Dallas, Texas · Technology consulting since 201635 services · 3 practices · 8 industries Technology in ActionPartnerships817-968-0523
Speak With an Expert
Insights

Analysis for people who have to be right.

Regulatory analysis, technical research and practical guidance from the practitioners who scope, test and assess for a living.

Curved white architectural ribs creating a rhythmic pattern of light
Featured · White paper

ISO/IEC 42001, the NIST AI RMF and the EU AI Act: a practitioner’s comparison

A management-system standard, a voluntary risk framework and a binding regulation. This white paper compares what each requires, where they overlap and where they diverge, and sets out how to build one AI governance program that serves all three.

October 15, 202618 min read
Read the publication

All publications

12 results

White paper18 min read

ISO/IEC 42001, the NIST AI RMF and the EU AI Act: a practitioner’s comparison

A management-system standard, a voluntary risk framework and a binding regulation. This white paper compares what each requires, where they overlap and where they diverge, and sets out how to build one AI governance program that serves all three.

Regulatory analysis10 min read

FedRAMP 20x: what changes for cloud providers, and what stays hard

FedRAMP is replacing document-heavy authorization with machine-readable evidence and Key Security Indicators, and has said the legacy Rev5 process is expected to wind down. The paperwork gets lighter. The engineering does not.

Regulatory analysis9 min read

The EU AI Act after the Digital Omnibus: what moved, and what did not

The amending regulation adopted in mid-2026 pushed back the high-risk obligations. It did not pause the Act. Prohibitions, general-purpose AI duties and most transparency obligations are already in application. The extra time is only useful if it is spent building governance.

Analysis11 min read

Payment-page scripts after PCI DSS 6.4.3 and 11.6.1: what assessors now expect

The two client-side requirements have been mandatory since 31 March 2025. Eighteen months on, buying a tool is the easy part. The hard part is proving authorization, integrity and tamper detection for scripts you do not fully control.

Analysis12 min read

Prompt injection is an architecture problem, not a filtering problem

No classifier reliably separates instructions from data inside a language model’s context. Teams that accept this design their AI systems differently, limiting what an injected instruction could ever achieve.

Perspective10 min read

One piece of evidence, many frameworks: designing a unified control set without overclaiming

Unified control frameworks can remove a great deal of duplicated effort. They can also produce confident claims that collapse under an auditor’s first question. The difference lies in how you handle the parts of each framework that do not overlap.

Regulatory analysis10 min read

The DORA register of information is a dependency map, not a spreadsheet

Supervisors now use the register to see concentration risk across the EU financial sector. Firms that treat it as an annual procurement export are missing what it is for, and what it can tell them about their own resilience.

Research brief11 min read

In the cloud, identity is the blast radius

A review of four publicly documented cloud incidents shows the same pattern: the initial weakness varied, but the damage was determined by what a compromised identity was allowed to do. What that means for how cloud security is assessed.

Regulatory analysis9 min read

Choosing your SWIFT CSCF architecture type: the decision that sets your scope

Your architecture type determines which Customer Security Controls Framework controls apply and how much of your estate the independent assessor examines. The 2026 framework made that decision harder to get right, particularly for users with customer connectors.

Technical guide10 min read

Segmentation is a claim. Testing is the proof.

Network segmentation is the most powerful lever for reducing PCI DSS scope, and the one most often asserted without evidence. A practical guide to what requirements 11.4.5 and 11.4.6 demand, and how to test segmentation in cloud and hybrid estates.

Perspective9 min read

SOC 1 or SOC 2? Start with who reads the report

The choice between a SOC 1 and a SOC 2 report is usually framed as finance versus security. The more useful question is who will rely on the report, and for what decision. Get that right and scope, criteria and type follow.

Analysis10 min read

Ransomware recovery is a control. Test it like one.

Most organizations can show that backups run. Far fewer can show that they could rebuild identity, restore critical services in a known order and do it while an adversary may still be present. Recovery capability should be evidenced, not assumed.

Browse by topic.

01Thought Leadership2 publications 02Research & Reports1 publication 03Regulatory Updates3 publications 04Cybersecurity Insights3 publications 05AI Governance Insights2 publications 06White Papers1 publication 07Case StudiesIn confidence 08Events & WebinarsBy invitation
Beyond the article

Have a question the article didn’t answer?

Our practitioners will talk you through how it applies to your environment, your assessor and your regulator.

Speak With an ExpertRequest an Assessment