Insights
Practical perspectives on information security management, compliance and business risk.
Penetration testing
Useful testing starts with a clear question: which risk do we need to assess, and what decision will the results support? Use this checklist to prepare an enquiry and compare the scope of competing proposals.
Read insight →Information security management
The need for information security leadership usually appears before a full-time role is justified. The real question is not the job title, but whether someone consistently manages risk, ownership, decisions and evidence.
Read insight →DORA
DORA readiness cannot be assessed reliably through a policy list alone. Management needs to know whether ownership is clear, controls operate, evidence persists and material gaps have accountable owners and realistic dates.
Read insight →