Category: Security frameworks

ISO 27017 is not a certification. Here is what the standard actually contains, how it differs from ISO…

In most industries a quality escape costs money. In aerospace and nuclear it can cost lives, and the quality regimes reflect that. Aerospace quality management under the AS9100 family, and

Ask two companies how they prove supply chain security and you will get two unrelated answers. One will describe physical controls over goods in transit; the other will describe how

ISO 55001, ISO 41001 and ISO 50001 manage different things about the same estate. What each one actually…

Teams adopting COBIT, ISO 31000 and the CIS Controls often assume they are choosing between them. They are not. Each occupies a different layer of the same problem, and an

If your institution is on the SWIFT network, security is not a matter of internal policy. SWIFT CSP attestation is an annual obligation: every member must attest against the Customer

There is no single rulebook for finance. Financial services compliance is a patchwork determined by what you do and where you do it — a bank in Riyadh, a European

Most organisations arrive at quality, health and safety, and environment separately — three managers, three manuals, three audit schedules, three sets of paperwork that say much the same thing. A

Sarbanes-Oxley made internal control a named personal responsibility: under Sections 302 and 404, executives sign to say the controls over financial reporting work, and auditors test whether that signature is

Healthcare vendors get asked for HIPAA compliance constantly, and increasingly for HITRUST certification as well. The two are often spoken of as if they were alternatives, which they are not.

Sooner or later a prospect asks a cloud provider to prove its security, and the honest first answer is a question: prove it to whom? There is no single cloud