Komplyo blog
Documentation and governance
The documentation an auditor or a customer asks for comes down to a limited set of policies and evidence, provided they all derive from a single assessment. This section covers the NIST CSF 2.0 framework, writing an information security policy, security budgeting and awareness training. The aim is documentation that gets used internally, not documentation produced for the audit.
Security awareness: a credible programme without budget or a dedicated team
An awareness programme holds together with a security representative who is short on time: one theme per month, short formats, free public resources (SensCyber, the Cybermoi/s kit, ENISA materials) and evidence of delivery. What NIS2, the AI Act and NIST CSF (PR.AT) require, and how to structure twelve months.
- Awareness
- Cybermoi/s
- NIS2
- NIST CSF
Information security policy for SMEs: what an auditor actually looks for
A security policy is not a Word template filled in within an hour. What clause 5.2 of ISO/IEC 27001 and control 5.1 of ISO/IEC 27002 require, what an auditor checks (approval, communication, review, consistency with the risk assessment) and how an SME builds a proportionate policy.
- Security policy
- ISO 27001
- Governance
- ANSSI
EU AI Act, ISO 42001, NIST AI RMF: three AI governance frameworks of three different kinds
The AI Act is a binding regulation, ISO/IEC 42001 a certifiable standard since the first accreditations of 2026, the NIST AI RMF a free voluntary framework. What each one requires and produces, what none of them replaces in the other two, and how an SME combines them without building an isolated programme.
- AI Act
- ISO 42001
- NIST AI RMF
- Governance
- NIST CSF
30 compliance documents from a single assessment: how it works
Security policy, ISO 27001 SoA, risk register, business continuity plan, DPIA, records of processing, NIS2 scope memo… How one assessment aligned on NIST CSF 2.0 generates 30+ deliverables ready for your customers and auditors.
- Compliance
- NIST CSF
- ISO 27001
- GDPR
- NIS2
NIST CSF 2.0 for SMEs: the six functions and how to implement them
The NIST Cybersecurity Framework 2.0 organizes cyber risk management into six functions: Govern, Identify, Protect, Detect, Respond, Recover. What each function expects from an SME, category by category, and a 90-day implementation sequence based on the NIST SP 1300 guide.
- NIST CSF
- Compliance
- Cybersecurity
Get the security policy template
An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.