Insights
The standards and rules behind the work.
Written for the person who has to act on them: what each one is, what it actually requires, and the date or decision that matters. No cadence promised — these are published when there is something worth saying.
72 articles
Regulation
The CERT-In directions: a six-hour clock, and two duties that bind you before anything happens
What the 2022 directions actually say, which obligations apply on an ordinary day, and where the six-hour clock starts.
Choosing
ISO/IEC 42001: do you need an AI management system yet?
What the standard covers, who is actually in scope, and an honest account of when certifying is premature.
Choosing
A third-party risk programme that is not just a questionnaire you send
How to tier a supplier estate, decide what to ask whom, and keep the answers current once the onboarding is over.
Payment security
PCI DSS v4.0.1: what changed, what became mandatory in March 2025, and SAQ or ROC
Fifty-one requirements stopped being best practice on 31 March 2025, and whether you self-assess was never yours to decide.
Evidence
Records of processing: the artefact every privacy obligation leans on
You cannot answer a rights request, a breach or a questionnaire without it.
Evidence
Exercising a continuity plan: the requirement organisations under-do
An exercise that surfaced nothing was not an exercise.
Evidence
The business impact analysis, and why IT should not set the RTO
Recovery objectives are a business decision that IT then has to deliver.
Technical testing
OWASP MASVS and MASTG: what a mobile app security test should cover
The standard, the test guide and the profiles — and the one thing all three leave out, which is where much of the risk sits.
Certification
Carve-out or inclusive: a scoping decision in your own report
Two ways to treat the providers you depend on, with very different cooperation costs.
Scroll for more