The second pillar
Improve your knowledge
Five moves. One loop. Any topic.
The frameworks and regulations you are expected to already know, taken one idea at a time — mapped, learned, checked, spaced out and applied. Not a certification course: the shortest honest path to holding the thing in your head.
How it works
-
5 min, once
Map
Before the first card, see the five to seven pillars the topic breaks into and say how each one feels. The ones you call new come first.
-
60–90 s a card
Learn
One card, one idea. What it is, why it is like that, what it is not to be confused with, and one case where it bites. Every card names its source.
-
2 min, every 3 cards
Check
Three cards, then three questions on those three. Not a score — the moment you find out which of the three you only think you read.
-
5 min a day
Reinforce
Cards come back at 1, 3, 7 and 21 days, interleaved across topics rather than grouped. A card is known once you have had it right three times running.
-
10 min a pillar
Apply
One realistic scenario, written in the language someone would actually use, and a rubric you are invited to disagree with. Disagreeing well is the point.
One idea per card. Three cards, then a check. Five to seven pillars per topic. A first pass through any topic is under an hour — the numbers are enforced by the build, not left to good intentions.
Compliance
EU regulation you are inside whether or not you read it.
-
NIS2
Cybersecurity as a legal duty, with a 24-hour clock
6 pillars · 18 cards
-
GDPR
Not a privacy policy — a set of duties with named defaults
6 pillars · 18 cards
-
EU AI Act
Risk tiers, and the moment a deployer becomes a provider
5 pillars · 15 cards
-
DORA
The regulation that outranks NIS2, and supervises your cloud provider
5 pillars · 15 cards
Service management
How work reaches the people who asked for it.
Project delivery
Governing a project without governing it to death.
Security
Standards and controls, and what they actually require.
GenAI
The parts that stay true when the model changes.
What we can promise, and what we cannot
The other half of this site executes every snippet against a real engine before it ships, so an answer key and the language cannot disagree. Nothing here can be run. NIS2's clocks, the AI Act's dates and ITIL's definitions are facts about the world, and no program can check them.
So we do the next best thing and make them traceable. Every card names the article, clause or section it came from, and links to the source. Every topic says when it was last checked and how closely — most of what is here was written from the cited texts and checked against reporting on them, rather than read line by line, and the pages say so rather than implying otherwise. If a card is wrong, the citation is what lets you prove it in one click — and [email protected] is where to send it.
None of this is legal advice. It is a way to hold the shape of a framework in your head well enough to ask the right question of someone who can give you advice.