 Sep 2026 00:00:00 +0000 How a CRA support period is set, evidenced, published and closed: the Article 13(8) criteria, the duties that run over it, and who owns each. governance https://grcide.com/playbooks/cra-technical-documentation https://grcide.com/playbooks/cra-technical-documentation Sat, 05 Sep 2026 00:00:00 +0000 Assembling the Annex VII file, keeping it current for the retention period, and getting a declaration signed by a role that has read it. compliance https://grcide.com/templates/cra-technical-documentation-index https://grcide.com/templates/cra-technical-documentation-index Sat, 05 Sep 2026 00:00:00 +0000 Four sheets that map the Annex VII file: one row per element per product, the declaration's Annex V items, and a retention schedule with derived end dates. compliance https://grcide.com/playbooks/cra-vulnerability-handling-and-sbom https://grcide.com/playbooks/cra-vulnerability-handling-and-sbom Sat, 05 Sep 2026 00:00:00 +0000 Annex I Part II run as a process: the bill of materials, component due diligence, intake, triage, the security update, disclosure and the Article 14 record. risk https://grcide.com/insights/cra-what-to-do-first https://grcide.com/insights/cra-what-to-do-first Sat, 05 Sep 2026 00:00:00 +0000 Article 14 starts in September 2026 and the essential requirements in December 2027. The first quarter is three decisions, not a compliance programme. https://grcide.com/briefings/cyber-resilience-beyond-continuity https://grcide.com/briefings/cyber-resilience-beyond-continuity Sat, 05 Sep 2026 00:00:00 +0000 What NIS2, DORA and the CER Directive each ask of resilience, the objectives that come before plans, and the exercise a policy cannot replace. risk https://grcide.com/playbooks/dora-implementation https://grcide.com/playbooks/dora-implementation Sat, 05 Sep 2026 00:00:00 +0000 A method for turning DORA into a running programme: scope, framework, incidents, testing, third-party risk, and the register of information built last. compliance https://grcide.com/briefings/eu-ai-act-for-security-governance https://grcide.com/briefings/eu-ai-act-for-security-governance Sat, 05 Sep 2026 00:00:00 +0000 The AI Act as consolidated on 27 July 2026: the scope test, obligations by article, the split high-risk timetable, and what security owns. compliance https://grcide.com/templates/findings-to-closure-tracker https://grcide.com/templates/findings-to-closure-tracker Sat, 05 Sep 2026 00:00:00 +0000 A sixteen-column register that carries every external audit finding from the auditor's wording to a verification date, with correction and cause kept apart. compliance https://grcide.com/playbooks/first-90-days-as-a-security-leader https://grcide.com/playbooks/first-90-days-as-a-security-leader Sat, 05 Sep 2026 00:00:00 +0000 A ninety-day method: inventory the mandate, the obligations and the risk picture, decide appetite and operating model, then take one decision to the board. governance https://grcide.com/briefings/governing-ai-and-agents-decision-rights https://grcide.com/briefings/governing-ai-and-agents-decision-rights Sat, 05 Sep 2026 00:00:00 +0000 AI governance as a table of decision rights: the three objects, a five-question test, who decides what an agent may do, and the evidence each decision leaves. governance https://grcide.com/engagement-patterns/governing-security-in-the-product-organisation https://grcide.com/engagement-patterns/governing-security-in-the-product-organisation Sat, 05 Sep 2026 00:00:00 +0000 Where product security decisions are actually taken: the decision rights, the risk assessment they run on, and the conformity evidence they leave behind. governance https://grcide.com/reference/grc-automation-patterns https://grcide.com/reference/grc-automation-patterns Sat, 05 Sep 2026 00:00:00 +0000 Seven patterns for automating compliance work, each with the evidence it produces, the place it breaks, and the