The law's clocks, kept by the workflow.

The law's own deadlines · 6

• A personal data breach: the 72 hours, the people, the recordA breach is found and the 72 hours to the Data Protection Commission start, often before anyone has decided who does what.GDPR
• A data subject request answered within the monthSomeone asks for their data, or for it to be erased or corrected, and the month passes before anyone has found it all.GDPR
• A significant incident under NIS2: 24 hours, 72 hours, one monthA significant incident starts three clocks to the CSIRT, and the last one moves when the notification goes.NIS2
• A major ICT-related incident under DORA: classify, then three reportsAn ICT incident has to be classified quickly, and a major one starts reports whose deadlines move with each submission.DORA
• A protected disclosure: acknowledged in 7 days, feedback in 3 monthsA report of wrongdoing arrives and the law's two deadlines, and the reporter's confidentiality, depend on someone remembering.Protected Disclosures Act
• An exploited vulnerability in a product: 24 hours, 72 hours, the fixAn actively exploited vulnerability in a product the business makes starts the Cyber Resilience Act's reporting clocks.Cyber Resilience Act

Quality and governance · 6

• A deviation: contained, its root cause, CAPA, and the check it workedA deviation is fixed on the day, and the same thing happens again: nobody found why or checked the fix.ISO 27001Quality
• A change: its impact, a second person's approval, made, then checkedChanges to systems and processes are made by the person who asked for them, with nobody else looking first.ISO 27001DORAQuality
• A new supplier or ICT third party: checked, contracted, an exit plan, reviewed yearlyA supplier gets access to data or runs a critical service before anyone has checked it or written the terms down.GDPRDORANIS2
• A policy or SOP published: everyone told, acknowledged, chasedA policy changes and nobody can show who has read it.ISO 27001NIS2
• AI literacy and security awareness, every yearStaff use AI tools and handle data with nobody able to show what they were taught, or when.AI ActNIS2ISO 27001
• A new AI system: classified, overseen, then reviewed every yearAn AI tool is in use before anyone has checked whether the AI Act bans it, treats it as high-risk, or who watches over it.AI Act

Every quarter and every year · 4

• The risk register reviewed every quarter, and signed offRisks are written down once for an audit and never looked at again.ISO 27001NIS2DORA
• An internal audit and management review, every yearThe first time anyone tests the controls is when the auditor arrives.ISO 27001
• Records past their retention, deleted every monthPersonal data is kept for years after anyone needed it. Deleting is nobody's job.GDPR
• A backup restored and the continuity plan tested, every quarterBackups run every night and nobody has ever tried restoring one.DORANIS2ISO 27001

Access · 3

• Access is approved by a second personSomeone is given access with no approver, or approves their own.ISO 27001
• Someone leaves: every sign-in removedA person leaves and keeps their sign-ins to the business's systems.ISO 27001
• Access reviewed every three monthsNobody looks again at who can sign in to what.ISO 27001

Evidence and follow-through · 3

• A failed check reaches a named personA check fails on the record and nobody picks it up.NIS2ISO 27001
• The month's evidence, keptEvidence is gathered in a rush when the auditor asks.
• A stopped workflow is chasedA workflow stops after its retries and the work behind it waits unseen.

Customers and money · 1

• A declined card is followed upA card is declined and nobody follows it up.