Guides
Ask a Vendor for an SBOM
CISA’s 2026 minimum elements apply to SaaS and AI software. Ask for the fields, the format, and the date. A slide is not a bill of materials.
Section
Guides
Checklists for the decision in the briefing: permissions, ingredients lists, dates, and the renewal.
Guides
Extra Questions for an AI Bill of Materials
The May 12, 2026 G7 and CISA note is an add-on, not a replacement. A model name with no components is not an ingredients list.
Guides
Limit What an Agent Can Touch
In Gartner’s second-quarter survey of 297 security leaders, 54% have no defined limit on agent access, or they reuse a person’s access.
Guides
Stop Using a Voice as Approval
Gartner’s September 30 note: do not authorize a decision because someone recognized a face or a voice. Pair detection with another authenticator and a provenance check.
Guides
What Article 50 Asks a Buyer
Transparency has applied since August 2, 2026. The December 2, 2026 date is a marking transition for systems already shipping, not a delay of the whole Act.
Guides
The Cloud Shared-Responsibility Checklist
AWS’s model is security of the cloud versus security in the cloud. A managed database does not move your backup duty. An EC2 instance does not move the patch duty.
Guides
What Belongs in a Processor Clause
The Commission adopted two different sets of standard clauses on June 4, 2021. One governs a processor inside the EEA. The other governs a transfer out. Do not sign the wrong PDF.
Guides
Before the Form 8-K Clock
The SEC’s clock is four business days from the materiality determination. Write down who can make that call, and what a private vendor must be able to say.
Guides
A One-Page AI Use Rule
NIST’s AI RMF 1.0 is voluntary and organized as Govern, Map, Measure, and Manage. Use those four lines. Cite the version. A revision is in progress.
Guides
Questions Before a Post-Quantum Pilot
Gartner’s September 30 note: start a pilot, or expect at least double the migration cost after 2027. Fifty-one percent of surveyed CISOs had not started.
Guides
Cyber Insurance Checklist for Mid-Market IT Budgets (2026)
MFA, EDR, immutable backups, IR retainer, and who owns broker versus IT while rates are still walking down.
Guides
When Cloud Repatriation Is a Finance Decision, Not an Engineering Slogan
Cost drivers, FinOps questions, and stay-versus-leave — with a labeled list-price egress example, not a fake calculator.
Guides
How to Tell AI Spend from AI Return
Seat cost versus token cost, pilot versus production, and questions a board can ask. No guaranteed-return claims.
Guides
Software Buying as an Operating Skill
RFP basics, seat waste, who signs, and the three SaaS-management jobs. The stack is the company.
Guides
How to Read a SaaS Renewal
A 90-day pass: seats, overlap, price, and the exit before you answer the increase.
Guides
What a Cyber Insurer Will Still Ask
MFA, EDR, backups, privilege, retainer — even when rates are falling.
Guides
Put an AI Cost on One Workflow
Tokens, review time, and rework on a single process with a definition of done.