AUSTRAC isn’t waiting for 2027
A firm that has enrolled with AUSTRAC, written an AML/CTF program and briefed its board understandably feels like the hard part is done. Two things AUSTRAC…
Read the article →150 on the register. Thousands beneath. A handful that everyone shares.
What really sits under a financial institution’s material service providers, and why the tools most teams still use cannot cope. TL;DR We undertook this research for…
Read the article →Do your work in the hallways: a CISO, the board, and the burnout nobody reports
TL;DR I keep coming back to a conversation I had recently with a CISO I have a lot of time for. We were not talking about…
Read the article →Three months, disconnected: what CI Fortify really asks of energy and gas operators
TL;DR. New national guidance now expects critical infrastructure operators to be able to run essential services for three months while completely cut off, from corporate networks,…
Read the article →The rules on third-party risk changed. The behaviour hasn’t. I want to understand why.
TL;DR. ISACA has effectively called time on the supplier security questionnaire, and Australia’s regulators have moved the same way. Under CPS 230, CPS 234, the SOCI…
Read the article →You did the Essential Eight. AESCSF now wants Security Profile 2 by 2028.
TL;DR. Many energy operators started the Essential Eight, stalled at Maturity Level One, and are now looking at a hard new obligation: AESCSF Security Profile 2…
Read the article →N-able N-central: ASD’s high alert on a tool you don’t run is still your problem
On 19 August, the Australian Signals Directorate’s Cyber Security Centre issued a high alert titled, without much ceremony, “Act quickly.” Most of the organisations who should…
Read the article →How to run a GRC function without hiring a cyber consultant
A question we are hearing more and more, often phrased almost exactly this way, is some version of “I need to run a proper governance, risk…
Read the article →ISACA just retired the questionnaire
TL;DR. ISACA, the global professional body for governance, risk and assurance, has published a blueprint for modern third-party risk built on five shifts: a contextual risk…
Read the article →Operation Claw and the fraud a questionnaire could never see
AUSTRAC's Operation Claw fraud was legible in the network of intermediaries the whole time. A questionnaire was never going to see it there. Here is where it actually lived.
Read the article →