Roadmap
SOC 2
Roadmap area for trust-service criteria, evidence mapping, and ISO/NIS2 crosswalks.
Research Notes
A compact framework tree for cybersecurity compliance guidance, controls, evidence, and templates.
Frameworks
Browse by standard first
Active
ISO27001
ISMS requirements, Annex A control domains, implementation guidance, evidence packs, and audit-ready templates.
Active
ISO27002
Implementation-oriented control guidance, attributes, mappings, and control interpretation references.
Active
ISO27005
Information security risk management notes and links between risk scenarios, controls, treatment, and evidence.
Active
GDPR
EU personal-data protection requirements translated into processing decisions, engineering controls, operating evidence, and accountable governance.
Roadmap
NIS2
Roadmap area for EU NIS2 transposition tracking, entity scope, obligations, and ISO/SOC 2 mappings.
Default path
Start with ISO27001
The first level is the framework. The second level is the domain: clauses, control families, implementation guides, evidence, templates, and risk crosswalks.
Overview & fundamentals
Start here for the ISMS model, Statement of Applicability, policy structure, roles, and core implementation concepts.
Clauses 4-10
The management-system clauses that define context, leadership, planning, support, operations, evaluation, and improvement.
Annex A Organizational Controls
A.5 controls for governance, policies, suppliers, incidents, business continuity, legal requirements, and information handling.
Annex A People Controls
A.6 controls for screening, employment terms, awareness, disciplinary process, termination, confidentiality, remote work, and reporting.
Annex A Physical Controls
A.7 controls for physical perimeters, entry, secure areas, monitoring, environmental threats, equipment placement, and clear desk/screen.
Implementation Guides
Practitioner guidance for turning ISO requirements into implementation plans, operating artifacts, and control ownership.
Audit Evidence
Evidence packs, audit questions, implementation proof, registers, and records that help prove controls are operating.
Risk & crosswalks
Risk treatment, ISO 27005 links, GRC mappings, control relationships, and cross-framework translation notes.
Exam preparation
Study notes and control distinction cues for ISO 27001, ISO 27002, and ISO 27005 learning paths.