requirement it actually serves. compliance https://grcide.com/briefings/iec-62443-for-governance-people https://grcide.com/briefings/iec-62443-for-governance-people Sat, 05 Sep 2026 00:00:00 +0000 IEC 62443 as a system of roles and decisions: which part binds which role, the concepts a governance reader must own, and where the series gets misread. governance https://grcide.com/playbooks/incident-governance https://grcide.com/playbooks/incident-governance Sat, 05 Sep 2026 00:00:00 +0000 A method for governing incidents end to end: declaration, decision records, the reporting clock across four regimes, and corrective action verified closed. governance https://grcide.com/playbooks/iso-42001-ai-management-system https://grcide.com/playbooks/iso-42001-ai-management-system Sat, 05 Sep 2026 00:00:00 +0000 Adding ISO/IEC 42001 to an existing ISMS as one system: scope and roles, the AI policy, AI risk, the impact assessment, Annex A and the certification route. compliance https://grcide.com/reference/iso27001-to-soc2 https://grcide.com/reference/iso27001-to-soc2 Sat, 05 Sep 2026 00:00:00 +0000 One control set can serve both, but a certificate and an attestation report differ in object, criteria, examiner, output and period. compliance https://grcide.com/reference/key-risk-indicators https://grcide.com/reference/key-risk-indicators Sat, 05 Sep 2026 00:00:00 +0000 Leading indicators for eleven common security risks, each with the source of the number, the threshold, the role that acts, and where the indicator misleads. risk https://grcide.com/templates/one-page-risk-picture https://grcide.com/templates/one-page-risk-picture Sat, 05 Sep 2026 00:00:00 +0000 A one-page board view of five to seven risks, each with an owner role, a position against appetite, a trend and the decision the body is asked to take. governance https://grcide.com/templates/one-page-security-strategy https://grcide.com/templates/one-page-security-strategy Sat, 05 Sep 2026 00:00:00 +0000 One approvable page: five to seven security objectives, each tied to a business objective and a risk, with a measure, a baseline, a target and an owner role. governance https://grcide.com/insights/open-source-risk-is-a-maintainer-problem https://grcide.com/insights/open-source-risk-is-a-maintainer-problem Sat, 05 Sep 2026 00:00:00 +0000 A Chinese-language piece argues that open-source risk lives in maintainers and funding, not in CVE queues. We agree, and add the control it implies. https://grcide.com/playbooks/policy-architecture https://grcide.com/playbooks/policy-architecture Sat, 05 Sep 2026 00:00:00 +0000 A method for turning a pile of documents into a tiered policy set with owners, review dates and exceptions, so a reader can find the rule that applies. governance https://grcide.com/templates/policy-map https://grcide.com/templates/policy-map Sat, 05 Sep 2026 00:00:00 +0000 A fourteen-column register of the policy set: tier, owner, approver, audience, the requirement that put each document there, and its next review date. governance https://grcide.com/playbooks/product-csms-as-a-management-system https://grcide.com/playbooks/product-csms-as-a-management-system Sat, 05 Sep 2026 00:00:00 +0000 Running the cyber security management system UN R155 requires as an operating system rather than a document set, on the clause pattern an ISMS already follows. governance https://grcide.com/templates/register-of-information https://grcide.com/templates/register-of-information Sat, 05 Sep 2026 00:00:00 +0000 A five-sheet starter that mirrors the standard templates for the register of information, so the function, arrangement and provider data is collected once. compliance https://grcide.com/playbooks/risk-acceptance-and-residual-risk https://grcide.com/playbooks/risk-acceptance-and-residual-risk Sat, 05 Sep 2026 00:00:00 +0000 A method for turning "we accept that risk" into a dated record: a named approver, a