Compliance and risk management insights
Notes from the field on ISO 27001, NIS2, GDPR, the EU AI Act and asset-centric risk management.
Control effectiveness: implemented is not the same as effective
A high implementation rate shows that controls exist, not that they work. Effectiveness is shown by three checks per control: whether it runs, whether it covers the inventory and whether it achieves its purpose.
Cyber risk quantification: risk in euros, not traffic-light colours
Cyber risk quantification answers the budget question a heat map leaves open: only an expected loss in money can be set against a control's cost. The matrix remains fit for a first sort of the risk inventory.
NIS2 and supply chain security: the overlooked obligation
NIS2 makes supply chain security a duty of the contracting entity, and supplier questionnaires do not evidence it. Four levers hold up instead: criticality, contract, scoped evidence and event-driven review.
Asset management for information security: why inventories go stale
An asset inventory goes stale at the pace at which the organisation changes, not at the pace of its upkeep. A record stays current when its entries come from procurement, role assignment and operations, and when it is queried every day.