Media & insights
Perspectives from our consulting practice on governance, cyber risk, regulation, and resilience — written for the executives, security teams, and auditors who have to make them work.
Reporting cyber risk to a Board that doesn't speak controls
ISO/IEC 27001 · COBIT REGULATIONDORA and NIS2: what actually changes in your architecture
DORA · NIS2 ISO 27001Certification readiness without a shelf-ware ISMS
ISO/IEC 27001 THIRD-PARTY RISKAssessing suppliers you have no leverage over
ISO/IEC 27005 RESILIENCEProving a recovery objective instead of asserting it
ISO 22301 PRIVACYData classification as the foundation of GDPR compliance
GDPRPerspectives
Executive reporting that answers the three questions a Board actually asks: what could stop us trading, what are we doing about it, and is it working. Metrics, committee structures, and an oversight model that survives a change of CISO.
Read the perspective →Enterprise risk assessment and business impact analysis produce a lot of paper and not much prioritisation. How to get from a control-gap list to a treatment plan that survives a budget conversation.
Read the perspective →What DORA and NIS2 actually require of your architecture, incident reporting, and supplier arrangements — mapped to the controls most organisations already run under ISO/IEC 27001, so the gap is smaller than it first looks.
Read the perspective →Cloud and third-party dependency now carries more residual risk than most internal estates. A proportionate third-party risk model: tiering by business impact, evidence you can realistically obtain, and contractual fallbacks.
Read the perspective →Business impact analysis, continuity and disaster recovery planning, crisis management, and the resilience testing that turns a documented RTO into an evidenced one. Where exercises usually fail, and how to design one that finds something.
Read the perspective →Annual e-learning is a compliance artefact, not a control. Building differentiated programmes for executives, developers, technical teams, and general staff — and measuring the behaviour, not the completion rate.
Read the perspective →