residual level tested against criteria, compensating controls and an expiry. risk https://grcide.com/templates/risk-acceptance-record https://grcide.com/templates/risk-acceptance-record Sat, 05 Sep 2026 00:00:00 +0000 A fifteen-column record for accepted risks, with the authority table that says who may accept each level and an expiry log that forces a re-decision. risk https://grcide.com/playbooks/risk-appetite-and-criteria https://grcide.com/playbooks/risk-appetite-and-criteria Sat, 05 Sep 2026 00:00:00 +0000 Appetite written as decisions rather than adjectives, scales with sentence anchors, and acceptance thresholds a register applies and a board approves. risk https://grcide.com/templates/risk-criteria-and-appetite https://grcide.com/templates/risk-criteria-and-appetite Sat, 05 Sep 2026 00:00:00 +0000 Appetite per risk category, anchored consequence and likelihood scales, and a published lookup that says which level is accepted, treated or escalated. risk https://grcide.com/playbooks/running-the-external-audit https://grcide.com/playbooks/running-the-external-audit Sat, 05 Sep 2026 00:00:00 +0000 A method for hosting the certification body: evidence architecture, the opening meeting, nonconformity handling, and findings tracked to verified closure. compliance https://grcide.com/playbooks/scenario-based-risk-assessment https://grcide.com/playbooks/scenario-based-risk-assessment Sat, 05 Sep 2026 00:00:00 +0000 Fifteen to forty scenarios a committee can decide on: risk sources with a desired end state, consequences over time, likelihood with a stated basis, and owners. risk https://grcide.com/templates/scenario-library https://grcide.com/templates/scenario-library Sat, 05 Sep 2026 00:00:00 +0000 The maintained set of risk scenarios a committee can decide on: sources with a desired end state, consequence and likelihood with a basis, and an owner per row. risk https://grcide.com/playbooks/security-awareness-that-works https://grcide.com/playbooks/security-awareness-that-works Sat, 05 Sep 2026 00:00:00 +0000 A method for running an awareness programme against measured behaviour instead of completion rates, with the training records falling out as a by-product. governance https://grcide.com/playbooks/security-operating-model https://grcide.com/playbooks/security-operating-model Sat, 05 Sep 2026 00:00:00 +0000 A method for writing down how security decisions are made: the functions, the decision rights, the three lines, the interfaces and the operating calendar. governance https://grcide.com/briefings/security-risk-in-enterprise-risk-management https://grcide.com/briefings/security-risk-in-enterprise-risk-management Sat, 05 Sep 2026 00:00:00 +0000 Where the security register meets the enterprise one: what must agree, what may differ, who owns aggregation, and which rules force the join. risk https://grcide.com/playbooks/security-strategy-on-one-page https://grcide.com/playbooks/security-strategy-on-one-page Sat, 05 Sep 2026 00:00:00 +0000 A method for turning business objectives, obligations and the risk picture into five to seven measured security objectives that fit on one approved page. governance https://grcide.com/insights/the-board-question-is-not-the-cve-count https://grcide.com/insights/the-board-question-is-not-the-cve-count Sat, 05 Sep 2026 00:00:00 +0000 A vendor piece uses Anthropic's Mythos findings to argue that boards should hear attack paths and expected loss, not patch rates. Half of it holds. https://grcide.com/playbooks/third-party-risk-lifecycle https://grcide.com/playbooks/third-party-risk-lifecycle Sat, 05 Sep 2026 00:00:00 +0000 A lifecycle method for supplier assurance: tier first, assess by tier, contract for the rights you will need, keep assurance running, and exit on plan. risk https://grcide.com/templates/third-party-tiering https://grcide.com/templates/third-party-tiering Sat, 05 Sep 2026 00:00:00 +0000 A