https://spot-suite.com/blog/ Operating notes for regulated teams — identity, audit, residency, and vendor risk. en Thu, 16 Jul 2026 00:00:00 GMT https://spot-suite.com/blog/conditional-access-for-workload-identities/ https://spot-suite.com/blog/conditional-access-for-workload-identities/ Thu, 16 Jul 2026 00:00:00 GMT Entra Conditional Access can block service principals by location and risk — but only single-tenant ones, only with block as the grant control, and only with Workload ID Premium. The limits matter as much as the feature. https://spot-suite.com/blog/dpa-register-for-your-saas-stack/ https://spot-suite.com/blog/dpa-register-for-your-saas-stack/ Thu, 16 Jul 2026 00:00:00 GMT Every SaaS vendor processing personal data for you needs an Article 28 data processing agreement — and every one of those DPAs changes over time. What a working DPA register records, and why a folder of PDFs is not one. https://spot-suite.com/blog/iso-27001-annex-a-evidence-collection/ https://spot-suite.com/blog/iso-27001-annex-a-evidence-collection/ Thu, 16 Jul 2026 00:00:00 GMT ISO/IEC 27001:2022 Annex A lists 93 controls across four themes. Evidence means records that the control operates — not the policy that says it should. What to collect per theme, and how to make collection continuous. https://spot-suite.com/blog/managing-conditional-access-across-multiple-tenants/ https://spot-suite.com/blog/managing-conditional-access-across-multiple-tenants/ Thu, 16 Jul 2026 00:00:00 GMT Entra Conditional Access has no native cross-tenant policy sync. How MSPs and multi-tenant operators keep policies consistent: Lighthouse baselines, policy as code, drift detection, and per-tenant break-glass. https://spot-suite.com/blog/certificate-renewal-failure-modes/ https://spot-suite.com/blog/certificate-renewal-failure-modes/ Wed, 10 Jun 2026 00:00:00 GMT A certificate breaks on a Tuesday afternoon. The reason is almost always one of four things: a delegation that expired, an ACME rate limit, drift between issuance and the system serving traffic, or a cert nobody on the team knows exists. Monitoring catches one. The others need different controls. https://spot-suite.com/blog/cidr-conflicts-before-they-ship/ https://spot-suite.com/blog/cidr-conflicts-before-they-ship/ Wed, 10 Jun 2026 00:00:00 GMT A VNet peering ships on Friday. On Saturday, traffic from a branch office is black-holing into a range another tenant in the same subscription has been using for two years. The reason is a CIDR overlap that nobody caught, because the address space lived in three spreadsheets and one engineer\u2019s head. https://spot-suite.com/blog/file-transfer-chain-of-custody/ https://spot-suite.com/blog/file-transfer-chain-of-custody/ Wed, 10 Jun 2026 00:00:00 GMT Email and consumer file shares do not produce evidence. A custody record for a transferred file needs identity, timing, location, content fingerprint, and a signed receipt — plus retention that does not depend on someone remembering. https://spot-suite.com/blog/joiner-mover-leaver-without-an-it-desk/ https://spot-suite.com/blog/joiner-mover-leaver-without-an-it-desk/ Wed, 10 Jun 2026 00:00:00 GMT A 60-person company does not have an IT desk. It has an office manager, a controller, and a founder who resets passwords on a Sunday afternoon. The leaver who keeps a license and a laptop is the failure mode that JML is supposed to prevent. The question is what JML looks like without a ticketing system behind it. https://spot-suite.com/blog/dora-ict-third-party-register/ https://spot-suite.com/blog/dora-ict-third-party-register/ Tue, 02 Jun 2026 00:00:00 GMT Financial entities must maintain an up-to-date register of ICT third-party contracts at entity and consolidated levels and supply it to supervisors on request. https://spot-suite.com/blog/entra-conditional-access-for-saas-operators/ https://spot-suite.com/blog/entra-conditional-access-for-saas-operators/ Tue, 02 Jun 2026 00:00:00 GMT Microsoft Entra Conditional Access evaluates signals at sign-in time to enforce per-tenant policies while preserving isolation between customer organisations. https://spot-suite.com/blog/finops-concentration-risk-dora/ https://spot-suite.com/blog/finops-concentration-risk-dora/ Tue, 02 Jun 2026 00:00:00 GMT DORA requires financial entities to assess concentration risk from ICT third-party providers; structured cloud spend data forms one input to that assessment. https://spot-suite.com/blog/iso-27001-2022-after-transition/ https://spot-suite.com/blog/iso-27001-2022-after-transition/ Tue, 02 Jun 2026 00:00:00 GMT With the