Raize Orion ComplianceBlog
Practical writing for the founding engineer running compliance on the side of a product roadmap. No vendor-marketing puffery — opinions you can disagree with.
- Compliance2026-10-26 9 min read
SOC 2, ISO 27001 and the EU AI Act — without doing the work three times
SOC 2, ISO 27001 and the EU AI Act (or NIST AI RMF) share one spine: risk, access, logging, incidents, vendors. Map to one control set and run it once.
Read post → - Compliance2026-10-26 8 min read
Choosing an ISO 42001 compliance platform: what actually matters
ISO 42001 is a certifiable AI management system, not a checklist. The seven things that matter when choosing a platform to run it — and who needs it when.
Read post → - Product2026-10-26 7 min read
Is Secureframe worth it? The cost-vs-capability math for multi-framework teams
Is Secureframe worth it? Honest answer: it depends what the entry plan actually covers. The cost-vs-capability math for teams running 2+ frameworks.
Read post → - Compliance2026-06-14 10 min read
The SOC 2 readiness checklist: what auditors actually look for
A practical SOC 2 readiness checklist: TSC scoping, the nine control areas auditors test, Type I vs Type II, and the gaps that fail first-time programmes.
Read post → - Compliance2026-06-13 8 min read
Do we need ISO 27001 or SOC 2? (Yes.)
ISO 27001 or SOC 2? Honest answer: whichever one your customer is withholding a signature over. How to decide — and why you will likely do both.
Read post → - Product2026-06-13 7 min read
Your compliance dashboard is quietly ignoring your vendors
Vendor questionnaires come back, get filed, and never touch your live compliance posture. Here is the gap — and what Raize Orion does differently.
Read post → - Compliance2026-06-13 9 min read
Control mapping and continuous monitoring: stop auditing the same control five times
Control mapping is the backbone of multi-framework compliance. How to map once and monitor everything, instead of collecting the same evidence five times.
Read post → - Compliance2026-06-03 7 min read
When a customer ticket starts your reporting clock
When a customer ticket starts your NIS2 Art. 23 / GDPR Art. 33 reporting clock: defending "awareness was reasonably expected" for the upstream signal.
Read post → - Founder2026-05-20 4 min read
Why we built Raize Orion
Most GRC platforms are priced for the auditor, not the team using them daily. Raize Orion is built for the founding engineer running compliance.
Read post → - Compliance2026-05-19 7 min read
A 6-month SOC 2 roadmap for first-time founders
What to actually do, week by week, to go from no compliance program to a Type I report in six months. Budget £30-40k year one, including the auditor.
Read post → - Product2026-05-18 5 min read
Where Raize fits next to Vanta, Drata, and Secureframe
The incumbent GRC platforms are excellent if you have the budget. Raize is built for the segment that does not. Here is how the trade-offs actually land.
Read post →