Every framework your buyers ask about, explained and tested.

The report enterprise buyers ask for first. Learn the five Trust Services Criteria, Type I vs Type II, and where penetration testing fits.

The report your customers' auditors ask for when you touch their financial data. Type I vs II, ITGCs, user entity controls, and how SOC 1 differs from SOC 2.

The international standard for an information security management system. Clauses, the 93 Annex A controls, and how certification works.

The payment card standard in plain English: the 12 requirements, SAQ vs ROC, and what Requirement 11.4 says about penetration testing.

How to pass vendor security reviews faster: questionnaires (SIG, CAIQ), evidence packs and the vendor risk lifecycle.

The Privacy, Security and Breach Notification Rules explained, with the three safeguard types and risk analysis expectations.

Six functions, 22 categories and four tiers. A flexible way to organise and communicate your security programme.

The Saudi National Cybersecurity Authority baseline: four domains, what assessors look for, and the testing evidence that backs each control.

The Saudi cloud security controls for providers and the organisations that use them. Who is in scope, what is tested and how it builds on ECC.

The Saudi data cybersecurity controls: protecting data across its lifecycle, how they relate to ECC and what testing evidence supports them.

Saudi Arabia’s PDPL in plain language: SDAIA oversight, transfer rules, breach notice and the security testing evidence that backs it up.

The UAE federal data protection law in plain language, with honest notes on its implementation status and how it sits beside DIFC and ADGM.

Oman’s data protection law in plain language: the 2026 enforcement date, 72-hour breach notice, DPO duties and testing evidence.

Three MENA privacy laws in one guide: Qatar PDPPL, Bahrain PDPL and Egypt’s Law 151, with status notes and testing evidence.

Data protection law and cyber expectations for firms in the Dubai International Financial Centre and Abu Dhabi Global Market, and how to prepare.

India’s DPDP Act and Rules explained: consent, data fiduciary duties, Section 8(5) security safeguards and the penalty tiers.

What SEBI's CSCRF and the RBI's IT and cyber rules ask of regulated entities, banks and NBFCs, including VAPT and audit expectations.

Seven principles, six lawful bases and the 72-hour breach clock. See how Article 32 security testing fits your obligations.

EU resilience rules for financial entities (DORA) and essential and important entities (NIS2): reporting clocks, TLPT and supplier risk.

Security rules for every connected product sold in the EU: essential requirements, vulnerability handling, reporting clocks and support periods.

Australia’s privacy law: APP 11 security duties, the Notifiable Data Breaches scheme, the 2024 reforms, new penalties and what testing evidence helps.

APRA’s standards for banks, insurers and super funds: information security capability, critical operations, service provider risk and assurance.

The security, privacy and safety assessment Australian and New Zealand education departments use for school technology. What it covers and how vendors prepare.