All playbooks
Playbook · Strategy and influence · 7 steps
Responding to new regulation
Turn a regulation such as DORA, NIS2 or the EU AI Act into architecture work, not a paper exercise.
“Security is a process, not a product.”
- 1Capability MappingWhich capabilities, systems and suppliers does the regulation touch?Describe what the business does, independent of how, by whom, or with which system.Open
- 2Power–Interest GridHave compliance, legal, risk and the regulator-facing teams been engaged early?Map stakeholders by how much power they have over the outcome and how much they care, and engage each group differently.Open
- 3Exit Strategy (Lock-in as a Design Input)Do critical third-party services have exit plans we have actually tested?Decide how you would leave a vendor or platform before you commit, and trade the switching cost consciously against the value the dependency brings.Open
- 4Single Point of FailureWhere would one supplier or system failing stop a critical function?Any component whose failure stops the whole system is a risk you've chosen, knowingly or not.Open
- 5Blast RadiusIf a third party fails or is breached, how much of the business goes with it?Limit how much can break when any one thing fails.Open
- 6Defense in DepthAre controls layered, or does compliance hang on a single one?Layer independent safeguards so no single failure leads to compromise.Open
- 7Architecture Decision RecordsCan we show an auditor why each control is designed as it is?Capture the why behind significant decisions in short, immutable records future teams can read.Open