four-sheet workbook that scores suppliers on five closed-option factors, bands the scores into three tiers, and sets the depth of assurance each earns. risk https://grcide.com/templates/vulnerability-handling-record https://grcide.com/templates/vulnerability-handling-record Sat, 05 Sep 2026 00:00:00 +0000 Four sheets for Annex I Part II: an SBOM index by product version, a disclosure log, an update log, and a reporting clock with the two Article 14 anchors. risk https://grcide.com/briefings/cra-obligations-by-product-class https://grcide.com/briefings/cra-obligations-by-product-class Fri, 04 Sep 2026 00:00:00 +0000 Regulation (EU) 2024/2847 by product class: the scope test, the obligations by article, the conformity route, and what starts on 11 September 2026. compliance https://grcide.com/playbooks/regulation-to-controls https://grcide.com/playbooks/regulation-to-controls Fri, 04 Sep 2026 00:00:00 +0000 A repeatable method for turning a legal instrument into control objectives, controls, evidence and owners, worked end to end on NIS2 and on the CRA. compliance https://grcide.com/engagement-patterns/ai-governance-standup https://grcide.com/engagement-patterns/ai-governance-standup Thu, 03 Sep 2026 00:00:00 +0000 Standing up AI governance from a blank sheet: role and classification first, then the management system, the impact work and the incident clocks. governance https://grcide.com/reference/grc-framework-selection https://grcide.com/reference/grc-framework-selection Thu, 03 Sep 2026 00:00:00 +0000 Certifiable standard, outcome framework, attestation report or sector standard: what each GRC instrument produces, and which one a given driver calls for. governance https://grcide.com/playbooks/isms-people-actually-use https://grcide.com/playbooks/isms-people-actually-use Thu, 03 Sep 2026 00:00:00 +0000 A method for standing up an ISO/IEC 27001 management system that produces evidence in daily operation instead of a binder assembled before the audit. governance https://grcide.com/engagement-patterns/iso27001-first-certification https://grcide.com/engagement-patterns/iso27001-first-certification Thu, 03 Sep 2026 00:00:00 +0000 The shape of a first certification cycle: scope, risk assessment and treatment, the operating record, and the evidence an accredited body reads. compliance https://grcide.com/briefings/nis2-for-the-security-officer https://grcide.com/briefings/nis2-for-the-security-officer Thu, 03 Sep 2026 00:00:00 +0000 Directive (EU) 2022/2555 in one pass: the scope test, the obligations by article, the reporting clock, the fine ceilings and a mapping to ISO 27001 Annex A. compliance https://grcide.com/engagement-patterns/nis2-readiness-important-entity https://grcide.com/engagement-patterns/nis2-readiness-important-entity Thu, 03 Sep 2026 00:00:00 +0000 How readiness is shaped for an entity in the important tier: the scope test, the Article 21 measures, the reporting chain and the evidence behind them. compliance https://grcide.com/engagement-patterns/product-cybersecurity-r155-cra https://grcide.com/engagement-patterns/product-cybersecurity-r155-cra Thu, 03 Sep 2026 00:00:00 +0000 One product, three instruments. How the management system, the per-product file and the reporting clocks are built so a single evidence set answers all three. compliance https://grcide.com/templates/risk-register https://grcide.com/templates/risk-register Thu, 03 Sep 2026 00:00:00 +0000 A sixteen-column information security risk register with anchored 1-5 scales, a published combination rule and two mandatory decisions on every row. risk https://grcide.com/playbooks/risk-register-people-trust https://grcide.com/playbooks/risk-register-people-trust Thu, 03 Sep 2026 00:00:00 +0000 Risk statements that name a source, an event and a consequence; scales that survive argument; and every row closed by a named approver on a dated decision. risk https://grcide.com/radar#eu-pqc-roadmap-faq