03 SECTION / CYBERCORIA

Regulation

Connect official texts, governance obligations and the reality of the information system without turning compliance into a slogan.

STARTING POINT

NIS2, DORA, GDPR, ANSSI/CNIL/ENISA guidance and the relationship between requirements, assets and evidence.

We separate what texts require, what authorities recommend and what mapping or technical controls can genuinely help demonstrate.

Questions we are trying to answer

What does the text actually require?
Which operational evidence needs to be retained?
Where does mapping help?
Which limitations should remain visible?

01 / Regulation

Start with the text, not with a product

Cybercoria separates three levels: what the legal text requires, what an authority or agency recommends, and what an organisation may choose as an operational means. This avoids turning a technical feature into a regulatory obligation that does not exist.

02 / Regulation

A requirement becomes operational when it meets the real system

Asset management, continuity, supply chain, data, access and evidence do not live in isolated documents. The analyses show which system objects and relationships can help address a requirement without claiming that mapping alone proves compliance.

03 / Regulation

Evidence remains distinct from the repository

A map can show a dependency; it cannot prove that a backup was restored, an access review took place or an incident was handled within a required timeframe. Separating structure, controls and evidence is a recurring editorial principle in this section.

ANALYSES

2 publications

August 24, 2026

NIS2 Article 21: what information system mapping can actually help demonstrate

Article 21 of NIS2 requires a risk-management approach covering incidents, continuity, supply-chain security, access and asset management. Where does information system mapping genuinely help?

5 min
Read →

August 24, 2026

GDPR: information system mapping and records of processing are different — but complementary

The GDPR record organises processing activities by purpose. Information system mapping describes applications, flows and infrastructure. Connecting the two can improve governance without confusing their roles.

5 min
Read →

PUBLICATION CRITERION

A page is published only when it contributes information, a method, a synthesis or a verifiable angle that justifies its existence beyond a search-ranking objective.