Risk: articles and guides.
Every CloudSoul article on Risk, newest first.
ISO 27001 risk register: what it must contain, a template, and what auditors check
ISO 27001 requires every risk to have an owner, a level scored against your own criteria, a treatment, and the owner's acceptance of what remains. What the register must contain, a copyable template, and what auditors check first.
NIS2 supply chain security: how to assess supplier risk under Article 21
NIS2 makes supply chain security one of the ten minimum measures. You must assess each direct supplier's vulnerabilities, product quality and security practices, and take EU coordinated assessments into account. The steps, the contract clauses and what Article 22 adds.
NIS2 all-hazards approach: what it means for physical and environmental security
NIS2 Article 21(2) requires measures based on an all-hazards approach that protects network and information systems and their physical environment. The hazards the recitals name, the rules for digital providers, the link with the CER Directive and a proportionate SME baseline.
NIS2 for the energy sector: which operators are in scope and what applies (electricity, gas, oil, hydrogen, heating)
NIS2 applies to electricity, district heating and cooling, oil, gas and hydrogen operators of an Annex I type that are at least medium-sized; large ones are essential. Scope by subsector, oil and gas, the electricity network code, the CER Directive and OT in practice.