Docs
Browse by intent — Respond, Comply, Prove, Certify, or Govern AI — or jump into a topic cluster below.
Respond
Incident response, breach reporting, and CRA Article 14 reporting ladders — first moves through regulatory notification.
Comply
Cyber Resilience Act obligations, framework crosswalks, and continuous compliance guides.
Prove
Evidence collection, connector setup, FAQs, and ShipReady Passport workflows.
Certify
SOC 2, ISO 27001, and audit-ready certification workflows.
Govern AI
EU AI Act cluster guides and AI governance frameworks from engineering evidence.
Topic clusters
Incident response
We've been breached — first moves through the first 15 minutes, first hour, first 24 hours, first 72 hours, and first week. Vendor-neutral guidance from CISA, NIST, SANS, and the FTC. Not legal advice.
Breach reporting
Do I have to report a cybersecurity breach? A regime map of personal-data, sector, and product-vulnerability classes. Not legal advice. Does not start a clock.
Cyber Resilience Act
What the EU Cyber Resilience Act is, which product classes it names, and the phased dates in Article 71. Not legal advice. Does not start a clock.
EU AI Act
What the EU AI Act is, the four risk categories, Article 113 dates, and Article 99 penalty ceilings. Not legal advice. Does not determine that the Act applies to YOU.
Engineering
AI-generated code security, measurement, governance, DORA metrics, technical debt, and engineering health. Vendor-neutral guidance for engineering leaders. Not legal advice.
How we use AI
Honest product documentation for every customer-facing AI surface — generative compliance chat, extractive trust-buyer classifier, deterministic score graders, telemetry, metering, and provenance. From code. Not legal advice.
Vulnerability management
Vendor-neutral guides on prioritizing and remediating vulnerabilities — KEV, EPSS, CVSS, SLAs, SBOM, and accepted risk. Not legal advice.
Evidence & audit readiness
Which security evidence to keep, how long to retain it, where each artifact lives per platform, and how to prove a control operated. Not legal advice.
ISO 42001
What ISO/IEC 42001 is, who needs an AIMS, certification stages, Annex A controls, and how it relates to ISO 27001 and the EU AI Act. Not legal advice.
SOC 2
What a SOC 2 examination is, the Type I/Type II split, readiness through report, cost and timeline drivers, exceptions and opinion types. An AICPA SSAE 18 attestation, not a certification. Not legal advice.
ISO/IEC 27001
What ISO/IEC 27001:2022 is, who typically needs it, the certification cycle, Annex A controls, evidence, cost, and SOC 2 compared with ISO 27001. Not legal advice.
Security audits
Cross-framework auditor selection, accreditation, independence, and assurance-provider comparisons. Not legal advice. Not procurement advice.
Security testing
Do you need a penetration test, how it differs from scanning, SAST/DAST/SCA, cadence, cost, reports, retests, and SOC 2 / ISO 27001 expectations. Not legal advice.
Due diligence & M&A
Technology, cybersecurity, and AI due diligence checklists for fundraises and acquisitions — plus how to prepare a readiness report. Not legal or investment advice.
Integration setup guides
Step-by-step, least-privilege setup for every source — GitHub, GitLab, the clouds, and AI spend.
Methodology
How each of the nine domain scores is computed and weighted into one ShipReady Score, how unmeasured domains are handled, and how scores become a dollar Value at Stake.
What we measure
The questions every technology leader asks — answered from your own systems' evidence, with all 45 ShipReady Markers in the open.
Why now
Compliance became market access. The three parties that now grade your digital estate, the deadlines already running, and what applies to a company like yours.
Frequently asked questions
How each score is computed, the connectors, where credentials are stored, tenant isolation, and the board pack.
What it costs
Priced per active contributor across three stages — See what is true, Prove it to someone else, Fix what matters first. Viewers are never billed.
See pricing