https://grcide.com/radar#eu-pqc-roadmap-faq Wed, 02 Sep 2026 00:00:00 +0000 The Commission published the roadmap consultation feedback on 2 September 2026; the FAQ of 15 April 2026 answers the milestone and inventory questions. https://grcide.com/radar#china-small-pi-processors https://grcide.com/radar#china-small-pi-processors Tue, 01 Sep 2026 00:00:00 +0000 Order No. 25 gives a processor under one hundred thousand people a five-year audit cycle, form-based impact assessments and six export exemptions. https://grcide.com/radar#nist-csf-informative-references https://grcide.com/radar#nist-csf-informative-references Tue, 25 Aug 2026 00:00:00 +0000 NIST SP 1347 reached final status on 25 August 2026, covering what a CSF 2.0 informative reference is and which NIST tools serve the reference data. https://grcide.com/radar#china-network-data-risk-assessment https://grcide.com/radar#china-network-data-risk-assessment Thu, 20 Aug 2026 00:00:00 +0000 Order No. 24 makes an annual risk assessment compulsory for important data processors, with the report filed within twenty working days. https://grcide.com/radar#nl-cyberbeveiligingswet https://grcide.com/radar#nl-cyberbeveiligingswet Sat, 15 Aug 2026 00:00:00 +0000 The Cyberbeveiligingswet and the Wet weerbaarheid kritieke entiteiten entered into force on 15 August 2026, and the decree carries no transitional law. https://grcide.com/radar#hipaa-security-rule-long-term-actions https://grcide.com/radar#hipaa-security-rule-long-term-actions Fri, 14 Aug 2026 00:00:00 +0000 The 2026 Unified Agenda moved the HIPAA Security Rule rewrite out of the final rule stage and projected final action in July 2027, with no day set. https://grcide.com/radar#china-police-cyberspace-inspection https://grcide.com/radar#china-police-cyberspace-inspection Fri, 07 Aug 2026 00:00:00 +0000 Order No. 176 replaces the 2018 internet inspection rules, holds routine on-site checks to one a year, and reuses another regulator's inspection result. https://grcide.com/radar#ai-act-high-risk-deferral https://grcide.com/radar#ai-act-high-risk-deferral Mon, 27 Jul 2026 00:00:00 +0000 The Digital Omnibus on AI moves the high-risk obligations to December 2027 and August 2028, and adds two prohibited practices from December 2026. https://grcide.com/radar#cra-commission-guidance https://grcide.com/radar#cra-commission-guidance Mon, 27 Jul 2026 00:00:00 +0000 C(2026) 5252 and its annex set out how the Commission reads scope, substantial modification, support periods and the reporting duties. https://grcide.com/radar#ai-act-transparency-code https://grcide.com/radar#ai-act-transparency-code Mon, 20 Jul 2026 00:00:00 +0000 The Code of Practice on Transparency of AI-generated Content closed on 10 June 2026, and the Commission's Article 50 guidelines followed on 20 July 2026. https://grcide.com/radar#japan-appi-2026-amendment https://grcide.com/radar#japan-appi-2026-amendment Fri, 17 Jul 2026 00:00:00 +0000 Promulgated 17 July 2026, the amending act adds a surcharge regime; one tranche is in force from 17 January 2027 and the rest await a Cabinet Order. https://grcide.com/radar#china-anthropomorphic-ai-services https://grcide.com/radar#china-anthropomorphic-ai-services Wed, 15 Jul 2026 00:00:00 +0000 Order No. 21 reaches AI that sustains emotional interaction, with a security assessment at a million registered users and algorithm filing verified each year. https://grcide.com/radar#cer-directive-swedish-bill https://grcide.com/radar#cer-directive-swedish-bill Tue, 14 Jul 2026 00:00:00 +0000 Sweden's bill implementing the critical entities resilience directive was laid before the Riksdag on 14 July 2026, proposing effect from 1 January 2027. https://grcide.com/briefings/r155-vs-iso21434-five-misreads https://grcide.com/briefings/r155-vs-iso21434-five-misreads Fri, 10 Jul 2026 00:00:00 +0000 R155 mandates the framework; ISO 21434 