161 security guides
Practical, source-backed guides on securing real deployments: pre-launch checklists, exposed secrets, security headers, and platform-specific misconfigurations.
ISO compliance means following the requirements of a specific ISO standard through internal policies and procedures, without needing a third - party audit.
ISO standards are consensus - based documents that define best - practice specifications for products, processes, and services worldwide, helping organizations improve quality, safety, and trade.
ISO standards provide voluntary frameworks for quality, security, environment, and more. This guide explains the most common ISO compliance standards, their certification options, and practical steps to adopt them.
ISO 37301:2021 is the global certifiable standard for compliance management systems, applicable to any organization. This guide explains its structure, key requirements, and practical steps to achieve certification.
ISO 9001 defines a quality management system, ISO 14001 sets an environmental management system, and ISO 45001 establishes an occupational health and safety system. All three share a common structure and improvement cycle, making integrated compliance easier.
Learn the ten essential DORA requirements, from ICT risk management to incident reporting, and get concrete steps to achieve EU digital operational resilience compliance.
A practical, step - by - step checklist that shows exactly what to document, test and retain to satisfy each DORA pillar and pass supervisory review.
The Digital Operational Resilience Act (DORA) is built around five pillars that define ICT risk management, incident handling, testing, third - party oversight, and information sharing.
The EU AI Act becomes fully enforceable on 2 Aug 2026, imposing risk - based rules, transparency duties for synthetic content, and hefty fines for non - compliance.
A concise, technical summary of the EU AI Act’s scope, risk tiers, prohibited practices, high - risk obligations, and compliance timeline for developers and companies.
The EU AI Act 2024 introduces a risk - based framework, bans the most harmful AI uses and sets steep fines, with staggered rollout through 2025 - 2027.
The EU AI Act creates a risk - based legal framework for AI, bans the most harmful uses, and sets staggered compliance deadlines through 2028.
The 2026 Digital Omnibus amendments bring new transparency rules, GPAI obligations, bans on harmful AI uses, and shifted timelines for high - risk compliance, reshaping how AI providers must prepare for the EU market.
The NIST Cybersecurity Framework (CSF 2.0) is a voluntary, sector - neutral set of guidelines that helps any organization understand, assess, prioritize, and communicate cybersecurity risk. This guide explains its structure, tiers, profiles, and practical steps to get started.
NIST exists to promote U.S. innovation and industrial competitiveness by advancing measurement science, standards, and technology that strengthen economic security and improve quality of life.
NIST does not issue a generic certification; it validates specific products and lets organizations demonstrate compliance with its frameworks through validation certificates or third - party assessments.
ISO certification is a third - party assurance that your management system meets a specific ISO standard, issued by an accredited certification body after a two - stage audit.
ISO is the International Organization for Standardization that publishes globally recognized standards like ISO 9001 and ISO 27001, helping businesses improve quality, security, and market access.
SOC 2 Type 1 is a point - in - time attestation that a service organization’s controls are suitably designed to meet AICPA Trust Services Criteria, but it does not test their operating effectiveness over time.
SOC 2 is voluntary by law but has become a de - facto requirement for any service organization that stores, processes, or transmits customer data for other businesses. This guide explains which industries must have a report and which typically do not.
Learn DORA’s MFA and logging requirements, how to implement phishing - resistant authentication, and use Decloak’s free scan to verify your public login pages for misconfigurations.
SOC 2 has no AI - specific criteria, but auditors now expect AI - focused evidence mapped to the five Trust Services Criteria. This guide shows what to provide and how to document it.
SOC 2 Security (the mandatory Security trust services criterion) requires concrete controls like MFA, RBAC, encryption, logging and continuous evidence. This guide shows exactly what to implement and how to prove it.
SOC 2 compliance is an attestation that a service - organization’s controls meet the AICPA Trust Services Criteria, providing assurance that customer data is protected. It’s voluntary but often contract - required for SaaS providers.
A concrete, vendor - agnostic checklist walks you through planning, risk assessment, remediation, audit engagement and ongoing maintenance for SOC 2 Type I or Type II compliance.
SameSite tells browsers when to send a cookie, protecting against CSRF and cross - site tracking. Choose Strict, Lax, or None + Secure and test your flows to avoid breaks.
A SOC 2 compliance checklist turns the Trust Services Criteria into concrete, step - by - step tasks for planning, implementing, and evidencing controls needed for a successful audit.
A complete audit trail records who acted, what happened, when, where, why and how, using standardized fields that support forensics, compliance and tamper - evidence.
Learn the five main security audit types - compliance, vulnerability assessment, penetration testing, risk assessment, and internal vs external audits - with concrete steps, evidence needed, and how they fit together.
SameSite=Lax blocks cookies on most cross - site requests while allowing link navigation, whereas SameSite=None sends cookies everywhere but requires the Secure flag. Choose the right setting to balance CSRF protection and cross - origin functionality.
Free security scan
Decloak's free scan runs in about 15 seconds, no account required, and covers: