Blog
Field notes from security operations and the audit room.
Notes on NIS2, ISO 27001, incident reporting and supply-chain risk, written by the people who run the platform.
The first ninety days of a part-time security owner
Someone has just been handed security on top of their existing job. Ninety days is enough to know what you have, what is already decided badly, and what the board has to sign. It is not enough to write forty policies, and the attempt is what usually fails.
Who owns security when nobody owns it
NIS2 makes the management body approve and oversee security measures. ISO 27001 requires the roles to be assigned. Neither says hire a CISO. In a company of forty, security lands on whoever is nearest, and nothing that is everyone's job gets done.