devguard: Your Compliance Platform
PlatformSolutionsFrameworksDevelopersPricing
Sign inStart for free
devguard

One workspace for your whole ISMS: Swiss-hosted, one control set, mapped to every framework you run.

All systems operational
Product
PlatformFeaturesSolutionsFrameworksPricing
Developers
API & CLIIntegrationsDocumentationChangelogSwiss hosting
Company
AboutBlogCompare
© 2026 devguard AG. All rights reserved.
Terms of servicePrivacy policySite noticeTrust centerLLM info
Swiss Made Software
Book a conversationStart for free
~/devguard/blog $ open issue-latestLatest issue Nº 25|25 issues|RSS feed
// the devguard dispatch

Compliance Blog

Engineering notes on surveillance audits, management reviews, evidence capture and keeping an ISMS alive between certificates.

all · 25audits · 12controls · 11evidence · 11nis2 · 10iso-27001 · 10supply-chain · 08risk · 07
++++
PINNEDIssue Nº 2516.10.2026lead article

Governing an AI client's read access to your ISMS

An assistant that queries your compliance data over MCP is an account. Here is what the MCP authorization spec guarantees, what a read-only boundary does and does not protect, and the account-management questions to answer before you connect one.

Read the article
VS
Vadim Sikora
Co-founder
reading_time
8 min
filed_under
ai-governance
controls

The index

ls --sort=time · 24
01Issue Nº 24

The CRA reporting portal, read before you need it

supply-chainAngelo Dini · 13.10.2026 · 9 min
02Issue Nº 23

Everyone does compliance, few should administer it

iso-27001Vadim Sikora · 07.10.2026 · 10 min
03Issue Nº 22

Pass, fail, error: what a scheduled check proves

evidenceVadim Sikora · 02.10.2026 · 7 min
04Issue Nº 21

Seeding a risk register from a threat catalog

riskVadim Sikora · 28.09.2026 · 7 min
05Issue Nº 20

Scan results as evidence: date, window, replacement rule

evidenceVadim Sikora · 24.09.2026 · 10 min
06Issue Nº 19

'Certified' is a claim with a document behind it

supply-chainAngelo Dini · 22.09.2026 · 7 min
07Issue Nº 18

What ISO 9001 and ISO 27001 share, clause by clause

iso-27001Vadim Sikora · 17.09.2026 · 9 min
08Issue Nº 17

Policy acknowledgement: who read which version, when

policiesVadim Sikora · 14.09.2026 · 8 min
09Issue Nº 16

What a training record has to prove under DORA and the GDPR

gdprVadim Sikora · 09.09.2026 · 10 min
10Issue Nº 15

The Mastra npm compromise, read as a compliance post-mortem

supply-chainAngelo Dini · 03.09.2026 · 6 min
$ ls --olderOlder posts
// keep in the loop

Follow the dispatch, or see it in action.

Start free, bring your frameworks, and keep the evidence attached as the work ships. No setup friction, no audit-week fire drill.

Book a conversationRSS feed

Stay audit-ready between certificates.

Start free, bring your frameworks, and keep the evidence attached as the work ships. No setup friction, no audit-week fire drill.

Start for freeBook a conversation
gdpr · 07
soc-2 · 04
policies · 04
ai-governance · 01
management-review · 01