Notes from the Frank team.
On compliance, audits, and the gap between what is recorded and what is true. Subscribe to the RSS feed.
-
Almost a quarter of incidents were found from outside
Of the cyber security incidents ASD responded to last year, 362 were identified after ASD told the organisation. What that says about who tests your posture, and when.
-
Three words
A control justified in three words is the cheapest finding in an assessment to fix, and the easiest to leave for years.
-
Compliant and breached
What the public record supports behind the eleven months: what happens when someone goes back and measures the gap between "assessed compliant" and "compliant now", and what a regulator found when it examined a certificate held at the time of a breach.
-
A programme can be up to date and still not name the risk
A critical infrastructure risk management programme can be current, reviewed and lawfully attested, and still not contain the hazard that takes the asset down.
-
A contradiction in the wild: implemented, accepted, and being fixed
One control, three of the organisation's own approved registers, three different answers, and the structural reason nobody had noticed.
-
A green dashboard is an argument, not evidence
A green tile is a conclusion, not an observation. Here is the difference between an assertion and evidence, and why a tool that turns your self-reports green is producing the confidence it was supposed to test.
-
Can your board honestly sign that the programme was up to date?
The Security of Critical Infrastructure Act has a board approve, once a year, a statement of whether its risk management programme was up to date at the end of the financial year. Here is why that statement is hard to get right from a view of the programme taken months later, and what a board needs in order to make it honestly and to oversee the programme in between.
-
Why we turn buyers away
A product built to produce discomfort has to be willing to refuse the customer who wants to look better rather than be better. Here is the qualification we run before we sell anyone anything, and why the discomfort is the point.
-
Why risk registers go stale faster than anyone notices
Your risk register records what you typed, not what your evidence does. Here is why the heat map and the self-scored residual survive, and what an honest, evidence-backed register looks like instead.
-
I've worked as a lead ISO 27001 auditor. Here's what a sign-off can't see.
An honest account of what a point-in-time audit structurally cannot observe, written from the auditor's chair, not against it. The limits are in the frame, not the diligence.
-
The eleven months your certificate isn't watching
An audit is a sample taken on a single day; the certificate hangs on the wall for a year. Here is what happens in the gap between the two, and why "compliant at the time" is a breach pattern, not a defence.
-
Why confidence decays, and why your dashboard should say so
Most GRC dashboards print a static green tick. Frank prints an expiry date. Here's why every claim we publish carries one.