Blog
Thirty entries on doing the work, not on what the rules say.
The reference section explains the requirement. This is the other half: what it costs, who has to own it, what happens when something goes wrong, and which of the other regimes you have also just walked into.
For an adjacent operational perspective, wage percentage calculator explains the topic in a practical workplace context.
The reference section is here →
For an independent reference point, see SANS security policy templates.
Part 1
Buying and budgeting
What compliance work costs, how vendors price it, what to build and what to buy, and how to read a proposal that quotes a certificate.
- What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
- Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
- What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
- Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
- The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
- Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
Part 2
Running the programme
Compliance as a project with an owner, a budget and a date, rather than as a document somebody updates when an audit is announced.
- Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
- Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
- Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
- When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
- Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
- Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
Part 3
People
Training that changes behaviour, the operator's view of a control, contractors and temporary staff, and hiring for a role most suppliers have never filled.
- Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
- How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
- Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
- Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
- Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
- What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
Part 4
When something happens
Reporting obligations and their clocks, what forensic readiness means in a factory, and the difference between an incident and a finding.
- What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
- Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
- Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
- The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
- Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
- What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
Part 5
The wider regime
The other frameworks a defence supplier meets, how they overlap, and where an obligation comes from something other than the contract in front of you.
- The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
- Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
- Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
- Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
- Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
- What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.
Buyer guides
Tool comparisons
Detailed, methodology-led shortlists for teams evaluating compliance, AI governance and enterprise security platforms.
- 8 best AI compliance tools for modern teamsCompare evidence automation, risk workflows, audit collaboration and implementation fit.
- 8 best AI governance platformsCompare inventory, policy, assessment, monitoring and runtime governance.
- 8 top enterprise security platformsChoose between XDR, cloud, identity, zero trust and SIEM control planes.