Policies, Compliance & Risk

Short policies people follow, risk assessments that change decisions, and audit evidence pulled from the line itself.

From the framework to the line

Each control maps to evidence your line already produces. Nobody takes a screenshot.

The framework asks	The control	The evidence, from the line
SOC 2 · CC8.1 change management	Every change reviewed and approved	Merged PRs with approvals, exported monthly
SOC 2 · CC6.1 logical access	Production access by role, reviewed	IAM review record for each release
DORA · Art. 28 third-party risk	Dependencies and vendors tracked	An SBOM per build, plus the vendor list
DORA · Art. 24 resilience testing	Testing after every major change	Pentest tickets and retest results
ISO 27001 · A.8.28 secure coding	Code scanned, risky paths reviewed	Scan results and review comments on PRs

Pick a step, or let it play. Every line is what someone in the room actually says.

SOC 2, ISO 27001, DORA, NIS2, CRA: what you actually need.

CISOPartners ask for SOC 2. The bank partner asks for DORA.

ATALAIAThen those two. ISO can wait; most controls overlap.

Leaves the roomFrameworks: SOC 2 and DORA

One page each, owned by a person.

ATALAIANine policies, one page each, each with a person's name on it.

DEV LEADOne page I'll actually read.

Leaves the room9 policies, one page, one owner

Controls proven by the line, not by screenshots.

ATALAIAChange-management evidence comes from merged PRs and approvals.

PLATFORMSo no screenshots this year?

ATALAIANone. The pipeline exports it every month.

Leaves the roomEvidence from pipelines and tickets

A method, a cadence and decisions recorded.

ATALAIAPartner webhook without signatures: likelihood medium, impact high.

CTOFixed next quarter. We accept it until then.

CISORecorded, with an expiry date.

Leaves the roomRisk register, decisions recorded

Before

Policies written for auditors are not read by engineers. Evidence gathered by hand once a year is late and expensive.

After

Typical shape: Four to eight weeks, then quarterly reviews.

Every station reports to the same tower. These are the neighbours.

From a team of one to a working program

Roles, managers, KPIs and budget

SBOM, provenance, signed builds

A 30-minute call. No slides, no price list, and a next step either way.