Articles
Asset and service inventory: knowing what you actually run
An inventory is a record with checkable properties, not a database: what CM-8 requires.
Cybersecurity Governance
Hardening, monitoring, tooling and good practice.
Articles
The asset lifecycle: from acquisition to sanitisation
The inventory is a snapshot; the lifecycle is the process that ends an asset.
Articles
Classifying information: impact levels before labels
The impact level is the decision; the label only carries it to the object it governs.
Articles
Organisational, technical and physical controls: three families of control
How NIST sorts controls by who executes them, and where physical controls sit.
Articles
Owner, custodian and service owner: three names on one asset
Three hats on one asset: who sets the rules, who runs it, and what the register names.
Articles
The risk register and the exception register: recording what was accepted
One register keeps the risk decision; the other keeps the deviation and its expiry.
Articles
Roles, responsibilities and RACI: who does it and who answers for it
A RACI chart maps activities to roles; done badly it hides who answers for what.
Articles
Scope, assumptions and system boundaries: drawing the line around a system
Drawing a system boundary: the decision it encodes and the assumptions it rests on.
Articles
Service criticality and dependencies: what fails when this stops
Criticality is a property of the service, not the box: name what it depends on.
Articles
The structure of a security policy: what the document must contain
The parts a security policy must contain, and what their presence does not prove.
Articles
Suppliers and external services: risk that arrives with the contract
Supplier risk that arrives with the contract: what stays yours and how it is managed.
Articles
Asset owner, risk owner, service owner: who is accountable for what
Asset, process and risk are owned differently; NIST names who is accountable for each.
Articles
Assets, processes, data and dependencies: the scope of a security decision
An asset matters for its process and data; scope is a chain, not a perimeter.
Articles
Confidentiality, integrity and availability: what security actually protects
Security protects three separate properties, not one attribute: each has its own impact.
Articles
Designed, implemented, verified: three different claims about a control
Designed, implemented and effective: three different claims, each with its own evidence.
Articles
Evidence and audit trails: how a control becomes provable
An audit trail records what happened; evidence is the proof a control works.
Articles
Least privilege and defense in depth: two principles, two different jobs
Least privilege bounds one identity; defense in depth bounds one failure.
Articles
Policy, standard, procedure, guideline: four levels of instruction
Policy states intent, standards bind, procedures give the steps, guidelines advise.
Articles
Risk appetite and acceptance criteria: deciding how much risk is acceptable
Risk appetite is a leadership call; acceptance is real once written, owned and dated.
Articles
Threat, vulnerability, likelihood, impact: the parts of a risk
Risk is not one number: threat source, vulnerability, likelihood and impact are separate.
Articles
Treating a risk: mitigate, avoid, transfer, accept
Five ways to respond to a risk: what each one changes, what is left, and who answers.