TL;DR. New national guidance now expects critical infrastructure operators to be able to run essential services for three months while completely cut off, from corporate networks,…
Read the article →TL;DR. ISACA has effectively called time on the supplier security questionnaire, and Australia’s regulators have moved the same way. Under CPS 230, CPS 234, the SOCI…
Read the article →TL;DR. Many energy operators started the Essential Eight, stalled at Maturity Level One, and are now looking at a hard new obligation: AESCSF Security Profile 2…
Read the article →On 19 August, the Australian Signals Directorate’s Cyber Security Centre issued a high alert titled, without much ceremony, “Act quickly.” Most of the organisations who should…
Read the article →A question we are hearing more and more, often phrased almost exactly this way, is some version of “I need to run a proper governance, risk…
Read the article →TL;DR. ISACA, the global professional body for governance, risk and assurance, has published a blueprint for modern third-party risk built on five shifts: a contextual risk…
Read the article →AUSTRAC's Operation Claw fraud was legible in the network of intermediaries the whole time. A questionnaire was never going to see it there. Here is where it actually lived.
Read the article →Somewhere in your organisation this morning, a spreadsheet is on its way to a supplier who will spend the better part of a week answering three…
Read the article →The risk grows daily, and sometimes hourly. New exposure arrives with every system connected, every supplier onboarded, every acquisition absorbed, and every technique the attackers refine.…
Read the article →There is a ritual that follows every breach that reaches the public. Within a day the coverage narrows from what happened to a single, sharper question,…
Read the article →If this is the kind of thinking you want on your side of the table, let's talk about your risk operation.
Get in touch