October 2025 deadline passed, certified organisations must demonstrate the 93 Annex A controls across four themes rather than the prior 14 domains. https://spot-suite.com/blog/nis2-article-21-audit-export/ https://spot-suite.com/blog/nis2-article-21-audit-export/ Tue, 02 Jun 2026 00:00:00 GMT NIS2 Article 21 lists ten risk-management measures. Here is how we map each one to a control you can already show an auditor, and export as a single pack. https://spot-suite.com/blog/eu-data-residency-operating-record/ https://spot-suite.com/blog/eu-data-residency-operating-record/ Mon, 01 Jun 2026 00:00:00 GMT Keeping data in the EU usually means standing up a second stack and reconciling two sets of records. It does not have to. Here is how region choice and one audit trail coexist. https://spot-suite.com/blog/one-customer-environment/ https://spot-suite.com/blog/one-customer-environment/ Sat, 30 May 2026 00:00:00 GMT Most suites are a logo on a login page over separate products. We tied identity, billing, and the audit trail to one record per customer. Here is why, and what it costs. https://spot-suite.com/blog/the-compliance-binder-that-could-not-be-exported/ https://spot-suite.com/blog/the-compliance-binder-that-could-not-be-exported/ Tue, 03 Mar 2026 00:00:00 GMT Across ISO 27001, DORA, NIS2 and GDPR, the GRC lead has built a binder of policies and a backlog of evidence requests. When the regulator asks for proof of one control, it takes two weeks to assemble what should be one export. https://spot-suite.com/blog/the-dpa-signed-once-and-never-revisited/ https://spot-suite.com/blog/the-dpa-signed-once-and-never-revisited/ Fri, 13 Feb 2026 00:00:00 GMT The DPO has a signed DPA for every vendor and assurance from none. Subprocessors changed, sub-locations moved, and the Article 28 obligations drifted, but the agreement sits in a drawer as if signing it was the control. https://spot-suite.com/blog/the-saas-outage-that-took-down-a-process-nobody-mapped/ https://spot-suite.com/blog/the-saas-outage-that-took-down-a-process-nobody-mapped/ Thu, 22 Jan 2026 00:00:00 GMT A mid-tier SaaS tool goes dark and a regulated workflow halts. The COO discovers there was no business-impact mapping, no RTO, and no fallback, because the tool was bought as a convenience and became load-bearing without anyone noticing. https://spot-suite.com/blog/the-exit-plan-the-contract-required-and-nobody-wrote/ https://spot-suite.com/blog/the-exit-plan-the-contract-required-and-nobody-wrote/ Thu, 01 Jan 2026 00:00:00 GMT DORA Article 28 expects documented exit strategies for critical ICT providers. The vendor-management lead has the clause in every contract and the plan in none, until a price hike forces a migration they cannot execute. https://spot-suite.com/blog/the-pen-test-that-only-covered-the-flagship-app/ https://spot-suite.com/blog/the-pen-test-that-only-covered-the-flagship-app/ Wed, 10 Dec 2025 00:00:00 GMT The annual pen test scopes the main product because that is what the budget bought. The regulated customer's security team asks for estate-wide assurance, and the IT director has coverage for one tool out of nine. https://spot-suite.com/blog/the-board-report-with-no-resilience-number/ https://spot-suite.com/blog/the-board-report-with-no-resilience-number/ Wed, 19 Nov 2025 00:00:00 GMT DORA put digital operational resilience on the board agenda, but the CTO walks in with uptime stats per tool and no estate-level view of concentration, recovery, or exposure. The board cannot govern a risk nobody can summarize. https://spot-suite.com/blog/the-mfa-everyone-assumed-was-on-everywhere/ https://spot-suite.com/blog/the-mfa-everyone-assumed-was-on-everywhere/ Tue, 28 Oct 2025 00:00:00 GMT Conditional access enforces MFA at the IdP, so leadership reports '100% MFA coverage.' Three legacy SaaS tools authenticate locally and bypass it entirely. The gap surfaces in a credential-stuffing incident, not the dashboard. https://spot-suite.com/blog/the-dpia-that-skipped-the-tools-behind-the-tool/ https://spot-suite.com/blog/the-dpia-that-skipped-the-tools-behind-the-tool/ Tue, 07 Oct 2025 00:00:00 GMT A data protection impact assessment scopes the headline application and misses the analytics, support, backup, and notification subprocessors feeding off it. The DPO signs off on a processing map that is missing half the data flows. https://spot-suite.com/blog/the-audit-trail-the-vendor-could-edit/ https://spot-suite.com/blog/the-audit-trail-the-vendor-could-edit/ Mon, 15 Sep 2025 00:00:00 GMT Forensic readiness assumes your logs are tamper-evident. When each