resolved Aug 21, 2026, 08:22 AM UTC

Tidal Control's July 2026 release launches the Trust Center, a public page where organisations can transparently display their security and compliance posture with customisable visibility, custom domain support, and branded styling. Seven new integrations are added, covering Cloudflare, STACKIT, Hetzner Cloud, TOPdesk, Anthropic, OpenAI, and Claude Enterprise. Azure automated checks expand by 15 tests to near-complete Microsoft Cloud Security Benchmark coverage. The in-app AI assistant TidalBot now runs on Anthropic's Claude models.

Read the full incident report →

Major August 16, 2026 Platform (portal) down 16m Platform (portal)

Started Aug 16, 2026, 12:08 AM UTC· resolved Aug 16, 2026, 12:25 AM UTC

investigating Aug 16, 2026, 12:08 AM UTC

Platform (portal) is down
resolved Aug 16, 2026, 12:13 AM UTC

Platform (portal) is up

Read the full incident report →

Major August 9, 2026 Platform (portal) down 10m Platform (portal)

Started Aug 09, 2026, 12:09 AM UTC· resolved Aug 09, 2026, 12:19 AM UTC

investigating Aug 09, 2026, 12:09 AM UTC

Platform (portal) is down
resolved Aug 09, 2026, 12:19 AM UTC

Platform (portal) is up

Read the full incident report →

Minor August 3, 2026 From first compliance step to audit with 0 findings: how Aivory achieved ISO 27001 and NEN 7510 in three months –

Started Aug 03, 2026, 07:22 AM UTC· resolved Aug 03, 2026, 07:22 AM UTC

resolved Aug 03, 2026, 07:22 AM UTC

Aivory earned ISO 27001 and NEN 7510 in three months with zero audit findings. See how this dental AI start-up moved fast without cutting corners.

Read the full incident report →

Major August 2, 2026 Platform (portal) down 5m Platform (portal)

Started Aug 02, 2026, 12:13 AM UTC· resolved Aug 02, 2026, 12:18 AM UTC

investigating Aug 02, 2026, 12:13 AM UTC

Platform (portal) is down
resolved Aug 02, 2026, 12:18 AM UTC

Platform (portal) is up

Read the full incident report →

Minor July 24, 2026 Controls: what are they and how do you use them? –

Started Jul 24, 2026, 09:35 AM UTC· resolved Jul 24, 2026, 09:35 AM UTC

resolved Jul 24, 2026, 09:35 AM UTC

A control is a concrete action, configuration, procedure or agreement an organisation puts in place to manage a risk or meet a framework requirement. Controls fall into three types (technical, organisational, physical) and three functions (preventive, detective, corrective). Under ISO 27001, you select controls based on a risk assessment and document your choices in a Statement of Applicability. Common failures include controls that exist only on paper, missing ownership and implementing controls without first identifying the underlying risks.

Read the full incident report →

Minor July 24, 2026 Performing a risk assessment: methods, models and tools –

Started Jul 24, 2026, 09:33 AM UTC· resolved Jul 24, 2026, 09:33 AM UTC

resolved Jul 24, 2026, 09:33 AM UTC

A risk assessment maps what can go wrong, how likely that is, and how serious the consequences would be, then determines how to respond. Risk is calculated as likelihood multiplied by impact, producing a score that guides treatment: mitigate, accept, transfer or avoid. ISO 27001 makes this process explicitly mandatory, while NIS2 and DORA impose comparable requirements. The assessment must be reviewed at least annually and after significant organisational changes, not treated as a one-off document.

Read the full incident report →

Minor July 23, 2026 From compliance roadbumps to ISO 27001 with confidence: The story of Fledger.ai –

Started Jul 23, 2026, 07:00 AM UTC· resolved Jul 23, 2026, 07:00 AM UTC

resolved Jul 23, 2026, 07:00 AM UTC

Fledger, the Hague-based legal tech company behind AI assistant LISA, got stuck for more than 6 months in its ISO 27001 project with a well-known American platform: progress bars moved, but the support stayed generic. Through the Breaking Barriers programme run by AIC4NL they switched to Tidal Control with guidance from implementation partner Riskwork, who carried over the existing work instead of starting again. Fledger achieved certification thanks to people and technology coming together and successfully taking them to their goals.

