Governance & risk
Deciding what matters, writing it down, and proving it afterwards.
33 sketches
AssuranceThree claims, three kinds of evidence
Board reportingThree things, not three hundred
ComplianceTrue about that day
Control effectivenessThree different claims
Cyber governanceThe stand everyone plays from
Cyber insuranceWhere the cover stops
ExceptionsTemporary, for eleven years
PolicyThe sign slows nobody
Risk acceptanceWhose yes was it?
Risk ownersEvery bag on one hook
Risk registersIs it connected to anything?
Risk transferOnly the bill moves
Security metricsWhich way does it send you?
Segregation of dutiesOut of reach on purpose
StandardsWhat actually takes the weight
Three lines modelThree jobs, one machine
'compliance means secure'Certified, and propped open
Risk is about uncertain impact, not merely bad thingsWhere it might land
A risk register is a decision queue, not a museumNot a display case
Risk acceptance spends organisational toleranceSigned, and spent
Control effectiveness is separate from control existenceTicked, and still empty
Risk owners need authority over the consequenceThe name, not the lever
Risk aggregation can reveal concentrationAll on one leg
Risk appetite needs operational thresholdsPaint the line on the gauge
Governance should distinguish advice from approvalTwo different acts
Regulatory scope is a security architecture questionThe rope follows the wire
Incident reporting deadlines change response prioritiesThe clock starts with the incident
DORA makes ICT third-party resilience a contractual and oversight responsibility for regulated financial entitiesThe work moves, the answering stays
Under NIS2, an organisation's sector, size and role can determine whether cybersecurity risk-management and reporting duties applyThree flaps, one outcome
Breach notification and incident notification are different testsTwo holes, two different shapes
Legal privilege does not make incident facts disappearIt seals the advice, not the facts
Regulation can make suppliers part of your compliance systemTheir controls, on your sheet
Law changes faster than evergreen security principlesOne post, two boards