tool keeps its own mutable activity log with a 90-day retention, the 'append-only' audit trail you promised the regulator is neither append-only nor complete. https://spot-suite.com/blog/the-mover-who-kept-every-role-they-ever-had/ https://spot-suite.com/blog/the-mover-who-kept-every-role-they-ever-had/ Wed, 27 Aug 2025 00:00:00 GMT Joiner-mover-leaver everyone budgets for the joiner and the leaver. The mover is the one who quietly amasses entitlements across five departments over four years, until a privilege-creep finding turns into a segregation-of-duties failure. https://spot-suite.com/blog/the-incident-clock-that-started-before-anyone-noticed/ https://spot-suite.com/blog/the-incident-clock-that-started-before-anyone-noticed/ Tue, 05 Aug 2025 00:00:00 GMT DORA and NIS2 both impose tight initial-notification windows. When a SaaS subprocessor is breached, the regulated entity's reporting clock runs from detection, and a fragmented estate detects late, reports late, and explains it badly. https://spot-suite.com/blog/the-nis2-scope-the-it-director-thought-did-not-apply/ https://spot-suite.com/blog/the-nis2-scope-the-it-director-thought-did-not-apply/ Thu, 17 Jul 2025 00:00:00 GMT NIS2 widened essential and important entity scope and pushed accountability onto management bodies. The IT director who assumed 'we're too small' discovers the supply-chain and reporting duties land anyway, with personal liability attached. https://spot-suite.com/blog/the-renewal-that-auto-charged-for-licenses-nobody-used/ https://spot-suite.com/blog/the-renewal-that-auto-charged-for-licenses-nobody-used/ Wed, 25 Jun 2025 00:00:00 GMT The annual SaaS renewal lands at last year's seat count. The finance director approves it because reconciling actual usage across a dozen tools is harder than just paying. License leakage is a budget line nobody owns. https://spot-suite.com/blog/the-deal-lost-on-a-security-questionnaire/ https://spot-suite.com/blog/the-deal-lost-on-a-security-questionnaire/ Wed, 04 Jun 2025 00:00:00 GMT A regulated buyer sends a 300-line vendor assessment with a two-week deadline. The COO can answer for the flagship product but not for the eight tools behind it, and the deal slips to a competitor who could. https://spot-suite.com/blog/the-iso-27001-evidence-assembled-the-night-before/ https://spot-suite.com/blog/the-iso-27001-evidence-assembled-the-night-before/ Wed, 14 May 2025 00:00:00 GMT Ten exports, three spreadsheets, and a folder of screenshots stitched together at midnight. The 2025 transition raised the bar on evidence quality, and a binder of stale screenshots no longer passes a competent auditor. https://spot-suite.com/blog/the-data-residency-claim-the-subprocessor-broke/ https://spot-suite.com/blog/the-data-residency-claim-the-subprocessor-broke/ Tue, 22 Apr 2025 00:00:00 GMT Sales told the regulated prospect 'all data stays in the EU.' One SaaS tool's support tier routes through a US team, and the DPO finds out during the due-diligence questionnaire that loses the deal. https://spot-suite.com/blog/the-vendor-concentration-nobody-mapped-until-it-failed/ https://spot-suite.com/blog/the-vendor-concentration-nobody-mapped-until-it-failed/ Thu, 03 Apr 2025 00:00:00 GMT Five of your critical SaaS vendors run on the same cloud region and the same auth provider. DORA Article 30 now expects you to know that before the outage, not during it. https://spot-suite.com/blog/the-shadow-saas-bought-on-a-corporate-card/ https://spot-suite.com/blog/the-shadow-saas-bought-on-a-corporate-card/ Mon, 17 Mar 2025 00:00:00 GMT The finance director reconciles the card statement and finds 40 SaaS subscriptions IT never approved, half of them processing customer data. Shadow IT is a procurement control failure before it is a security one. https://spot-suite.com/blog/the-access-review-that-took-six-weeks-and-still-failed/ https://spot-suite.com/blog/the-access-review-that-took-six-weeks-and-still-failed/ Sun, 23 Feb 2025 00:00:00 GMT When identity lives in twelve apps, the annual access certification is a hand-merged spreadsheet that is stale before it is signed. ISO 27001 control 5.18 and SOC 2 CC6 expect a review you can reproduce, not reconstruct. https://spot-suite.com/blog/the-leaver-who-still-has-access-to-three-saas-apps/ https://spot-suite.com/blog/the-leaver-who-still-has-access-to-three-saas-apps/ Tue, 04 Feb 2025 00:00:00 GMT 31% of former employees keep access to at least one company app, and the CISO only finds out when one of them logs in. Deprovisioning that stops at the HR system and the IdP is not deprovisioning.