Read the full incident report →

Minor July 16, 2026 What is GRC and why do modern businesses need a GRC platform? –

Started Jul 16, 2026, 07:00 AM UTC· resolved Jul 16, 2026, 07:00 AM UTC

resolved Jul 16, 2026, 07:00 AM UTC

GRC stands for Governance, Risk and Compliance: three domains that most organisations already handle separately but that work better as one connected system. When you manage more than one framework at the same time, or enterprise customers regularly ask for compliance evidence, separate tools create duplication, unclear ownership and last-minute audit stress. A GRC platform links controls, evidence and tasks across frameworks so each control is documented once and compliance status is visible at any time. Complexity is the trigger for a structured GRC approach, not organisational size.

Read the full incident report →

Minor July 14, 2026 ISO 9001 certification costs: what does it really cost? –

Started Jul 14, 2026, 07:00 AM UTC· resolved Jul 14, 2026, 07:00 AM UTC

resolved Jul 14, 2026, 07:00 AM UTC

For an SME with up to 25 employees, ISO 9001 certification costs between €3,000 and €30,000 in year one, with internal time being the most underestimated component. Over the full three-year cycle, including surveillance audits and recertification, total costs range from €6,000 to €35,000. Limiting scope, building internal audit capacity, and combining with ISO 27001 where needed are the most effective ways to land at the lower end of those ranges.

Read the full incident report →

Minor July 9, 2026 What's new |June 2026 –

Started Jul 09, 2026, 07:00 AM UTC· resolved Jul 09, 2026, 07:00 AM UTC

resolved Jul 09, 2026, 07:00 AM UTC

The June 2026 Tidal Control release adds five new integrations (Aikido Security, OVHcloud, Neon, and DigitalOcean) alongside significantly expanded Azure tests covering networking, app services, and SQL. The application now fully supports Dutch as well as English, selectable per user in settings. Bulk actions with shift-click selection, read-only API credentials, customisable roles, an Opportunity issue type for ISO 9001 and ISO 27001 clause 6.1 tracking, and live external issue status for Jira and Azure DevOps tasks are also included.

Read the full incident report →

Minor July 7, 2026 What is ISO 9001 and when should you start certification? –

Started Jul 07, 2026, 07:00 AM UTC· resolved Jul 07, 2026, 07:00 AM UTC

resolved Jul 07, 2026, 07:00 AM UTC

ISO 9001 is the international standard for quality management systems, requiring organisations to document and prove their processes consistently deliver what customers expect. Certification is not legally required but is effectively mandatory for public tenders, enterprise supplier lists, and sectors such as construction, manufacturing, and IT services. For an SME with up to 25 employees, first-year costs run between 9,000 and 30,000 euros. ISO 9001:2026 was published on 16 September 2026; the changes are evolutionary and existing 2015 certificates remain valid during a transition period.

Read the full incident report →

Minor June 30, 2026 Triagen explains: how much AI can really speed up your compliance journey –

Started Jun 30, 2026, 09:48 AM UTC· resolved Jun 30, 2026, 09:48 AM UTC

resolved Jun 30, 2026, 09:48 AM UTC

AI doesn't replace compliance, but it does speed up the execution work. Discover how Triagen.ai and Fendix use the MCP integration of Tidal Control.

Read the full incident report →

Minor June 15, 2026 DORA explained: what does the regulation mean for your organisation? –

Started Jun 15, 2026, 12:00 PM UTC· resolved Jun 15, 2026, 12:00 PM UTC

resolved Jun 15, 2026, 12:00 PM UTC

DORA (EU 2022/2554) became fully applicable on 17 January 2025 and requires financial entities and critical ICT service providers in the EU to manage ICT risk across five pillars: ICT risk management, incident reporting, resilience testing, third-party risk management, and information sharing. Around twenty categories of financial entity are in scope, including payment institutions holding AISP or PISP licences under PSD2. No DORA certification exists; compliance is assessed by the competent national supervisor through policies, procedures, test results, and register data.

Read the full incident report →

Minor June 11, 2026 NIS2 for SaaS: what do you need to arrange now? –

Started Jun 11, 2026, 12:00 PM UTC· resolved Jun 11, 2026, 12:00 PM UTC

resolved Jun 11, 2026, 12:00 PM UTC

NIS2 applies directly to SaaS companies above 50 employees or €10 million in revenue, and indirectly to smaller suppliers whose enterprise customers fall in scope. The regulation requires a documented risk management system, a 24-hour incident reporting procedure, supply chain assessments, and a business continuity plan. ISO 27001 is explicitly recognised by NIS2 as a compliance path. Fines reach up to €10 million or 2% of global annual turnover for essential entities.

