Articles, whitepapers and insights into IT audit, information security, compliance and risk management.
More organizations pursue ISO 42001 certification for AI governance. But the practice is tougher than the theory. These are the seven things we encounter.
SOC 2 is an essential audit report for service organizations. Learn what a SOC 2 report entails and why it matters for your business.
ISAE 3402 and SOC 2 are both assurance standards for service organizations. But they differ in scope, audience and application. Here is how to choose.
Planning your ISO 27001 certification? This step-by-step roadmap covers scoping, risk assessment, implementation and the certification audit itself.
Traditional audits look back. Continuous auditing looks forward. Learn how real-time monitoring and automated testing are transforming IT audit.
SOC 2 Type 1 and Type 2 reports serve different purposes. Understand the key differences to choose the right report for your organization.
ISAE 3402 is the international standard for assurance reports on controls at service organizations. This guide explains what it means for your business.
Both pentests and vulnerability scans identify security weaknesses. But they differ fundamentally in approach, depth and value. Here is how to choose.
ISO 9001 provides a solid quality management foundation that integrates naturally with ISO 27001 and other standards. Here is why it matters for IT services.
ISO 22301 provides the framework for business continuity management. From business impact analysis to continuity testing, here is what you need to know.
ISO 27017 adds cloud-specific security controls to your ISO 27001 framework. Learn about shared responsibility, the seven new controls, and practical implementation.
ISO 27018 sets the standard for PII protection in cloud environments. Learn how it connects to GDPR, ISO 27001, and ISO 27017.
ISO 27701 extends ISO 27001 with a Privacy Information Management System. Learn how it supports GDPR compliance and what certification involves.
The eIDAS regulation governs electronic identification and trust services across the EU. With eIDAS 2.0 and the European Digital Identity Wallet on the horizon, understanding this framework is essential.
Internal audits are a mandatory component of every ISO management system. Done well, they drive real improvement. Done poorly, they become a compliance checkbox.
Your first SOC 2 audit does not have to be overwhelming. This practical checklist covers scope definition, control design, gap remediation and evidence collection.
The ISAE 3402 Type II observation period requires a minimum of six months. Learn why this period matters, what auditors test, and how to manage evidence collection.
SaaS providers in the DigiD chain face specific assessment requirements. From network segmentation to multi-tenant challenges, here is what you need to know.
DORA creates new obligations for ICT providers serving financial institutions. Understanding the requirements early turns compliance into a commercial advantage.
Good evidence management can make or break an audit engagement. Learn the fundamentals of audit evidence, common pitfalls, and how to organize evidence efficiently.
The EU AI Act takes full effect for high-risk AI systems in August 2026, with fines up to 35 million euros. How to classify your AI systems, meet compliance requirements, and prepare for conformity assessment.
The Cyber Resilience Act introduces mandatory cybersecurity requirements for all digital products on the EU market. From IoT devices to software: what manufacturers, importers, and distributors need to know.
The transition period to ISO 27001:2022 expired on 31 October 2025. Organizations still certified to the 2013 version need to take action. Here is what changed and how to approach the transition audit.
More organizations combine ISO 27001, ISO 42001, NEN 7510, or ISO 9001 in a single management system. An integrated audit saves time and cost. But how does it work in practice?
The biggest cyberattacks of recent years came through the supply chain: SolarWinds, Kaseya, MOVEit. NIS2 mandates supply chain management. How do you audit the security of your supply chain?
Quantum computers threaten the cryptography that protects virtually all digital communication. NIST has published the first post-quantum standards. What does this mean for your organization?
ISO/IEC 42005:2025 is the first international standard dedicated specifically to conducting AI system impact assessments. It helps organizations map how their AI systems affect individuals, groups, and society in a structured way. Not a certifiable standard, but a practical guide that aligns seamlessly with ISO 42001 and the EU AI Act.
Since 2 February 2025, Article 4 of the EU AI Act requires every organization that uses AI to ensure a sufficient level of AI literacy among its staff. It is the first concrete obligation already in force, and it affects almost every organization. What exactly does the requirement entail and how do you meet it?
Since 2 August 2025, the EU AI Act imposes specific obligations on providers of general-purpose AI models, the models behind tools like GPT, Claude, and Gemini. Transparency, documentation, copyright and, for the most capable models, requirements around systemic risk. What does this mean for those who provide or embed such models?
Two leading frameworks for AI governance: the NIST AI Risk Management Framework and ISO 42001. One is a voluntary risk model with the functions Govern, Map, Measure, and Manage; the other a certifiable management system standard. They do not compete, they complement each other. Here is how to choose and combine them.
Employees use AI tools nobody approved, vendors quietly add AI features, and the organization has no overview. That is shadow AI, and it is the biggest blind spot in any AI governance. A complete AI inventory is the first and indispensable step, whether you are implementing ISO 42001 or preparing for the EU AI Act.
In May 2026 the EU institutions reached an agreement on the Digital Omnibus, the first amendment package to the EU AI Act since its adoption. The obligations for high-risk AI systems shift to December 2027 and August 2028. What changes, what stays, and why is a delay no reason to sit still?
Broken Access Control has topped the OWASP Top 10 for years and produces the most impactful findings in pentests. We explain how we attack it and how to prevent it.
The risk assessment is the foundation of ISO 27001, yet it often stalls in practice. This guide shows how to build a risk assessment that stays usable.
The NIS2 directive introduces strict cybersecurity requirements for Dutch organisations. Read everything about the implementation and your obligations.
DORA (Digital Operational Resilience Act) sets strict requirements for digital resilience in the financial sector. Read what this means for your organisation.
ISO 27001:2022 introduced significant changes. Discover the latest updates and what this means for your information security.
DigiD assessments are mandatory for organisations that offer government services. Here is your checklist for compliance.
A strong IT internal control framework is essential for reliable operations. This article guides you through COSO and COBIT.
ISO 42001 provides guidelines for managing AI systems in a safe and responsible way. Discover what this means for your organisation.
BIO (Baseline Information Security Government) sets cybersecurity requirements for Dutch government organisations. Learn what this involves.
DNB, AFM and other regulators scrutinise IT risk management closely. Discover what they are looking for.
ScanZeker.nl scans your domain in 30 seconds across twelve security modules. From SSL/TLS and security headers to open ports, data breaches, subdomain takeover and attack paths. Free, without an account and without storing results.
The NIS2 directive is in force and the Dutch implementation act is approaching. Many organisations know they have to do something, but not what. This article describes the concrete steps that organisations must take now to become compliant.
Attackers are using AI to scale up phishing, deepfakes and automated attacks. At the same time, AI offers new defensive capabilities. How do you, as an organisation, navigate this rapidly changing threat landscape?
How do you test the security of your website without being a security expert? From HTTP headers and SSL configuration to email security and DNS. A step-by-step approach for IT managers and business owners.
Logius has once again tightened the ICT security assessment for DigiD. What is changing in 2026 and how do you prepare your organisation?
The EU AI Act is in force and ISO 42001 provides the management system to comply with it. But how do they relate to each other? And where are the gaps?
More and more enterprise customers require a SOC 2 report. But how exactly does the process work, what does it cost, and when do you choose Type I or Type II?
The Cybersecurity Act is the Dutch implementation of the European NIS2 directive. Adopted by the House of Representatives on 15 April 2026, with entry into force on 1 July 2026. This article explains what the law entails, who falls under it and what you need to arrange now.
Get our latest articles and insights on IT audit, compliance and information security.