Organisational policy that defines the requirements for integration between security monitoring and the incident response process (IRP), including activation criteria, mandatory playbooks, response phases, regulatory notification, post-mortem and periodic testing, proportional to the criticality level (L1, L2, L3).
Practical roadmap for implementing SbD-ToE in line with the requirements of Regulation (EU) 2024/1689 (AI Act) - mapping of articles to actions, by role and risk category
Practical roadmap for using SbD-ToE as the technical basis for the CRA in a product context, with complementary regulatory formalisation
Practical roadmap for implementing SbD-ToE in line with DORA requirements - direct mapping of articles to actions
Practical roadmap for aligning SbD-ToE with the technical requirements of the GDPR
A practical roadmap for using SbD-ToE as the basis for NIS2 implementation, with additional regulatory formalisation where applicable
Reusable templates and practical examples for implementing SbD-ToE principles in any normative framework