Tag
Risk Management
37 articles
Risk and vendors
Vendor security questionnaires that get answers
How to design and send vendor security questionnaires that come back complete: sizing by tier, reusing reports, writing answerable questions, and follow-up.
6 min read
Risk and vendors
NIST 800-30 risk assessments
How to run a risk assessment with NIST SP 800-30 Rev. 1: the four steps, the risk model, how likelihood and impact combine, and what the report must hold.
6 min read
Compliance frameworks
NIS2 cybersecurity risk management measures
The ten cybersecurity risk management measures in NIS2 Article 21, what each one asks for in practice, the evidence to keep, and how ISO 27001 maps to them.
6 min read
Risk and vendors
ISO 27005 risk management
What ISO/IEC 27005 is, how it supports ISO 27001 clause 6, and how to use its event-based and asset-based approaches to build a risk method you can defend.
6 min read
Compliance frameworks
The PCI DSS customized approach
The customized approach lets you meet a PCI DSS objective with your own control. What you must document, how assessors test it, and when it is worth it.
6 min read
Compliance frameworks
Building an ISO 27001 risk treatment plan
What an ISO 27001 risk treatment plan must do, the fields each entry needs, how owner approval and residual risk acceptance work, and how to keep it live.
6 min read
Risk and vendors
Managing SaaS sprawl
How to find the SaaS apps your teams already use, triage them into an owned inventory, retire the extras, and stop new sprawl without blocking the business.
6 min read
Security engineering
Business continuity and disaster recovery plans
Continuity keeps the business running; recovery restores the technology. How to run an impact analysis, map dependencies, write both plans, and test them.
6 min read
AI governance
Keeping an AI system inventory
What belongs in an AI system inventory, the fields worth keeping, where entries come from, and the change triggers that stop it going stale in months.
6 min read
Compliance frameworks
HITRUST corrective action plans
When HITRUST requires a corrective action plan, what a good CAP contains, how to set dates you can meet, and how CAP progress is checked through the cycle.
6 min read
Compliance frameworks
NIST CSF implementation tiers explained
What the four NIST CSF tiers describe, from Partial to Adaptive, why they are not maturity scores, and how to choose and evidence a target tier that fits.
6 min read
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read
Risk and vendors
Offboarding a vendor
How to offboard a vendor: inventory what it holds, export data, revoke every credential and DNS record, confirm deletion, update records, and keep evidence.
6 min read
Compliance frameworks
The ISO 27001 management review, done properly
What ISO 27001 clause 9.3 requires of a management review, who must take part, how to prepare each input, and what the record needs to show your auditor.
6 min read
Risk and vendors
Fourth-party risk, explained
What fourth-party risk is, where your vendors' vendors show up in SOC 2 reports and sub-processor lists, what GDPR and ISO 27001 expect, and what to do.
6 min read
Compliance frameworks
Building NIST CSF current and target profiles
How to build NIST CSF 2.0 current and target profiles: scoping, describing current practice with evidence, setting targets by risk, and planning gaps.
6 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Compliance frameworks
The HIPAA risk analysis requirement
What the HIPAA Security Rule's risk analysis must cover, the elements HHS guidance expects, how to scope all ePHI, and what is often mistaken for one.
6 min read
Risk and vendors
Vendor tiering by data access
How to tier vendors by the data and systems they can reach, the intake questions that set a tier, what each tier triggers, and edge cases that mislead.
6 min read
AI governance
The NIST AI Risk Management Framework, explained
What the NIST AI RMF 1.0 is, its trustworthiness characteristics, what Govern, Map, Measure, and Manage each ask for, and how it fits next to ISO/IEC 42001.
6 min read
Compliance frameworks
Building a privacy information management system on your ISMS
A step-by-step plan for extending an ISO 27001 ISMS into an ISO 27701 PIMS: roles, scope, privacy risk, controls, and the management review changes.
6 min read
Compliance frameworks
How to write a Statement of Applicability
What ISO 27001 requires in a Statement of Applicability, the columns worth adding, how to justify inclusions and exclusions, and how to keep it current.
6 min read
Risk and vendors
Risk treatment options: mitigate, transfer, accept or avoid
What each of the four risk treatment options really commits you to, the evidence each leaves, why transfer never moves accountability, and when to mix.
6 min read
Compliance frameworks
What the Govern function added in NIST CSF 2.0
Which parts of the NIST CSF 2.0 Govern function moved from version 1.1, which are new, and what each of the six Govern categories asks you to produce.
6 min read