Page 4 of 4
Under SEBI's Cybersecurity and Cyber Resilience Framework, regulated entities need cyber audits by CERT-In empanelled auditors, half-yearly or yearly depending on their category.
A bridge letter covers the gap between the end of your last SOC 2 period and your next report. Customers usually accept one for a few months, not longer.
ISO/IEC 42001 applies management-system discipline to AI. If you already run an ISO 27001 ISMS, most of the scaffolding exists.
Evidence that cannot be found, dated or traced to a control gets requested again. A five-part file name fixes most of that before any tool is involved.
Three, six or twelve months: the right first observation window depends on how long your controls have run, what your buyers will accept and when you need the report.
The 2022 revision regrouped Annex A into four themes and added 11 controls. Here is what that means for your Statement of Applicability and your next surveillance audit.
DORA requires financial entities to maintain a register of all contractual arrangements with ICT third-party service providers, in a standard format supervisors can collect.
