GRC Lab

GRC Lab

Home
Chat
Exam Vouchers
About
Risk Management for Dummies
I remember sitting in security meetings at the very start of my career, feeling completely lost.
 • Aron Lange
How to get ISO 27000 for FREE (legally)
Most people think you have to pay hundreds of dollars for any official ISO standard.
 • Aron Lange
8:31
The All-New C5:2025 Catalogue
A Practical Guide to the New Cloud Security Standard
 • Aron Lange
C5:2026 – The New Standard for Cloud Security is Here
The German Federal Office for Information Security (BSI) has officially released the final version of the Cloud Computing Compliance Criteria Catalogue…
 • Aron Lange
Qualitative vs. Quantitative: Which Risk Analysis wins?
Plus: What a volcano in Hawaii teaches us about ISO 27001 and risk acceptance criteria.
 • Aron Lange
15:35
A Smarter Way to Audit Personnel Security
Why you should audit the employee lifecycle and pull in some IT controls as well.
 • Aron Lange
Is ISO 42001 Really about AI "Governance"?
“AI Governance” is now firmly in the buzzword hall of fame.
 • Aron Lange
Major, Minor, or Just an OFI? Test your audit IQ.
You are sitting in a conference room.
 • Aron Lange
Your ISMS Scope and Your Certification Scope Are Not the Same Thing
Here’s a question I get surprisingly often from people preparing for ISO 27001 certification: “Does our certificate have to cover our entire…
 • Aron Lange
I've Been Teaching ISO 27001 in the Wrong Order
If you’ve followed my work on implementing ISO/IEC 27001, you’ll know I teach it as a 12-step project.
 • Aron Lange
7:00
Updates in ISO 27000:2026 I did not expect
I really did not expect those...
 • Aron Lange
258 auditors voted. Only 11% got it right.
From the “Test Your Auditor IQ” series
 • Aron Lange
© 2026 Lange Advisory GmbH · Privacy ∙ Terms ∙ Collection notice
Start your SubstackGet the app
Substack is the home for great culture