I wrote here about the CRA and the deployment plan: https://www.sorinmustaca.com/eu-cyber-resilience-act-cra-overview/ We are past September 11th and the Art. 14 of CRA is applying. Who is affected? Is a a company from a non EU country, which sells software globally affected by the CRA Art. 14? Any company is affected if the software is made […]
Intro I talk a lot about AI these days… and I know I am not alone. People talk a lot about “agentic AI” or “AI Agents” or simply “Agents”. During these discussions, I see there is confusion sometimes what is an Agent and what’s the difference between “AI” and “AI Agents”. Here’s the core distinction, […]
The Data Protection catalog is the shortest of the three in ISA 6.0.3 and the one most often underestimated. Twelve control questions across eight subchapters, all numbered under chapter 9. Compared to the roughly sixty questions in Information Security, it looks like an afterthought. It isn’t. It is the part of the assessment where an […]
This is the extension of the original article AI Adoption for companies (based on OECD data) What US Companies Are Actually Spending — And Where It Maps The OECD data gives you the strategic framework. US-specific data gives you a reality check on spending. Here is what verified US sources report. Adoption in the […]
Why You Need to Read This Now Between 2020 and 2024, the share of firms using AI across OECD countries more than doubled — from 5.6% to 14%. Large firms (250+ employees) are at 40% adoption. Small firms (10–49 employees) are at 11.9%. Mid-sized firms sit in the middle at 20.4%. That gap is […]
We started to talk about the SOC2 Type 2 certification and I feel that we neglected it a bit. I wrote a bit about SDLC, Secure SDLC in particular, but now it is time to bring them together. SOC 2 Type 2 and Secure SDLC — the big picture SOC 2 Type 2 evaluates whether […]
What are you doing is wrong! Most engineering teams are tracking effort and calling it progress. Story points, commit frequency, PR cycle time, items from a Definitions of Done implemented or respected — these are process metrics dressed up as productivity metrics. They tell you how busy your team is. They tell you almost nothing […]
What is the Cyber Resilience Act – CRA The Cyber Resilience Act is the first European regulation to set a mandatory minimum level of cyber security for all connected products available on the EU market – something that did not exist before. The CRA is a regulation from the European Union — formally Regulation (EU) 2024/2847 […]
We continue the series of 3 articles with the second one, about the Proof of Concept (POC). Here is the first article in the series, From Idea to Proof of Concept to MVP: The Idea stage (1/3) . 2. The Proof of Concept (POC) The POC is where the team tests a specific risky assumption […]
This is a a developer focused guide in three parts to evolving code, architecture, and processes with the purpose of turning a raw concept into a usable product. This process is one of the hardest parts of software development. Teams often jump into implementation too early, or they build something polished before testing whether the […]
You must be logged in to post a comment.