Articles, courses, downloads, and a free security, privacy and compliance glossary - practical guidance you can use across your team.
News, insights, and practical guidance on security, privacy, and cyber resilience.
Cyber Resilience Act
A guide to the EU Cyber Resilience Act (CRA) that provides the overview of the most important aspects, such as, who it applies to, key compliance dates, product risk categories, SBOM and vulnerability-reporting requirements, potential penalties, and the difference between the CRA and NIS2.
Cyber Resilience Act
Awareness of the Cyber Resilience Act is rising faster than operational readiness. Survey evidence from German industry, European SMEs, and the global open-source ecosystem shows where product teams still need ownership, evidence, and supplier information.
Cyber Resilience Act
Learn who must report under the EU Cyber Resilience Act, which cybersecurity events trigger reporting, the 24-hour and 72-hour deadlines, and how to prepare your team.
Structured learning for people and teams who need security, privacy, and compliance habits they can keep.
A practical live webinar for software and connected-product teams selling in the EU. Translate the 11 September Article 14 reporting milestone into product ownership, triage, and a 30-day readiness plan.
A free, beginner-friendly introduction to safer everyday internet habits.
AI tools can make work faster, but they can also expose sensitive business information. A live, practical course for safer AI use at work.
Guides, checklists, and tools you can use today.
Take a short applicability assessment and get a preliminary result with next steps.
Plain-language definitions for GDPR, ISO 27001, DORA, the EU AI Act, the Cyber Resilience Act, and related terms. This is a short preview - open the full glossary to browse by letter.
General Data Protection Regulation. The EU law that sets rules for processing personal data, including lawful bases, individual rights, security, and accountability for controllers and processors.
Digital Operational Resilience Act. EU rules for financial entities covering ICT risk, incident reporting, testing, and oversight of critical ICT third-party providers.
EU product-security law for products with digital elements. It expects manufacturers to design, maintain, and document security throughout the product lifecycle, including vulnerability handling.
The European Union’s risk-based law for AI systems. Obligations scale with risk, from transparency for some uses to strict requirements for high-risk systems affecting safety or fundamental rights.
An international standard for establishing, running, and improving an ISMS. Certification is optional; the value is a repeatable way to manage risk, controls, and evidence.
The rules and technical measures that decide who can view, change, or use information, systems, and services. Proportionate access control limits privileges to what people need for their role.
Building data-protection into products and processes from the start, rather than adding a notice at the end. It covers minimisation, purpose limits, security, and user rights in everyday workflows.
The unsanctioned use of AI tools with work data. It can leak information, create unapproved processing, and bypass security or privacy rules unless teams have clear, usable alternatives.
Browse insights from Boxfish Labs, or get in touch to talk through what your team needs next.
