Thinkwerke Documentation
Implementation guides, reference architectures, evidence models, and compliance mappings for regulated and core-industry organisations operating in vendor-hosted cloud environments.
Start here
- Getting Started
- Glossary of Terms
- Audit-ready evidence
- CI/CD (Continuous Integration / Continuous Delivery)
- CNAPP (Cloud-Native Application Protection Platform)
- Compliance mapping
- Control
- Control-to-proof
- CSPM (Cloud Security Posture Management)
- Evidence by design
- Operating model
- Shared responsibility
- SIEM (Security Information and Event Management)
- SSLM (Secure Software Lifecycle Management)
- Supply-chain security
- Tender evidence
- Vendor-hosted environment
- Vulnerability lifecycle
- How to Use This Documentation
Solutions & Architectures
Compliance Mapping
- Compliance Mapping
- ISO/IEC 27001: Compliance Mapping
- NIS2 Directive: Operational Security & Resilience
- Cyber Resilience Act (CRA): Product & Software Engineering
- Purpose
- What the CRA Actually Targets
- Core CRA Expectations
- Common Failure Patterns
- Thinkwerke Implementation Model
- Secure Software Lifecycle (SSLM)
- Vulnerability Handling
- Software Supply-Chain Governance
- Vendor-Hosted Responsibility
- Evidence and Audit Readiness
- Relationship to Other Frameworks
- Key Takeaway
- GDPR: Privacy Engineering & Data Protection by Design
- Purpose
- What GDPR Actually Requires
- Common GDPR Failure Patterns
- Thinkwerke Privacy Engineering Model
- LINDDUN Privacy Threat Modeling
- Applying LINDDUN in Practice
- Data Flow Mapping
- Technical Control Implementation
- DPIA as a Living Artefact
- Incident Detection and Breach Response
- Evidence and Audit Readiness
- Relationship to Other Frameworks
- Key Takeaway
- Compliance Crosswalks: One Control, Many Obligations
- Purpose
- Why Crosswalks Matter
- Thinkwerke Crosswalk Philosophy
- Core Crosswalk Dimensions
- Example: Vulnerability Management Crosswalk
- ISO 27001 ↔ NIS2 Crosswalk
- NIS2 ↔ CRA Crosswalk
- GDPR ↔ Security Framework Crosswalk
- Customer & Tender Alignment
- Evidence Reuse Model
- Maintaining Crosswalks Over Time
- Key Takeaway
Evidence Library
- Evidence Library
- Tender Evidence Packs
- Security Questionnaires
- Control to Proof
- Purpose
- Why Control Statements Fail Without Proof
- Thinkwerke Control Model
- 1. Control Definition
- 2. Control Implementation
- 3. Control Proof
- Traceability Model
- Evidence Lifecycle
- Example: Vulnerability Management
- Applicability to Regulations
- Engineering Ownership
- Relationship to Other Documents
- Key Takeaway
- Exportable Artifacts
Whitepapers & Research
- Whitepapers & Research
- NIS2 Engineering Guide
- From Directive to Defensible Implementation
- Purpose
- What NIS2 Actually Changes
- Engineering-Centric Interpretation
- Core Engineering Domains Affected
- Risk Management as an Operating Model
- Evidence Expectations
- Vendor-Hosted & Shared Responsibility
- Management Accountability
- Common Failure Patterns
- A Practical Path Forward
- Relationship to Other Materials
- Key Takeaway
- Cyber Resilience Act (CRA): Practical Implementation Guide
- From Legal Obligation to Engineering Reality
- Purpose
- What the CRA Introduces
- Engineering Impact of the CRA
- Core Engineering Domains
- Evidence Expectations Under CRA
- Vendor-Hosted & Shared Responsibility
- Common Implementation Pitfalls
- A Practical Implementation Model
- Relationship to Other Materials
- Key Takeaway
- ISO 27001: Evidence by Design
- From Documentation Compliance to Operational Proof
- Purpose
- The Problem with Traditional ISO 27001 Implementations
- What “Evidence by Design” Means
- Control Implementation Model
- Policy, Implementation, Proof
- Evidence Sources
- Continuous Assurance
- Vendor-Hosted Environments
- Business Impact
- Relationship to Other Materials
- Key Takeaway
- Vendor-Hosted Responsibility
- Clarifying Ownership in Cloud & Managed Environments
- From Assumed Trust to Defensible Accountability
- Purpose
- The Reality of Vendor-Hosted Environments
- The Shared Responsibility Model — and Its Limits
- Responsibility Categories
- From Responsibility to Evidence
- Validating Vendor Controls
- Regulatory Expectations
- Common Failure Patterns
- A Practical Operating Model
- Relationship to Other Materials
- Key Takeaway