Insights
The Lightwork Brief
Framework updates, practical guides and perspectives on security, compliance and AI governance, written for people who have to get the work done.
-
Vendor risk for a 40-person company: what auditors sample and what you can skip
A proportionate third-party programme that satisfies CC9.2 and A.5.19 to A.5.23 without a GRC platform.
-
The Digital Omnibus bought high-risk AI providers fourteen months. Spend them well.
Regulation (EU) 2026/1744 moved the Annex III deadline to 2 December 2027. What changed, what did not, and the order to do…
-
Answering security questionnaires when nobody is the security team
How a 30-person company gets through a 200-row questionnaire without inventing controls, and builds the answer library it will reuse.
-
What a certification auditor reads into your Statement of Applicability
The SoA is the first document a Stage 1 auditor opens and the test plan for Stage 2. How to write one…
-
A SOC 2 readiness review in two weeks, with the tools on this site
The sequence we use before an audit, compressed into ten working days, with the free tools that carry each step.
-
SOC 2, ISO 27001 or HITRUST: How to Choose Your First Framework
The right first framework depends less on your technology and more on who you sell to. A simple way to decide.
-
ISO 42001 Explained: What It Is and Who Needs It
ISO/IEC 42001 is the first certifiable standard for AI management systems. Here is what it covers and why customers are starting to…
-
SOC 2 Type I vs. Type II: Which One Do You Need?
Both are SOC 2 reports, but they answer different questions. Here is how to choose, and why many companies do both.
Get The Lightwork Brief
One email a month: framework updates that matter, a practical tip, and what auditors are asking for right now.