Gwenda ResourcesGwenda is an AI-first GRC platform that discovers the controls in the applications you already run and measures your risk posture against the gold standard for your industry.https://www.gwenda.ai/en-auCPS 230 does not apply to you. Your investors will apply it anyway.https://www.gwenda.ai/resources/cps-230-flow-down-private-credit/https://www.gwenda.ai/resources/cps-230-flow-down-private-credit/A private credit manager is not APRA-regulated, yet it is signing CPS 230 terms anyway, because a super fund trustee cannot lawfully retain a material service provider without them.Fri, 14 Aug 2026 00:00:00 GMTfinancial-servicesWhat Essential Eight Maturity Level Two actually requireshttps://www.gwenda.ai/resources/essential-eight-maturity-what-good-looks-like/https://www.gwenda.ai/resources/essential-eight-maturity-what-good-looks-like/Maturity Level Two is the practical expectation for most Australian organisations handling sensitive data. Here is what each strategy asks for, and where self-assessments overstate.Tue, 14 Jul 2026 00:00:00 GMTcyber-securityThe strengthened Aged Care Quality Standards: what actually changedhttps://www.gwenda.ai/resources/strengthened-aged-care-standards-what-changed/https://www.gwenda.ai/resources/strengthened-aged-care-standards-what-changed/The seven strengthened Standards took effect on 1 November 2025 under the Aged Care Act 2024. The substantive change is evidentiary, and it falls on systems never designed to produce evidence.Tue, 30 Jun 2026 00:00:00 GMTaged-careWhat assessment and rating actually asks you to evidencehttps://www.gwenda.ai/resources/nqs-assessment-and-rating-evidence/https://www.gwenda.ai/resources/nqs-assessment-and-rating-evidence/Seven quality areas, fifteen standards, forty elements. Services doing the work still lose ground at rating on the documentary half, Quality Area 7 especially.Wed, 10 Jun 2026 00:00:00 GMTchild-careWhy SOC 2 preparation is painful, and what actually fixes ithttps://www.gwenda.ai/resources/soc-2-type-ii-evidence-window/https://www.gwenda.ai/resources/soc-2-type-ii-evidence-window/The controls are usually in place. What tends to be missing is contemporaneous evidence that they operated across the observation window, and that cannot be reconstructed after the window closes.Fri, 22 May 2026 00:00:00 GMTsoc-2You cannot protect personal data you cannot locatehttps://www.gwenda.ai/resources/where-personal-data-actually-lives/https://www.gwenda.ai/resources/where-personal-data-actually-lives/The hardest question in a privacy programme is where the personal data is, right now, and who can reach it. Writing the policy is easy by comparison. And the hard question has a real answer.Tue, 05 May 2026 00:00:00 GMTprivacyCompliance theatre and the evidence gaphttps://www.gwenda.ai/resources/compliance-theatre-versus-evidence/https://www.gwenda.ai/resources/compliance-theatre-versus-evidence/Most organisations are unevidenced rather than non-compliant, which looks identical from the outside and gets treated identically by regulators, auditors and boards.Sat, 18 Apr 2026 00:00:00 GMTgrc-practice