about
what this is
A publication that turns EU cybersecurity rules into work: what to decide, who owns it, what to build and what proof it leaves.
who it is for
Boards and technical owners at EU companies of about 50 to 1000 people, implementing these rules for the first time, with no compliance team. Usually that means a director who has just been told this is now their signature, and a head of IT or an operations lead who has been handed the work.
the idea
One control can answer parts of several rules at once. So the useful unit is the job, and each job should leave proof you can reuse. The map is the whole idea on one page.
how it is checked
- The explanation comes first. Each section says what it means in practice. A small basis note names the article, and each page lists its texts at the bottom.
- Every page shows when it was last checked, and the texts were opened and read on that date. Rules move: the AI Act's high-risk dates changed in July 2026.
- What is working practice says so. Where no legal text sets something, the basis note says that.
- What could not be read at source is labelled. ISO 27001 and the SOC 2 criteria are paid or gated, and their pages say so.
- Nothing is invented. There are no made-up clients, costs or testimonials, and illustrations say "picture". No time or cost estimates appear, because no reliable source for a company your size was found.
what it does not do
- It does not recommend or compare vendors or products. A company name appears only when it is part of a public enforcement record.
- It does not give legal advice or sell advisory services.
if something is wrong
Rules change and readers notice first. Send the page and the article to hello@compliance.fyi, and tell us which date you checked it.