ISO 27001 is an international standard for building and running an information security management system (ISMS). Organisations can be formally certified against it by accredited bodies.
The GDPR (General Data Protection Regulation) is the EU law governing how organisations collect, use, store and share personal data about people in the EU. It sets duties for businesses and gives individuals enforceable rights.
SOC 2 is an independent audit report on how a service organisation controls security and related risks, based on the AICPA Trust Services Criteria. Business customers often request it from software vendors.
A security audit is a structured review of systems, code, configuration or processes against a defined standard. It produces findings showing where security falls short and how to fix it.
Threat modeling is a structured way to identify what could go wrong with a system's security during design. Teams then decide which risks to mitigate before code is written.
PCI DSS (Payment Card Industry Data Security Standard) is the security standard for organisations that store, process or transmit payment card data. It sets controls to protect cardholder information from theft and misuse.
A clear proven process, that delivers
You've seen our ideas - now go deeper.
Discover more insights, guides, and engineering practice.