describes how to build it. Treating them as interchangeable is where most first-time audits go sideways. compliance https://grcide.com/briefings/soc2-type1-90-day-plan https://grcide.com/briefings/soc2-type1-90-day-plan Fri, 10 Jul 2026 00:00:00 +0000 A week-by-week sequence for a first SOC 2 type 1 examination: scope, policy set, evidence pipeline, risk assessment, fieldwork. compliance https://grcide.com/radar#iso-27000-19011-2026 https://grcide.com/radar#iso-27000-19011-2026 Fri, 03 Jul 2026 00:00:00 +0000 ISO/IEC 27000:2026 was published on 3 July 2026 and ISO 19011:2026 in May 2026, withdrawing the editions an older audit file cites. https://grcide.com/radar#china-cybersecurity-label https://grcide.com/radar#china-cybersecurity-label Wed, 01 Jul 2026 00:00:00 +0000 A voluntary three-star label rates a connected product's security, filed with a designated body and scannable to the test report and conformity declaration. https://grcide.com/radar#china-pi-audit-standard https://grcide.com/radar#china-pi-audit-standard Wed, 01 Jul 2026 00:00:00 +0000 GB/T 46903-2025 took effect on 1 July 2026, giving the compliance audit already required of large processors a published national method. https://grcide.com/radar#china-nfra-ai-banking-insurance-guidance https://grcide.com/radar#china-nfra-ai-banking-insurance-guidance Thu, 18 Jun 2026 00:00:00 +0000 Thirty-two items put AI in banks and insurers under a board committee, a graded application inventory, and risk committee approval for high-risk uses. https://grcide.com/radar#cra-reporting-obligations https://grcide.com/radar#cra-reporting-obligations Thu, 11 Jun 2026 00:00:00 +0000 Article 14 applies from 11 September 2026, ahead of full application on 11 December 2027, and it reaches products already placed on the market. https://grcide.com/radar#nist-ransomware-profile https://grcide.com/radar#nist-ransomware-profile Thu, 11 Jun 2026 00:00:00 +0000 NIST IR 8374 Revision 1 was published in June 2026 and supersedes the 2022 ransomware profile, which predates the six-Function Core. https://grcide.com/radar#un-r156-amendments-2026 https://grcide.com/radar#un-r156-amendments-2026 Thu, 04 Jun 2026 00:00:00 +0000 In force since 22 January 2021; amended by ECE/TRANS/WP.29/2025/142, binding on applying Contracting Parties from 4 June 2026 per the UN depositary record. https://grcide.com/radar#china-ai-agents-implementation-opinion https://grcide.com/radar#china-ai-agents-implementation-opinion Fri, 08 May 2026 00:00:00 +0000 Thirty-eight tasks for AI agents: a registration platform carrying digital identity, a permission boundary, anomaly tooling and graded sector treatment. https://grcide.com/radar#edpb-europrivacy-transfer-seal https://grcide.com/radar#edpb-europrivacy-transfer-seal Wed, 15 Apr 2026 00:00:00 +0000 Two opinions adopted on 15 April 2026 approve an updated European Data Protection Seal and, separately, one usable as an Article 46(2)(f) transfer tool. https://grcide.com/radar#korea-pipa-2026-amendment https://grcide.com/radar#korea-pipa-2026-amendment Tue, 10 Mar 2026 00:00:00 +0000 Act No. 21445, promulgated 10 March 2026, is in force from 11 September 2026, with a ten per cent turnover tier and a board resolution for the privacy officer. https://grcide.com/radar#china-automotive-data-export-guidance https://grcide.com/radar#china-automotive-data-export-guidance Fri, 30 Jan 2026 00:00:00 +0000 Eight departments set nine export exemptions for automotive data, scenario rules for judging important data, and three-year tamper-proof log retention. https://grcide.com/radar#nis2-swedish-cybersecurity-act https://grcide.com/radar#nis2-swedish-cybersecurity-act Thu, 15 Jan 2026 00:00:00 +0000 Cybersäkerhetslag (2025:1506) entered into force on 15 January 2026, fifteen months after the directive's transposition date of 17 October 2024. https://grcide.com/radar#china-cybersecurity-law-amendment