NIS2 — what is actually different, and what is repackaged
A practical reading of the directive for organisations that already had a working ISMS, and where the genuinely new requirements bite.
Insights
Writing on our work
Observations from current engagements, opinion on industry developments, and the occasional longer essay.
DORA's supplier register is the workstream most projects underestimate
Of all the obligations DORA imposes, the ICT supplier register and contractual review consistently consumes the most effort. Why, and what to do about it.
ISO 27001:2022 transition — what to know one year before the deadline
The transition deadline from ISO 27001:2013 to ISO 27001:2022 lands on 31 October 2025. Where remediation work tends to land in practice.
Awareness training that survives the second year
Why most awareness programmes peak in year one and decline thereafter, and what to do about it.
The 24-hour incident-notification clock — what "becoming aware" actually means
NIS2 starts the early-warning clock at the moment of awareness. The definition has substantial interpretation latitude and high-stakes consequences.