The obligations that matter, and the order in which they matter, depend on the sector you operate in and who supervises it. These pages set out what we see in each sector, what changes when the work is organised properly, and the specific trap that costs the most to discover late.
Overlapping supervisory expectations, a permanent audit cycle, and evidence gathered by hand every quarter.
Clinical data raises the bar on every control, and the entity classification decides how far that bar moves.
National assurance expectations, information classification, and suppliers pulled into scope by contract.
Enterprise procurement asks for a certificate before it asks about your product.
The regimes overlap more than the sector labels suggest, and an assessment establishes which obligations are genuinely in scope before anyone commits budget to closing them.