Insights
Practical perspectives on AI security, governance, risk and compliance — for leaders who need to act, not just understand.
How to plan and run an ISO 27001 internal audit: scope, audit programme, clauses 4 to 10, Annex A sampling, grading findings and closing corrective actions.
CMMC 2.0 explained: the three levels, 110 NIST SP 800-171 requirements, SPRS scoring, POA&M rules and what it means for Australian suppliers.
How to conduct a cyber security risk assessment step by step: scope, threats, vulnerabilities, a 5x5 risk matrix, appetite and NIST SP 800-53 treatment.
What ISM compliance really means, how the risk-based approach works, and the practical steps to apply the Australian Government Information Security Manual to your systems.
A practical guide to third-party risk management: tiering vendors, security questionnaires, evidence, scoring, contracts, monitoring and AI questions.
NIST CSF 2.0 explained: the new Govern function, all six functions, categories, profiles and tiers, and how Australian organisations can use it with the ISM.
AI governance is moving from principles to auditable systems. Here is what ISO 42001 means in practice — and the five questions every Board should be asking now.
A practical guide to the PSPF annual self-assessment: how maturity is judged, the evidence that matters, and how to turn PSPF reporting into genuine security improvement.
How to map NIST SP 800-53 to the Australian ISM, where the frameworks align and differ, and how a unified control set cuts compliance effort for global and government work.
A practical guide to writing a System Security Plan (SSP): structure, what assessors look for, common mistakes and how the SSP, SRMP and Statement of Applicability fit together.
AI agents run code, hold credentials and act on our behalf. Here is how the Essential Eight still applies — and where assessors should be looking harder.
Preparing for an IRAP assessment? Ten practical readiness steps — from system boundary and SSP quality to evidence and cloud responsibilities — that save time, cost and findings.
A practical guide to the SOCI Act Critical Infrastructure Risk Management Program (CIRMP): the four hazard domains, cyber framework alignment, and preparing for Board attestation.
Your suppliers are shipping AI features whether you asked for them or not. A practical approach to AI supply chain risk and third-party AI governance for regulated organisations.
The AI security risks that matter most to Boards and executives — prompt injection, sensitive data leakage, excessive agency and supply chain risk — and the controls that address them.
How to design cyber risk reporting that Boards use: choosing key risk indicators (KRIs) and key control indicators (KCIs), setting thresholds and telling a clear story.
No articles match — try another topic.