<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0">
    <channel>
        <title>Sarika Bhatta</title>
        <link>https://sarikabhatta.com.np</link>
        <description>Cybersecurity Research Analyst at SecurityPal, technical writer, and international speaker. Based in Kathmandu, Nepal.</description>
        <lastBuildDate>Fri, 09 Oct 2026 17:39:51 GMT</lastBuildDate>
        <docs>https://validator.w3.org/feed/docs/rss2.html</docs>
        <generator>https://github.com/jpmonette/feed</generator>
        <language>en</language>
        <copyright>All rights reserved 2026, Sarika Bhatta</copyright>
        <item>
            <title><![CDATA[Assessing AI Vendors: The New Frontier of TPRM]]></title>
            <link>https://sarikabhatta.com.np/blog/assessing-ai-vendors</link>
            <guid>https://sarikabhatta.com.np/blog/assessing-ai-vendors</guid>
            <pubDate>Sun, 02 Aug 2026 00:00:00 GMT</pubDate>
            <description><![CDATA[Your vendor risk questionnaire was built for static software. Here's why AI-powered vendors need a different kind of scrutiny, and what to actually ask them.]]></description>
            <category>grc</category>
            <category>tprm</category>
            <category>ai-governance</category>
        </item>
        <item>
            <title><![CDATA[Why You Shouldn't Treat All Vendors Equally: The Key to Scalable TPRM]]></title>
            <link>https://sarikabhatta.com.np/blog/scalable-tprm-vendor-triage</link>
            <guid>https://sarikabhatta.com.np/blog/scalable-tprm-vendor-triage</guid>
            <pubDate>Tue, 10 Feb 2026 00:00:00 GMT</pubDate>
            <description><![CDATA[The biggest mistake TPRM programs make is treating every vendor equally. Here's a framework for triaging vendors based on inherent risk.]]></description>
            <category>tprm</category>
            <category>risk-management</category>
            <category>grc</category>
        </item>
        <item>
            <title><![CDATA[SOC 2 Type II Explained: Everything You Need to Know in Plain English]]></title>
            <link>https://sarikabhatta.com.np/blog/soc2-type-ii-explained</link>
            <guid>https://sarikabhatta.com.np/blog/soc2-type-ii-explained</guid>
            <pubDate>Wed, 16 Jul 2025 00:00:00 GMT</pubDate>
            <description><![CDATA[A plain-English walkthrough of SOC 2 Type II reports — what's inside them, how to read them, and why they matter for your organization.]]></description>
            <category>soc-2</category>
            <category>compliance</category>
            <category>grc</category>
        </item>
        <item>
            <title><![CDATA[Everything You Need to Know About Security, Compliance & Governance]]></title>
            <link>https://sarikabhatta.com.np/blog/security-compliance-governance</link>
            <guid>https://sarikabhatta.com.np/blog/security-compliance-governance</guid>
            <pubDate>Thu, 08 May 2025 00:00:00 GMT</pubDate>
            <description><![CDATA[A clear breakdown of the terms you'll encounter in information security — policies, standards, frameworks, regulations, and how compliance actually works.]]></description>
            <category>cybersecurity</category>
            <category>compliance</category>
            <category>governance</category>
        </item>
        <item>
            <title><![CDATA[A Beginner's Guide to ISO 27001 Certification]]></title>
            <link>https://sarikabhatta.com.np/blog/beginners-guide-iso-27001</link>
            <guid>https://sarikabhatta.com.np/blog/beginners-guide-iso-27001</guid>
            <pubDate>Wed, 30 Apr 2025 00:00:00 GMT</pubDate>
            <description><![CDATA[Want to understand how ISO 27001 certification actually works? Here's a simplified breakdown of clauses, Annex A, the certification process, and the Statement of Applicability.]]></description>
            <category>iso-27001</category>
            <category>compliance</category>
            <category>cybersecurity</category>
        </item>
        <item>
            <title><![CDATA[Digital Certificate and Its Use in Secure Communication]]></title>
            <link>https://sarikabhatta.com.np/blog/digital-certificate-secure-communication</link>
            <guid>https://sarikabhatta.com.np/blog/digital-certificate-secure-communication</guid>
            <pubDate>Sat, 22 Feb 2025 00:00:00 GMT</pubDate>
            <description><![CDATA[How does your browser know a website is real? Learn how digital certificates, public keys, and session keys work together to keep your data safe.]]></description>
            <category>cybersecurity</category>
            <category>encryption</category>
            <category>networking</category>
        </item>
        <item>
            <title><![CDATA[Difference Between Threat, Vulnerability, and Risk]]></title>
            <link>https://sarikabhatta.com.np/blog/threat-vulnerability-risk</link>
            <guid>https://sarikabhatta.com.np/blog/threat-vulnerability-risk</guid>
            <pubDate>Sat, 01 Feb 2025 00:00:00 GMT</pubDate>
            <description><![CDATA[Threat, vulnerability, and risk are often used interchangeably — but they mean very different things in cybersecurity. Here's a clear breakdown.]]></description>
            <category>cybersecurity</category>
            <category>risk-management</category>
            <category>fundamentals</category>
        </item>
    </channel>
</rss>