Explore our latest insights, strategic frameworks, and practical advice for navigating the modern threat landscape.
ISO 42001 and the EU AI Act don't replace your GRC program — they extend it. A vendor-neutral view on governing AI through the ISO 27001 / NIS2 / DORA controls you already run.
Read article →Article 21 of NIS2 asks whether your security measures are appropriate, proportionate, and operating — a higher bar than owning a firewall and a policy PDF. A practical walk-through of the ten Article 21(2) measures, where mid-market teams fall short, and how an existing ISO 27001 programme maps onto them.
Read article →Threat-Led Penetration Testing sits at the demanding end of DORA's testing regime — intelligence-led red-teaming against live production systems. What TLPT actually requires under Chapter IV, who competent authorities designate for it, what a cycle involves, and the readiness gaps financial entities hit in their first round.
Read article →If you run or manage a small or mid-sized business in Luxembourg, Germany, or elsewhere in the EU, the cybersecurity rulebook now looks crowded: NIS2, DORA, the Cyber Resilience Act, the AI Act, CER, and sector-specific instruments all appear in the same conversations. The practical question is not "which regulation is most important?" It is "which legal trigger applies to what we actually do?"
Read article →For owners and managing directors of Luxembourg SMEs who have just heard that NIS2 might apply to them — and want to know what they are personally on the hook for before anyone says the word "audit."
Read article →DORA's ICT third-party risk requirements have applied since 17 January 2025 under Regulation (EU) 2022/2554 Article 64 . For Luxembourg financial entities supervised by CSSF or CAA, those requirements sit alongside national implementation through the Luxembourg Law of 1 July 2024 and the CSSF circular framework for ICT third-party services .
Read article →When a mid-market business needs to improve cybersecurity governance, the first gap is often operating capacity. There may be no CISO. The IT manager may already be handling infrastructure, support, vendors, and incidents. Then a regulatory requirement arrives: NIS2 management-body accountability, a DORA ICT risk framework, ISO 27001 customer pressure, or a customer audit that asks for evidence the organisation has never had to maintain in one place .
Read article →The EU Cyber Resilience Act, Regulation (EU) 2024/2847, introduces mandatory cybersecurity requirements for products with digital elements placed on the EU market . It is horizontal: it does not target one sector in the way NIS2 or DORA does. It targets the product and the economic activity around that product: manufacturing, importing, distributing, and making products with digital elements available in the EU .
Read article →
