Tagged “Compliance”
A data centre physical security audit checklist, each item mapped to the PSPF, ISM controls, CIRMP s 11, ISO 27001 A.7 and SOC 2 CC6.4, from site to rack.
What CIRMP section 11 requires of data centre physical security under the SOCI Act, and when the June 2026 enhanced rules can reach a data centre.
What a System Security Plan is, what goes in one, who requires it (NIST 800-171 and CMMC, FedRAMP, FISMA, Australia's ISM and IRAP), how to write one, and why most SSPs are out of date the day they are signed.
How research computing centres meet NIST SP 800-171 and CMMC obligations for controlled unclassified information on shared clusters: the enclave pattern, scoping, and the SP 800-223 zones it builds on.
Your first SOC 2 audit does not have to be a three-month panic. A structured, low-drama route to a Type II report: scoping, the control framework, a realistic timeline, evidence, exceptions, and what changes after the report.
Most third-party risk programs are a spreadsheet of questionnaires nobody reads after they are collected. How to build a tiered, continuously monitored program that genuinely reduces vendor risk, and what CPS 230 and DORA now expect of it.