Komplyo blog
Risk, third parties and continuity
Risk analysis, supplier assessment and business continuity all start from the same inventory: what the company processes, with which tools and through which third parties. These articles cover building a risk register that stays current, running a business impact analysis and answering the security questionnaires customers send.
Your first risk register: a proportionate method aligned with EBIOS RM and ISO 27005
Risk registers for SMEs: what ISO 27001 (clauses 6.1.2 and 8.2) and NIS2 require, how to start with EBIOS RM workshop 1 (scoping and security baseline), which columns to keep and which pitfalls to avoid. An iterative method aligned with ISO/IEC 27005:2022.
- Risk register
- EBIOS RM
- ISO 27005
- NIST CSF
Answering a customer security questionnaire without losing a week: a method for SMBs
CAIQ, SIG, 200-row custom spreadsheets: customer security questionnaires have become a fixture of B2B sales. A 5-step method for SMBs: one answer base aligned with NIST CSF 2.0, projection into each framework's vocabulary, and evidence ready before it's requested.
- Customer questionnaires
- Compliance
- NIST CSF
- Enterprise sales
Business Impact Analysis for SMBs: a five-step method
A Business Impact Analysis (BIA) prioritizes assets by business criticality rather than technical value. A five-step method for SMBs, based on NIST SP 800-34, NIST CSF 2.0, CISA resources and ANSSI's EBIOS Risk Manager.
- BIA
- NIST CSF
- Business continuity
Get the security policy template
An information security policy template in .docx format, structured around NIST CSF 2.0 and ISO 27001. Delivered by email, usable as a documentation baseline.