https://grcide.com/radar#china-cybersecurity-law-amendment Thu, 01 Jan 2026 00:00:00 +0000 Presidential Order No. 61 adds an artificial intelligence article to the Cybersecurity Law and sets the top penalty on an operator at ten million yuan. https://grcide.com/radar#gb-44495-44496-in-force https://grcide.com/radar#gb-44495-44496-in-force Thu, 01 Jan 2026 00:00:00 +0000 China's mandatory vehicle cybersecurity and software-update standards moved from issued to in force on 1 January 2026, seventeen months after publication. https://grcide.com/radar#vietnam-pdpl-decree-356 https://grcide.com/radar#vietnam-pdpl-decree-356 Wed, 31 Dec 2025 00:00:00 +0000 Issued on 31 December 2025 and in force the next day, the decree sets the dossier forms, widens the transfer exemptions and repeals Decree 13/2023. https://grcide.com/radar#india-dpdp-rules-2025 https://grcide.com/radar#india-dpdp-rules-2025 Thu, 13 Nov 2025 00:00:00 +0000 G.S.R. 846(E) splits commencement three ways: part on publication, consent managers a year on, and the working obligations eighteen months on. https://grcide.com/radar#iso-27001-2022-transition-closed https://grcide.com/radar#iso-27001-2022-transition-closed Fri, 31 Oct 2025 00:00:00 +0000 The accredited transition period set by IAF MD 26 ended on 31 October 2025; certificates naming the 2013 edition expire or are withdrawn. https://grcide.com/radar#china-pi-export-certification https://grcide.com/radar#china-pi-export-certification Tue, 14 Oct 2025 00:00:00 +0000 Order No. 20 gives the certification route its own rules: who may use it, a three-year certificate, and a bar on splitting volumes to dodge the assessment. https://grcide.com/radar#california-ccpa-audit-admt-regulations https://grcide.com/radar#california-ccpa-audit-admt-regulations Mon, 22 Sep 2025 00:00:00 +0000 Approved on 22 September 2025 and effective 1 January 2026, the package dates ADMT compliance at 2027, first audit reports at 2028 and later. https://grcide.com/radar#iso-42006-certification-route https://grcide.com/radar#iso-42006-certification-route Mon, 07 Jul 2025 00:00:00 +0000 The requirements standard for bodies auditing AI management systems was published on 7 July 2025, alongside the impact-assessment standard of May 2025. https://grcide.com/radar#dora-subcontracting-rts https://grcide.com/radar#dora-subcontracting-rts Wed, 02 Jul 2025 00:00:00 +0000 Delegated Regulation (EU) 2025/532 sets what a financial entity must determine before ICT services supporting critical or important functions are subcontracted. https://grcide.com/radar#vietnam-personal-data-protection-law https://grcide.com/radar#vietnam-personal-data-protection-law Thu, 26 Jun 2025 00:00:00 +0000 Law No. 91/2025/QH15, passed on 26 June 2025, took effect on 1 January 2026 and caps cross-border transfer fines at five per cent of turnover. https://grcide.com/radar#un-r155-supplement-3 https://grcide.com/radar#un-r155-supplement-3 Fri, 10 Jan 2025 00:00:00 +0000 The consolidated R155 text republished in the Official Journal as 2025/5 incorporates all valid text up to Supplement 3 to the original version. https://grcide.com/radar#chile-ley-21719 https://grcide.com/radar#chile-ley-21719 Fri, 13 Dec 2024 00:00:00 +0000 Published on 13 December 2024, the law rewrites Chile's data protection regime and creates a supervisory agency, in force from 1 December 2026. https://grcide.com/radar#nist-csf-2-0 https://grcide.com/radar#nist-csf-2-0 Mon, 26 Feb 2024 00:00:00 +0000 The Cybersecurity Framework 2.0 was published on 26 February 2024 as NIST CSWP 29, with Govern at the centre of a six-Function Core. https://grcide.com/radar#eu-data-act-switching-charges https://grcide.com/radar#eu-data-act-switching-charges Wed, 13 Dec 2023 00:00:00 +0000 Article 29 bars any switching charge for cloud and other data processing services from 12 January 2027, and already caps the reduced charges allowed until then.