A-R-C Insightshttps://www.a-r-c.me/fachartikel/en.htmlArticles on security governance and regulation.Sat, 11 Jul 2026 21:26:20 +0000Security questionnaire received? Structure first, then answerhttps://www.a-r-c.me/fachartikel/what-to-do-after-security-questionnaire.htmlhttps://www.a-r-c.me/fachartikel/what-to-do-after-security-questionnaire.htmlWhy SaaS teams should not improvise security questionnaires — and how structured buyer communication reduces friction.Sat, 11 Jul 2026 21:26:20 +0000Are ISO 27001 and a CISO Required by Law?https://www.a-r-c.me/fachartikel/iso-27001-ciso-required-by-law.htmlhttps://www.a-r-c.me/fachartikel/iso-27001-ciso-required-by-law.htmlWhen ISO 27001 or a CISO function becomes relevant through law, contract or governance, with sources on the BSIG, NIS2, GDPR and German company law.Sat, 11 Jul 2026 21:26:20 +0000GoBD and Software Development: Must Source Code Be Retained for Ten Years?https://www.a-r-c.me/fachartikel/gobd-source-code-retention.htmlhttps://www.a-r-c.me/fachartikel/gobd-source-code-retention.htmlWhat the GoBD, German Fiscal Code and Commercial Code actually require for source code, program versions, procedural documentation and build tools.Sat, 11 Jul 2026 21:26:20 +0000DORA and Software Providers: Who Is Responsible for What?https://www.a-r-c.me/fachartikel/dora-software-provider-responsibility.htmlhttps://www.a-r-c.me/fachartikel/dora-software-provider-responsibility.htmlDORA accountability, minimum contract terms, audit rights and exit rights: what financial entities and software providers need to address.Sat, 11 Jul 2026 21:26:20 +0000New Regulation: Software Defect or Change Request?https://www.a-r-c.me/fachartikel/regulatory-change-software-defect-change-request.htmlhttps://www.a-r-c.me/fachartikel/regulatory-change-software-defect-change-request.htmlWhen new regulatory requirements fall within existing software support obligations—and when they require renegotiation or a change request.Sat, 11 Jul 2026 21:26:20 +0000