Tag
Risk Management, page 2
37 articles
Risk and vendors
Writing a risk appetite statement
How to write a security risk appetite statement leadership will approve: appetite vs tolerance, a structure by category, sample wording, and common faults.
6 min read
Privacy
When a DPIA is required under GDPR
How to tell whether GDPR Article 35 requires a DPIA: the three named cases, the nine screening criteria, national lists, and what to record if you skip.
6 min read
Compliance frameworks
ISO 27001 clause 6: risk assessment and treatment
What ISO 27001 clause 6.1 requires of your risk assessment and treatment process, step by step, the records it must leave, and where auditors find gaps.
6 min read
Compliance frameworks
Tailoring NIST 800-53 controls
The tailoring activities NIST SP 800-53B describes, how to set parameter values and compensating controls, and how to record decisions a reviewer accepts.
6 min read
Compliance frameworks
The DORA ICT risk management framework
What Articles 5 to 16 of DORA require in an ICT risk management framework, who must own it, how often it is reviewed, and the evidence a supervisor expects.
7 min read
AI governance
Building an AI management system
A practical build order for an ISO/IEC 42001 AI management system: scope, policy, risk and impact methods, controls, and the first full audit cycle.
6 min read
Compliance frameworks
HIPAA administrative safeguards in practice
How to run each HIPAA administrative safeguard as a working process: who owns it, what it produces, and the dated records that show it operated all year.
6 min read
Risk and vendors
Risk scoring: likelihood and impact
How to build likelihood and impact scales two people apply the same way, how to combine them without false precision, and how auditors test your scores.
6 min read
Compliance frameworks
ISO 27001 clause 4: context and interested parties
What ISO 27001 clauses 4.1 to 4.4 require, how to record your issues and interested parties so they drive scope and risk, and what auditors look for.
6 min read
Compliance frameworks
Choosing a NIST 800-53 baseline
How FIPS 199 categorization and the high-water mark decide your NIST 800-53 baseline, who makes the call, and the categorization mistakes to avoid.
6 min read
Risk and vendors
Building a risk register auditors accept
The fields a risk register needs, how to write risks that are not missing controls in disguise, and the register mistakes auditors turn into findings.
7 min read
Compliance frameworks
NIST CSF 2.0 and its six functions
What NIST CSF 2.0 contains: the six functions and their categories, how subcategories are written, where profiles and tiers fit, and what it is not.
6 min read
Compliance frameworks
What an ISMS is, in plain terms
An ISMS is the management system ISO 27001 certifies, not a tool or a binder. What it is made of, what clauses 4 to 10 require, and where Annex A fits.
6 min read