[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:iso-27001\u002Fa-5-36":3},{"item":4,"lessons":16,"controls":27,"related":33},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"iso-27001","a-5-36","Annex A 5.36","Compliance with policies, rules and standards for information security",0,"International Organization for Standardization (ISO) and IEC","**What it asks for.** Regularly check that the organisation's information security policy, topic-specific policies, rules and standards are actually being followed.\n\n**In practice.** Managers review compliance in their own areas, supported by technical checks such as configuration scanning, access reviews and policy as code. Where non-compliance is found, causes are analysed, corrective actions are agreed and tracked, and results are reported upwards. Formal exceptions are recorded with a risk owner and expiry date. Auditors look for a compliance monitoring schedule, results of reviews and scans, an exception register and evidence that actions were closed.\n\n**Common gaps.** Policies are often written and published but never measured, so nobody knows the actual compliance level. Exceptions are granted informally by email and never revisited, and technical baselines drift without being detected.",null,"https:\u002F\u002Fwww.iso.org\u002Fstandard\u002F27001","See the standard at ISO","2026-10-18T15:18:43.664+00:00",{"total":17,"list":18},2,[19,23],{"slug":20,"title":21,"published_at":22},"edpb-advances-global-data-protection-standards-and-targets-ai-decision-making-in-2027-enforcement","EDPB Advances Global Data Protection Standards and Targets AI Decision-Making in 2027 Enforcement","2026-11-11T15:20:54.198+00:00",{"slug":24,"title":25,"published_at":26},"municipality-reprimanded-for-deploying-ai-in-nursing-home-without-adequate-dpia","Municipality Reprimanded for Deploying AI in Nursing Home Without Adequate DPIA","2026-11-11T12:22:06.148+00:00",[28],{"slug":29,"name":30,"problem":31,"stories":32},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[34,39,43,47,51,56],{"family":35,"item":36,"code":37,"title":38,"together":17},"gdpr","35","Article 35","Data protection impact assessment",{"family":35,"item":40,"code":41,"title":42,"together":32},"22","Article 22","Automated individual decision-making, including profiling",{"family":35,"item":44,"code":45,"title":46,"together":32},"25","Article 25","Data protection by design and by default",{"family":35,"item":48,"code":49,"title":50,"together":32},"46","Article 46","Transfers subject to appropriate safeguards",{"family":52,"item":53,"code":54,"title":55,"together":32},"nis2","21-2-a","Article 21(2)(a)","Policies on risk analysis and information system security (Article 21(2)(a))",{"family":57,"item":58,"code":59,"title":60,"together":32},"nist-800-53","ra-3","RA-3","Risk Assessment"]