BLOG

From the practitioner's desk

Notes on GRC, compliance frameworks and running it all inside your own network.

2 posts found

12 August 2026 · By P LarnerBlog post

The Statement of Applicability ISO 27001's Most Misunderstood Document

The Statement of Applicability is where ISO 27001 audits are won or lost. What it is for, how to justify exclusions, and how to keep it current.

Compliance in Practice #Annex A #certification #audit #Statement of Applicability #ISO 27001

11 August 2026 · By P LarnerBlog post

ISO 27001 Annex A vs NIST SP 800-53 Choosing a Control Set

Ninety-three broad controls or a thousand fine-grained ones. How Annex A and SP 800-53 differ, and how to let the audience that must trust you choose.

Frameworks & Standards #Annex A #control sets #NIST SP 800-53 #ISO 27001 #FedRAMP