SAMA CSF: What Maturity Level 3 Requires
The SAMA CSF is maturity-scored and level 3 is mandatory. What that requires, how much of ISO 27001 transfers, and why suppliers end up in scope.
Netru Compliance9 min read
Security HubWriting from the
Writing from the
engineers who fix it.
Practical cybersecurity and compliance writing. No vendor pitches, no recycled threat reports.
NHS DSP Toolkit: What Suppliers Need to Know
The DSP Toolkit now runs on the Cyber Assessment Framework for large NHS organisations. What changed, who completes which version, and what suppliers are asked.
Netru Compliance8 min read
GovAssure and the CAF: Selling to UK Government
GovAssure assesses government departments against the NCSC Cyber Assessment Framework. The five stages, what the CAF actually is, and why it reaches suppliers.
Netru Compliance8 min read
India's DPDP Act: Who It Reaches and What It Asks
The Digital Personal Data Protection Act reaches organisations with no presence in India. What it requires, and what changes if you already comply with GDPR.
Netru Compliance9 min read
The EU AI Act: What It Actually Requires, and When
The EU AI Act applies to providers outside the EU and phases in by date. What the risk tiers mean, what high-risk systems must do, and where ISO 42001 fits.
Netru Compliance8 min read
TISAX Explained: What Suppliers Need
TISAX is effectively mandatory to supply the German automotive industry. What the assessment levels mean and how it differs from ISO 27001.
Netru Compliance7 min read
Singapore PDPA: What Overseas Businesses Must Do
Singapore's PDPA requires a named DPO whose details are public, and breach notification within three days. What it demands and how it compares to GDPR.
Netru Compliance6 min read
HIPAA for Non-US Companies: When It Applies to You
HIPAA reaches overseas suppliers through Business Associate Agreements. What the Security Rule requires, what a BAA commits you to, and how SOC 2 relates.
Netru Compliance7 min read
SOC 2 vs ISO 27001: Which One Do You Actually Need?
They overlap heavily but answer different questions. How to choose, and what holding one buys you towards the other.
Netru Compliance8 min read
Cyber Essentials vs ISO 27001: Not a Real Comparison
One is a five-control technical baseline. The other is a management system certification. When each is enough, and why one says little about the other.
Netru Compliance6 min read
GDPR vs India's DPDP Act: What Actually Changes
If you run a GDPR programme and are entering India, most of the machinery transfers. The differences are lawful basis, consent, transfers and children.
Netru Compliance7 min read
Australia: Essential Eight and Privacy Act
What Australian buyers ask for: Essential Eight maturity levels, the Privacy Principles, and the notifiable breach scheme.
Netru Compliance7 min read
Saudi NCA ECC and UAE IA: What the Gulf Requires
What the Gulf markets require. Saudi NCA Essential Cybersecurity Controls, UAE Information Assurance Standards, and how much of ISO 27001 carries over.
Netru Compliance7 min read
Dark Web Monitoring for Engineering Teams
How the dark web works, what credential dumps and ransomware forums mean for your startup, and how to evaluate monitoring tools.
Netru Engineering7 min read