the work
The jobs most of these rules ask for. Each page says what to decide, who owns it, what to build, what evidence it leaves and what goes wrong.
- incident reportingOne event can start three clocks at once, each to a different authority. The hours are easy to remember. The hard part is that someone must be allowed to say this counts before the investigation is finished.
- supplier riskYour suppliers' failures count as yours. Three rules ask for the same thing: know who they are, look at them in proportion, and put security in the contract.
- the board's partSecurity decisions now need a director's signature. A board does not have to understand firewall rules. It has to see risks, cost and choice, decide, and be able to show that it did.
- access controlWho can get in, who said so, and when someone last checked. Every rule asks the same thing in slightly different words, which makes this the most reusable work on the site.
- risk assessmentEvery rule says appropriate to the risk. Without a written assessment you cannot show that anything you did was appropriate, and you have no honest way to do less.
- backups and recoveryA backup counts once you have restored from it. One timed restore tells you more than a plan, and it leaves a record that shows the control runs.
- trainingThree rules ask for training, and the AI Act adds its own. One small programme with one attendance record answers them all. The failure that shows up is having no record.
- patching and checking it worksPatch on a schedule you wrote down, handle the reports that come in, and test once a year whether the rest of your controls run. Companies skip the last part because nothing breaks when they do.
your next step
Not sure which of these touch you? Six questions will narrow it down.