The Key Ingredients of a Successful GRC Programme
It has to start with a degree of integration between threats, risks, controls and protective measures. The GRC acronym (Governance, Risk and Compliance) has been…
Talent and Governance, not Technology, are Key to Drive Change around Cyber Security
You Are Not Going to Fix Your Cyber Security Problems by Buying More Tech For the last 20 years, large organizations have been spending significant…
Towards Clearer Governance for OT Security
It is not rare for OT Security to end up in some form of organisational no-man’s-land This interesting interview with Andy Norton puts things in…
Helping Charities Do Data Governance
As you probably know I help organisations understand and manage their data better. Typically people turn to me because their data is a mess and…
Why does my company need Data Governance?
If you plan to implement data governance in your organisation, it’s really important to understand why you are doing it. This can often be a…
What is the number one Data Governance mistake?
Nine years ago, I wrote a report detailing what I believe to be some of the biggest mistakes you can make when implementing data governance.…
Cyber Security: The Operational Illusion
Security culture and governance eat tech for breakfast Looking back at what happened at ground level throughout the COVID crisis, it is clear that the…
Cyber Security and the Culture of Alienation
The COVID crisis is presenting most organisations with unprecedented situations, but it does not make cyber security less of a priority. On the contra…
“Good Security Governance” is not a Piece of Useless Consultant Jargon
For any organisation above a certain size, effective and efficient protection can only result from the layered application of protective measures at p…
A Contemporary Confucian business governance approach
A Confucian governance framework in a tech-based company can allow effective self-regulation, with public trust and technological innovation.
The Two Factors Killing GRC Practices
In many firms, the equation between Governance, Risk and Compliance around cyber security is becoming heavily weighted towards the G, and GRC function…
Why are we still talking about the reporting line of the CISO?
Why are so many organisations and security professionals still worried about the reporting line of the CISO? This is one of the oldest and most consis…