Law / regulation
DPDP Act (India)
India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
Hi, I'm Pharos Click me Tap me to see what I do Understand the rules.
Cybersecurity · AI Governance · Privacy
Understand the rules.
Master the risks.
Build trust.
MajorCyber™ is an independent knowledge platform that explains security, AI governance and privacy frameworks in clear language, with every claim traced to its official source.
13 full guides 26 profiles Drag the globe to spin it · tap or click a label to open its page · arrow keys move between labels
Focus areas
Six disciplines, one connected body of knowledge
Governance sets direction. Testing, awareness, intelligence and operations show whether it holds up in practice.
-
Governance, Risk & Compliance
How security programmes are governed, how risk is assessed and treated, and how frameworks turn into evidence.
-
Security Awareness Training
Building awareness programmes that change behaviour — and meet the training expectations written into major frameworks.
-
Penetration Testing
How authorised security testing is scoped, governed and reported, and how findings feed risk decisions.
-
Phishing Simulation Campaigns
Running ethical, consent-based phishing simulations that measure risk without punishing people.
-
Threat Intelligence
Turning threat information into decisions: intelligence requirements, sources, analysis and sharing.
-
Security Operations (SOC)
How security operations centres detect, triage and respond — and the reporting duties that follow an incident.
Compliance Academy
Start with the frameworks people ask about most
Each guide explains what the framework is, who it applies to, what it requires and what evidence looks like.
Law / regulation
EU AI Act
The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
Law / regulation
GDPR
The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Certifiable standard
ISO/IEC 42001
The first certifiable international standard for an AI management system (AIMS): how an organisation governs the AI systems it develops, provides or uses.
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.
Cyber Intelligence
What changed, and what does it mean?
Short, sourced briefings on regulatory developments, enforcement and incidents, with clear next steps.
All briefings-
DPDP Rules: Consent Manager Provisions Commence in November 2026
One year after India notified the DPDP Rules 2025, Rule 4 on Consent Managers comes into force. Core Data Fiduciary obligations follow eighteen months after publication, in May 2027.
-
A China-Linked Zero-Day in BeyondTrust Remote Support Lands on CISA's Known Exploited Vulnerabilities Catalog
CISA added a BeyondTrust Remote Support flaw, CVE-2026-102764, to its KEV catalog on 16 October 2026, after Google tied zero-day exploitation from late August to a suspected China-nexus actor.
-
CISA Adds an Ivanti Connect Secure Authentication-Bypass Flaw to Its Known Exploited Vulnerabilities Catalog
CISA added an Ivanti Connect Secure authentication-bypass flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities catalog on 13 October 2026, with a federal patch deadline of 16 October.
-
EDPB Publishes a Statement on the Data Protection Risks of Smart Glasses
The EDPB set out preliminary, non-binding views on smart glasses: wearers, makers and app providers can all be GDPR controllers, and bystanders need clear warning when recording is possible.
AI Governance & Privacy
AI and personal data are now governed by law, not just good intentions
The EU AI Act's obligations are phasing in, India's DPDP Rules reach their main compliance date in 2027, and certifiable standards such as ISO/IEC 42001 and ISO/IEC 27701 give organisations a way to organise the work. Our guides separate what is binding from what is voluntary.
Explore AI governance & privacy- EU AI Act The European Union's binding, risk-based law for AI systems and general-purpose AI models, with obligations that vary by risk level and by role.
- ISO/IEC 42001 The first certifiable international standard for an AI management system (AIMS): how an organisation governs the AI systems it develops, provides or uses.
- NIST AI RMF NIST's voluntary framework for managing the risks of AI systems, organised around four functions: Govern, Map, Measure and Manage.
- GDPR The EU's comprehensive data protection law, setting principles, lawful bases, individual rights and accountability duties for anyone processing personal data in its scope.
- DPDP Act (India) India's data protection law for digital personal data, made operational by the DPDP Rules, 2025, which come into force in phases until May 2027.
- ISO/IEC 27701 The international standard for a privacy information management system (PIMS). Since its 2025 edition it can be implemented and certified on its own, without ISO/IEC 27001.
- See all 23 AI and privacy guides
Insights & Resources
Latest explainers and guides
Practical guide
Running Ethical Phishing Simulations: Consent, Pretexts and the Metrics That Matter
Phishing simulations can build a reporting culture or destroy trust. How to authorise and design them ethically, rate their difficulty with NIST's Phish Scale, and measure reporting, not clicks.
Practical guide
What ISO/IEC 27001, PCI DSS, HIPAA and NIST CSF Actually Ask of Security Awareness Training
Most frameworks require security awareness training, but few say how. What ISO/IEC 27001, PCI DSS, HIPAA, NIST CSF 2.0 and the GDPR expect — and what to measure instead of completion rates.
Framework explainer
The Threat Intelligence Lifecycle: Turning Threat Feeds into Decisions
Threat intelligence starts with questions, not feeds: the intelligence lifecycle, its three levels, sharing with the Traffic Light Protocol, and ISO/IEC 27001 control 5.7.
AI governance
Standards, Frameworks and Laws: Reading AI Governance Requirements Correctly
ISO/IEC 42001, the NIST AI RMF and the EU AI Act are often mentioned together. One is a certifiable standard, one a voluntary framework, one binding law — and that changes everything.
Recently reviewed
Checked against official sources
Every guide shows when it was last reviewed. These are the most recent.
- AI Security A fast-moving field. Key references include NIST AI 100-2 E2025 (March 2025), the OWASP Top 10 for LLM Applications 2025 and the UK AI Cyber Security Code of Practice (January 2025).
- Business Continuity and Disaster Recovery ISO 22301:2019 is the certifiable standard and is being revised. EU laws such as DORA and NIS2 now make continuity and backup management a legal duty in scope.
- CIS Controls Version 8.1, an update to version 8 (2021) that aligns the controls with NIST CSF 2.0, including its Govern function.
- CJIS Security Policy Version 6.1, dated 25 June 2026. Modernised requirements marked Priority 2 to 4 are in a zero-cycle until 30 September 2027.
- COBIT COBIT 2019 is the current core framework, with ISACA focus-area guides extending it to topics such as information security, risk, DevOps and AI.
- CSA Cloud Controls Matrix CCM v4.1, which now includes the CAIQ questionnaire in the same package. Assurance is published through CSA's STAR Registry.
Behind MajorCyber™
Built by a practitioner, for practitioners
MajorCyber™ was founded by Major Shubham Sharma ("Sam"), a former Indian Army officer and cybersecurity GRC practitioner who holds the CISSP, CCSP and ISACA AAISM certifications and is a BSI-certified ISO/IEC 27001 Lead Implementer. The platform exists to make complex security, AI and privacy requirements understandable, accurately and without hype.