Komplyo blog
Security & compliance, explained
Practical guides on NIST CSF 2.0, ISO 27001, SOC 2, GDPR and NIS2 for European SMEs and scale-ups without the jargon.
DORA for subcontractors: when your bank and insurance clients pass their obligations on to you
Regulation (EU) 2022/2554 has applied since 17 January 2025. SME providers are not in scope, but their financial clients must list them in a register of information, impose the Article 30 contract clauses and control subcontracting chains. What you will be asked for, and how to build a single reusable answer file.
- DORA
- EU regulation
- Subcontracting
- NIST CSF
Your first notification on ENISA's Single Reporting Platform: a CRA walkthrough for SMEs
ENISA's Single Reporting Platform has been open since 11 September 2026. An operational guide for an SME: create the account, pick the right CSIRT, fill in the 24-hour early warning, understand what becoming aware sets running, and what the platform does and does not do today.
- CRA
- ENISA
- EU Regulation
- Incident response
- NIST CSF
Security awareness: a credible programme without budget or a dedicated team
An awareness programme holds together with a security representative who is short on time: one theme per month, short formats, free public resources (SensCyber, the Cybermoi/s kit, ENISA materials) and evidence of delivery. What NIS2, the AI Act and NIST CSF (PR.AT) require, and how to structure twelve months.
- Awareness
- Cybermoi/s
- NIS2
- NIST CSF
ISO 27001 audit: the most frequent nonconformities (and how an SME avoids them)
Published analyses by the certification bodies DNV and NQA converge: risk assessment, internal audit, scope and day-to-day operations concentrate the nonconformities in ISO 27001 audits. What the data shows, what the standard requires clause by clause and how to prepare each area.
- ISO 27001
- Audit
- Certification
- SoA
The Data Omnibus: where the GDPR, NIS2 and DORA simplifications stand for SMEs
The data strand of the Digital Omnibus proposes to simplify the GDPR, NIS2 and DORA: a single EU list for DPIAs, a consent overhaul, and consolidated breach notification. A factual read for SMEs, with what sits in the Council text and what was taken out of it. A file still in negotiation, with nothing to implement today.
- Data Omnibus
- GDPR
- NIS2
- DORA
- EU Regulation
- NIST CSF
Information security policy for SMEs: what an auditor actually looks for
A security policy is not a Word template filled in within an hour. What clause 5.2 of ISO/IEC 27001 and control 5.1 of ISO/IEC 27002 require, what an auditor checks (approval, communication, review, consistency with the risk assessment) and how an SME builds a proportionate policy.
- Security policy
- ISO 27001
- Governance
- ANSSI
EU AI Act, ISO 42001, NIST AI RMF: three AI governance frameworks of three different kinds
The AI Act is a binding regulation, ISO/IEC 42001 a certifiable standard since the first accreditations of 2026, the NIST AI RMF a free voluntary framework. What each one requires and produces, what none of them replaces in the other two, and how an SME combines them without building an isolated programme.
- AI Act
- ISO 42001
- NIST AI RMF
- Governance
- NIST CSF
The AI Act on 2 August 2026: what actually applies and what is postponed for SMEs
2 August 2026 is the general application date of Regulation (EU) 2024/1689, but Regulation (EU) 2026/1744, published on 24 July 2026, postpones the Annex III high-risk obligations to 2 December 2027. A verified overview for SMEs: Article 50 transparency, AI content marking, postponed deadlines, penalties.
- AI Act
- EU regulation
- Governance
- NIST CSF
Your first risk register: a proportionate method aligned with EBIOS RM and ISO 27005
Risk registers for SMEs: what ISO 27001 (clauses 6.1.2 and 8.2) and NIS2 require, how to start with EBIOS RM workshop 1 (scoping and security baseline), which columns to keep and which pitfalls to avoid. An iterative method aligned with ISO/IEC 27005:2022.
- Risk register
- EBIOS RM
- ISO 27005
- NIST CSF
CRA: the 24-hour and 72-hour notification obligation has applied since 11 September 2026
Article 14 of Regulation (EU) 2024/2847 has applied since 11 September 2026, fifteen months ahead of the rest of the CRA. Early warning within 24 hours, notification within 72 hours, final report within 14 days or one month, through ENISA's single reporting platform. What a manufacturer, including an SME software vendor, must have in place.
- CRA
- EU regulation
- Incident response
- NIST CSF
Answering a customer security questionnaire without losing a week: a method for SMBs
CAIQ, SIG, 200-row custom spreadsheets: customer security questionnaires have become a fixture of B2B sales. A 5-step method for SMBs: one answer base aligned with NIST CSF 2.0, projection into each framework's vocabulary, and evidence ready before it's requested.
- Customer questionnaires
- Compliance
- NIST CSF
- Enterprise sales
Coordinated vulnerability disclosure (CVD): the policy the CRA requires, in practice
Annex I, Part II of Regulation (EU) 2024/2847 requires manufacturers to have a coordinated vulnerability disclosure policy. What the policy must contain, the ISO/IEC 29147 and 30111 standards that structure it, the French framework (L. 2321-4 and L. 2321-4-1) and a proportionate implementation for an SME.
- CRA
- CVD
- Vulnerability management
- NIST CSF
Get the security policy template
An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.