Category: Blog

ITSecOps, Sophos MDR, Huntress, Blackpoint, SentinelOne Vigilance, CrowdStrike Falcon Complete and Arctic Wolf compared on response, platform, white-label and price per device.

EDR is the software, MDR adds a 24/7 team, XDR widens the telemetry. A decision guide with 2026 prices and the cyber-insurance angle.

Updated August 2026 More than 350 organisations now hold ISO/IEC 42001:2023 certificates — from AWS, Microsoft and Anthropic to 100-person SaaS companies. The pattern across their case studies is consistent: certification takes 3–12 months, the hard work is the AI system inventory and impact assessments, and companies that automated evidence collection certified in roughly half […]

NIST 800-171 is the control standard — 110 security requirements for protecting Controlled Unclassified Information. CMMC is the DoDu2019s program for verifying you actually meet it: Level 1 self-assessment for FCI, Level 2 assessment against all 110 NIST 800-171 controls, Level 3 for the most sensitive programs. One is the ruler, the other is the […]

24/7 SOC monitoring costs a typical SMB $40–120 per user per month as a managed service, versus $1M+ per year to staff an in-house SOC. The managed price includes SIEM licensing, log ingestion, L1–L3 analysts, threat hunting and incident response coordination around the clock. This is the pricing and scoping guide we wish buyers had […]

ISO 27001 implementation takes most SMBs 3–6 months and follows nine steps: define scope, run a gap analysis, assess risks, write the Statement of Applicability, implement Annex A controls, document policies, train staff, pass an internal audit, then the two-stage certification audit. This guide gives you the full plan with realistic timelines and costs — […]

A C3PAO (CMMC Third-Party Assessment Organization) is a company authorized by the Cyber AB and accredited under ISO/IEC 17020 to conduct official CMMC Level 2 certification assessments of defense contractors. Only a C3PAO listed on the Cyber AB Marketplace can issue the assessment that leads to CMMC Level 2 certification — consultants, MSPs, and RPOs […]

ISO 27001 is a certifiable international standard for running an information security management system (ISMS); SOC 2 is a US attestation report where a CPA firm audits your controls against the Trust Services Criteria. Rule of thumb: selling to European or global enterprises → ISO 27001; selling SaaS to US companies → SOC 2 Type […]

A CMMC compliance checklist has two tracks: Level 1 (17 basic safeguarding practices, annual self-assessment, for Federal Contract Information) and Level 2 (all 110 NIST SP 800-171 controls, SPRS score plus possible C3PAO assessment, for Controlled Unclassified Information). The practical work falls into six phases: scope, gap-assess, plan, remediate, document, and assess. This checklist reflects […]

NIST SP 800-171 defines 110 security requirements, organized into 14 control families, that any organization handling Controlled Unclassified Information (CUI) must implement. Each control carries an official DoD SPRS point weight of 5, 3, or 1, and a perfect self-assessment score is 110 (the scale starts at -203). This page lists every control with its […]