Category
Risk and vendors
Risk registers, risk assessment methods, vendor due diligence and the third-party risk work that every framework expects you to run.
13 articles
Risk and vendors
Vendor security questionnaires that get answers
How to design and send vendor security questionnaires that come back complete: sizing by tier, reusing reports, writing answerable questions, and follow-up.
6 min read
Risk and vendors
NIST 800-30 risk assessments
How to run a risk assessment with NIST SP 800-30 Rev. 1: the four steps, the risk model, how likelihood and impact combine, and what the report must hold.
6 min read
Risk and vendors
ISO 27005 risk management
What ISO/IEC 27005 is, how it supports ISO 27001 clause 6, and how to use its event-based and asset-based approaches to build a risk method you can defend.
6 min read
Risk and vendors
Managing SaaS sprawl
How to find the SaaS apps your teams already use, triage them into an owned inventory, retire the extras, and stop new sprawl without blocking the business.
6 min read
Risk and vendors
Continuous vendor monitoring
What to watch between annual vendor reviews: report expiry, incidents, sub-processor and usage changes, what each signal should trigger, and cadence by tier.
6 min read
Risk and vendors
Offboarding a vendor
How to offboard a vendor: inventory what it holds, export data, revoke every credential and DNS record, confirm deletion, update records, and keep evidence.
6 min read
Risk and vendors
Fourth-party risk, explained
What fourth-party risk is, where your vendors' vendors show up in SOC 2 reports and sub-processor lists, what GDPR and ISO 27001 expect, and what to do.
6 min read
Risk and vendors
A vendor due diligence checklist
A pre-contract vendor due diligence checklist: assurance reports, data handling, access, incidents, contract terms, sub-processors and the approval record.
6 min read
Risk and vendors
Vendor tiering by data access
How to tier vendors by the data and systems they can reach, the intake questions that set a tier, what each tier triggers, and edge cases that mislead.
6 min read
Risk and vendors
Risk treatment options: mitigate, transfer, accept or avoid
What each of the four risk treatment options really commits you to, the evidence each leaves, why transfer never moves accountability, and when to mix.
6 min read
Risk and vendors
Writing a risk appetite statement
How to write a security risk appetite statement leadership will approve: appetite vs tolerance, a structure by category, sample wording, and common faults.
6 min read
Risk and vendors
Risk scoring: likelihood and impact
How to build likelihood and impact scales two people apply the same way, how to combine them without false precision, and how auditors test your scores.
6 min read
Risk and vendors
Building a risk register auditors accept
The fields a risk register needs, how to write risks that are not missing controls in disguise, and the register mistakes auditors turn into findings.
7 min read