Read the full incident report →

Minor June 9, 2026 Comparing compliance tools: why a false timeline is costly –

Started Jun 09, 2026, 12:00 PM UTC· resolved Jun 09, 2026, 12:00 PM UTC

resolved Jun 09, 2026, 12:00 PM UTC

Promises of ISO 27001 or SOC 2 certification in thirty days are a red flag because both standards require a demonstrably working management system, not just documentation. A SOC 2 Type 2 report cannot comply with the standard without an observation period of at least three months, and a small organisation pursuing ISO 27001 needs a minimum of three months working in a focused way. Tidal Control works exclusively with independent, accredited certification bodies and includes implementation support, automated evidence collection, and EU hosting in its platform.

Read the full incident report →

Minor May 29, 2026 What's New | May 2026 –

Started May 29, 2026, 12:24 PM UTC· resolved May 29, 2026, 12:24 PM UTC

resolved May 29, 2026, 12:24 PM UTC

The May 2026 Tidal Control release adds eight new integrations, including Azure DevOps, Azure Defender and Vercel. Three new frameworks are now available: BIO2 v1.3 for Dutch government organisations, ABRO 2026 for companies carrying out government contracts involving national security risks, and BSI C5:2026 for cloud security in Germany, which takes effect from June 2027. The release also introduces a DORA Register of Information export in XBRL-CSV format accepted by the EBA and the AFM, plus a new Critical priority level for issues.

Read the full incident report →

Minor April 30, 2026 What's New | April 2026 –

Started Apr 30, 2026, 12:00 PM UTC· resolved Apr 30, 2026, 12:00 PM UTC

resolved Apr 30, 2026, 12:00 PM UTC

The April 2026 Tidal Control release adds an MCP AI integration that lets assistants like Claude, ChatGPT, Codex, and VS Code query and update GRC data directly in your tenant. A Datadog integration automatically runs 11 compliance tests, vendors can now be linked to assets, and dedicated DORA Register of Information fields support Digital Operational Resilience Act reporting for financial institutions. The release also includes a markdown policy editor and risk approval visibility.

Read the full incident report →

Minor March 27, 2026 What's New | March 2026 –

Started Mar 27, 2026, 12:00 PM UTC· resolved Mar 27, 2026, 12:00 PM UTC

resolved Mar 27, 2026, 12:00 PM UTC

The March 2026 Tidal release adds automated compliance tests for Google Workspace and Google Cloud Platform, covering areas such as MFA enforcement, IAM policies, and device management. A structured risk approval workflow now tracks the full history of assessments per risk, and existing assessments must be reviewed and approved within the new workflow. The release also introduces asset categories, an interactive evidence viewer, and incident reporting for basic users.

Read the full incident report →

Minor March 5, 2026 What's New | February 2026 –

Started Mar 05, 2026, 12:00 AM UTC· resolved Mar 05, 2026, 12:00 AM UTC

resolved Mar 05, 2026, 12:00 AM UTC

Tidal's February 2026 release adds a guided onboarding module that walks users through ISO 27001 compliance step by step, a Web Security Scanner that validates SSL/TLS certificate configuration, and the BSI C5 2020 cloud security framework. The update also brings improvements to the Jira two-way integration, a new Azure Entra Admin Portal access test, automatic saving of policies and required documents, and several bug fixes.

Read the full incident report →

Minor March 4, 2026 When customers ask for SOC 2 and what they really mean –

Started Mar 04, 2026, 12:00 AM UTC· resolved Mar 04, 2026, 12:00 AM UTC

resolved Mar 04, 2026, 12:00 AM UTC

When customers ask for a SOC 2 report, they are usually asking for evidence they can share internally to prove due diligence, not for the report itself. ISO 27001 certification or a detailed security questionnaire is often an acceptable substitute. Waiting until a customer asks is the most common mistake: setting up controls that map to both SOC 2 and ISO 27001 from the start means a report can be reached in three to six months once the request arrives, rather than nine to fifteen months from scratch.

Read the full incident report →

Major March 3, 2026 Why manual SOC 2 slows your team down and what it costs –

Started Mar 03, 2026, 12:00 AM UTC· resolved Mar 03, 2026, 12:00 AM UTC

resolved Mar 03, 2026, 12:00 AM UTC

An estimated twenty to thirty percent of first SOC 2 audits fail, and manual programmes are the common factor. Three predictable failure points explain why: evidence collection does not scale, compliance knowledge concentrates in one or two people, and last-minute corrections produce lower-quality results. A manual SOC 2 Type II programme typically requires 500 or more internal hours and 35,000 to 80,000 euros in internal costs before external audit fees. Automation reduces internal hours by 40 to 60 percent and builds evidence continuously across the observation period.

Read the full incident report →