Insights

Security teams in Australia are shifting away from the scramble that once followed the annual audit window. The Australian Signals Directorate, through the…

For security and engineering teams operating in fast-moving SaaS markets, the hardest part of a SOC 2 audit is rarely the controls themselves. It is the…

A data subject access request (DSAR) can look simple from the outside: an individual asks what personal information an organisation holds, and the organisation…

For organisations supporting the United States defence supply chain, access control is a continuing operational responsibility rather than a document prepared…

Third-party risk is a central part of HITRUST CSF readiness. A healthcare provider, software vendor, insurer, university or managed service provider may have…

NIST SP 800-171 incident response testing is intended to show that an organisation can detect, contain, eradicate and recover from a cybersecurity event…

PCI DSS Requirement 12 focuses on the organisational controls that keep payment security active between assessments. It covers security policies, defined…

SOC 2 access controls are often treated as a documentation exercise, but auditors are looking for evidence that permissions are appropriate, authorised,…

Security operations centres generate a constant stream of signals: failed logins, privilege changes, malware detections, unusual data access and configuration…

A healthcare breach rarely stays within one legal boundary. A US patient record may be processed by an Australian software team, stored in Singapore, accessed…