Secantra — ResourcesArticles and guides on DORA, NIS2 and ISO 27001 programmes: how requirements become scope, how scope becomes evidence, and what auditors actually ask for.https://www.secantra.comenWhat a new framework version changes — and what it must never touchhttps://www.secantra.com/blog/what-a-framework-version-update-changeshttps://www.secantra.com/blog/what-a-framework-version-update-changesA framework pack gets a new version. Which applicability decisions carry over, which need review, which are gone — and why the old adoption must stay frozen.Tue, 01 Sep 2026 00:00:00 GMTFramework versionsApplicabilityAudit trailAnnex ACurated packsSecantra editorialISO 27001 clause 9 without the slide deck: internal audit and management review on a derived posturehttps://www.secantra.com/blog/iso-27001-clause-9-derived-posturehttps://www.secantra.com/blog/iso-27001-clause-9-derived-postureClause 9 asks for monitoring, internal audit and management review. When posture is computed from records, the review is a delta between two frozen snapshots.Mon, 31 Aug 2026 00:00:00 GMTISO 27001Clause 9Internal auditManagement reviewPostureSecantra editorialNIS2 incident reporting: the 24-hour, 72-hour and one-month path as a runbook, not a policyhttps://www.secantra.com/blog/nis2-incident-reporting-24-72-one-monthhttps://www.secantra.com/blog/nis2-incident-reporting-24-72-one-monthArticle 23 sets three deadlines and asks different questions at each. Who decides "significant", who notifies whom, and which records the answers come from.Sun, 30 Aug 2026 00:00:00 GMTNIS2Article 23Incident reportingRunbookCSIRTSecantra editorialA backup restore drill is evidence — if you record it like onehttps://www.secantra.com/blog/backup-restore-drill-is-evidencehttps://www.secantra.com/blog/backup-restore-drill-is-evidenceDORA, NIS2 and ISO 27001 ask whether you can restore, not whether you back up. What turns a restore test into evidence: date, scope, control, the gap it found.Sat, 29 Aug 2026 00:00:00 GMTEvidenceBackupRestore testingDORANIS2ISO 27001Secantra editorialThe DORA register of information in 30 minutes: a walkthrough of the checklisthttps://www.secantra.com/blog/register-of-information-in-30-minuteshttps://www.secantra.com/blog/register-of-information-in-30-minutesRun the register-of-information checklist with three people in half an hour: which records to open first, what "Partly" usually means, and what to do next.Fri, 28 Aug 2026 00:00:00 GMTDORARegister of informationThird partiesChecklistWalkthroughSecantra editorialFour-eyes per flow: what a second approver actually changes — and when a single-admin tenant may switch it offhttps://www.secantra.com/blog/four-eyes-per-flowhttps://www.secantra.com/blog/four-eyes-per-flowSegregation of duties is only real when the system refuses a self-approval. Which three flows carry it, what an approver may do, how an exception is audited.Thu, 27 Aug 2026 00:00:00 GMTFour-eyesSegregation of dutiesGovernance documentsRisk acceptanceAudit trailSecantra editorialEvidence recency: why "twelve months" is not a rule, and what to measure insteadhttps://www.secantra.com/blog/evidence-recency-twelve-months-is-not-a-rulehttps://www.secantra.com/blog/evidence-recency-twelve-months-is-not-a-ruleAuditors do not ask how old evidence is; they ask whether it still shows the control operating. Measure recency per control against its own review period.Wed, 26 Aug 2026 00:00:00 GMTEvidenceRecencyControlsPostureAuditSecantra editorialProvider → service → function: the three links most third-party obligations read back tohttps://www.secantra.com/blog/provider-service-functionhttps://www.secantra.com/blog/provider-service-functionDORA Art. 28, NIS2 Art. 21(2)(d) and ISO 27001 supplier controls all assume you know which provider delivers which service to which function. Model it once.Tue, 25 Aug 2026 00:00:00 GMTThird partiesDORANIS2Supply chainCMDBRegister of informationSecantra editorialApplicability has five scopes — and "tenant-wide" is usually the wrong first answerhttps://www.secantra.com/blog/applicability-has-five-scopeshttps://www.secantra.com/blog/applicability-has-five-scopesA requirement rarely applies to a whole organisation. Deciding applicability per asset, IT service, business solution or process makes "not applicable" hold up.Mon, 24 Aug 2026 00:00:00 GMTApplicabilityScopeCMDBStatement of ApplicabilityEvidenceSecantra editorialThe DORA testing programme is a scoping problem before it is a testing problemhttps://www.secantra.com/blog/dora-resilience-testing-programmehttps://www.secantra.com/blog/dora-resilience-testing-programmeDORA Article 24 asks for a yearly, risk-based testing programme. The hard part is not the test: it is deriving scope from the inventory and closing every gap.Sat, 22 Aug 2026 00:00:00 GMTDORAResilience testingTLPTFindingsCMDBSecantra editorialWhy a compliance percentage should never be typed into a boxhttps://www.secantra.com/blog/why-a-compliance-percentage-should-never-be-typedhttps://www.secantra.com/blog/why-a-compliance-percentage-should-never-be-typedA posture number somebody typed is a slide, not a fact. What deriving posture from adoption, applicability, coverage and evidence means — and why you freeze it.Fri, 21 Aug 2026 00:00:00 GMTPostureEvidenceApplicabilityManagement reportingSecantra editorialThe Statement of Applicability is a decision log, not a checklisthttps://www.secantra.com/blog/statement-of-applicability-is-a-decision-loghttps://www.secantra.com/blog/statement-of-applicability-is-a-decision-logISO/IEC 27001 asks for the one thing most SoAs lack: the reason. Keeping applicability, justification and implementation status as records that outlive audits.Thu, 20 Aug 2026 00:00:00 GMTISO 27001Statement of ApplicabilityAnnex AEvidenceApplicabilitySecantra editorialNIS2 Article 21: ten measure areas, one inventory — where to start when the deadline has already passedhttps://www.secantra.com/blog/nis2-article-21-where-to-starthttps://www.secantra.com/blog/nis2-article-21-where-to-startNIS2 Article 21 lists ten measure areas but never says which system they protect. Start from the inventory and the management-body decision, not a policy pack.Wed, 19 Aug 2026 00:00:00 GMTNIS2Article 21CMDBRisk managementManagement bodySecantra editorialThe DORA register of information: what the ESAs actually ask for, and where the data has to come fromhttps://www.secantra.com/blog/the-dora-register-of-informationhttps://www.secantra.com/blog/the-dora-register-of-informationThe DORA register is a prescribed template, not a product feature. Which linked records — providers, services, functions — must exist to fill it with no sheet.Tue, 18 Aug 2026 00:00:00 GMTDORAThird partiesCMDBRegister of informationSecantra editorial