Disclaimer.

1. Educational and informational purposes only

All content on nhigovernance.com (articles, framework explainers, breach case studies, vendor profiles, interactive tools) and any other material, is published for general educational and informational purposes. It is not intended to provide legal, regulatory, compliance, security-architecture, audit, investment, or any other form of professional advice for your specific circumstances.

2. We are not your lawyer, your auditor, or your consultant

HumanAudit Inc. does not provide legal advice, audit services, or advisory services through this Site. Reading this Site does not create a solicitor to client, attorney to client, auditor to client, or consultant to client relationship between you and HumanAudit Inc., its employees, or its contributors. For professional advice on your specific situation, particularly under regulatory frameworks such as NIS2, DORA, the EU AI Act, GDPR, HIPAA, PCI DSS, SOC 2, ISO 27001, ISO 42001, or CSA STAR, engage qualified professionals licensed in the relevant jurisdiction.

3. No warranty of accuracy or currency

We make reasonable efforts to ensure accuracy and to re-review definitional, framework, and breach content at least quarterly, with visible "last reviewed" dates. However, regulations change, standards move, vendors are acquired, and forensic understanding of breaches evolves over time. No reasonable quality process catches every change immediately.

Use the "last reviewed" date, verify critical claims against primary sources, and assume that anything material to a decision should be confirmed in the underlying standard, regulation, vendor documentation, or forensic report before action.

4. About our breach case studies

Our breach case studies are based on publicly available forensic reports, vendor post-mortems, regulator filings, and published security research. We synthesise these sources into practitioner-oriented narratives. We do not have direct access to confidential incident-response data. Where forensic understanding evolves, we update our articles and preserve the prior version with attribution.

Where a breach case study describes specific vendor products or services, the description reflects what is publicly reported about the incident. It is not a comprehensive assessment of the vendor's overall security posture, nor an indictment of the vendor's present-day product.

5. About vendor profiles and comparisons

Vendor profiles are editorial overviews written from publicly available information plus (where provided) vendor documentation. They represent our honest editorial assessment at the time of writing. They are not investment recommendations, procurement advice, or a substitute for a full RFP process tailored to your environment and requirements.

6. Third-party content and links

The Site links to third-party content, standards documents, vendor websites, regulatory guidance, academic research, news reports, and community resources. We are not responsible for the content, accuracy, privacy practices, or availability of third-party resources. Links are provided for the reader's convenience and further research.

7. Commercial disclosure

This site carries no advertising, no sponsored content, no affiliate or referral links, and no paid vendor placement of any kind. No vendor described on this site has paid us anything for that coverage, and we do not operate a programme through which they could.

It is published by HumanAudit Inc., which sells AI governance consulting and ISO/IEC 42001 documentation products. That is the commercial interest you should know about when reading anything here: we benefit if you decide you need help with governance work, and we have said so on every page that carries a call to action. We do not benefit from which vendor you choose, which is why the vendor coverage can say what it says.

Links to our sister properties, humanaudit.ai, iso42001toolkit.com and euaiactchecklist.com, are links to our own publications and products. They are not third-party endorsements and carry no commission.

8. Forward-looking statements

Articles sometimes discuss how standards, regulations, vendor landscapes, or attacker techniques might evolve. These are informed opinions, not predictions. Do not make decisions that depend on future events unfolding as we suggest without independently validating the likelihood of those events with qualified practitioners.

9. Jurisdictional variation

Security and identity regulations vary substantially between jurisdictions. An approach that is compliant in one country or sector may be inadequate in another. We make reasonable efforts to identify jurisdictional variation where relevant, but we cannot exhaustively cover every regulatory environment. Always consult counsel in your specific jurisdictions.

10. Contact

Questions: truth@humanaudit.ai. For corrections: editorial@nhigovernance.com.

How this content is produced

Content on this site is researched, drafted and reviewed by the HumanAudit Inc. editorial team. AI tools are used in research and drafting. Every factual claim, date, standard reference and regulatory statement is verified by a human against primary sources before publication, and every page carries a visible review date. Where we get something wrong we correct it in public at our corrections log rather than editing silently.

We label the status of what we publish. Ratified standards, working-group drafts, individual drafts with no formal standing, published industry frameworks and our own practical recommendations are distinguished throughout, because the difference determines whether you can rely on something, cite it to an auditor, or only watch it.

External links

We link to standards bodies, regulators, vendors and news sources. We do not control those sites, we are not responsible for their content, and a link is not an endorsement. Standards and regulatory texts change; always verify against the primary source. Vendor links carry no affiliate arrangement and no payment of any kind.

Trademarks and third-party marks

ISO® and IEC® are registered trademarks of the International Organization for Standardization and the International Electrotechnical Commission. OWASP® is a registered trademark of the OWASP Foundation. All other product names, company names, standards and marks referenced on this site are the property of their respective owners. Reference does not imply affiliation, sponsorship or endorsement in either direction. We describe the requirements of standards; we do not reproduce their text.

Governing law

This site is published by HumanAudit Inc., a Delaware corporation. These notices and any dispute arising from use of this site are governed by the laws of the State of Delaware, United States, without regard to conflict of law provisions. Nothing on this site has been reviewed or approved by legal counsel for your jurisdiction, and we make no claim that it has been.