The role of internal audit cannot be underestimated as cybersecurity regulation takes shape across the EU and the US. EU NIS2, EU DORA, and the US DoW CMMC program all place a burden on internal audit to provide assurance of…
Gerry Kennedy, the problem with cyber insurance is that you just don’t know where to go to get a consistent message about underwriting, rates, and claims. More worrying is the increase in cyber incidents, which continues year-on-year to increase at…
In recognition that cybersecurity is a significant risk to the US Federal Government and the important role of the US General Services Administration(GSA). The GSA announced earlier this year that it is implementing the Cybersecurity Maturity Model Certification program, following…
The UK doesn’t even have to be bold…….it just needs to do what partner nations are doing. One only has to read cyber regulations across the globe to realise the risk they are attempting to manage and why, and the…
It is a pleasure to publish a paper on the UK’s cyber regulatory reset in the International Security Journal (ISJ). I examine the complexity of cybersecurity risk management, and the only lever that governments have left to manage the effects…
You either love the World Economic Forum (WEF) or hate them. They write allot and facilitate conversations, but don’t necessarily change the needle on the dial. Saying that this is a paper worth reading given the inflating and deflating bubble,…
Thank you for posting, Martin Schwarz. The UK has no cyber strategy, and we have no defensive program enabling UK industry manage cyber risk. Letters requiring cybersecurity risk management to boards, policy statements, and guidance documents do not deliver cybersecurity.…
Births, Deaths, and Marriages. Cyber risk is everywhere. This report highlights an issue with cybersecurity in the Korean Funeral industry. An industry that the 2025 hack of the UK Co-op retailer highlighted, as one of the UK’s largest funeral providers,…
It’s not just M&A. Data is the most important corporate asset, period. Data is the only corpoeate asset an organisation possess that once compromised promised through poor cyber risk management, impacts every aspect of corporate performance, shareholder value and carries…
The EU Cyber Resilience Act (CRA) became law in late 2024. Requiring the manufacturers and distributors of internet enabled digitial products and services to implement cybersecurity risk management. If they wish to sell or distribute products and services across the…
