Cybersecurity Briefings
Short, practical notes on cyber risk, regulation and assurance, each drawn from a question raised in an advisory conversation and addressed in terms a board or senior leader can act on.
Get new briefings in your inbox as they are published.
The Executive Decisions Behind an Effective Security Leader
When you appoint a security leader or reset their remit, your executive team needs to agree what the role must achieve, what authority it carries and which business leaders will commit resources to delivery. Without those agreements, material risks can remain unresolved with a capable leader in post.
Board Assurance over CRA Reporting Readiness
From 11 September 2026, Article 14 of the Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents affecting product security. Boards need assurance that management can meet these obligations, fifteen months before the CRA's main requirements apply in December 2027.
What Supervision of Critical Cloud Providers Means for the Financial Firms That Rely on Them
In November 2025, the EU designated 19 ICT providers, including AWS, Google Cloud and Microsoft, as critical under DORA. In July 2026, the UK designated AWS, Google Cloud, Microsoft and Oracle as critical third parties.
The Cyber Security and Resilience Bill Puts UK Boards on Notice
The Cyber Security and Resilience Bill is the UK's answer to many of the same cyber resilience problems addressed by the EU's NIS2 Directive, which does not apply in the UK after Brexit. It updates the Network and Information Systems Regulations 2018 and is moving through its final stages in Parliament. It brings managed service providers, data centres and large electricity load controllers into UK cyber regulation for the first time, with penalties reaching 4% of worldwide turnover for the most serious breaches.
Governing the NIS2 Gaps That Remain at Programme Close
A NIS2 programme may reach its planned end date with some findings still open. Supplier negotiations can take longer than expected, technical remediation may depend on wider investment, and new gaps can emerge while delivery is under way. Extending the programme until every issue disappears may be impractical because the obligations, systems and risk environment continue to change.
A NIS2 Programme Should Leave an Operating Model Behind
When a NIS2 programme closes, the steering committee stands down and the programme team disperses. The regulatory obligations continue: controls require ongoing verification and evidence, risk assessments require refreshing, the incident notification capability requires testing, and the management body needs reporting to exercise oversight. Each of these needs to be designed, owned and handed over before the programme closes.
Governing a Compliance Platform
Compliance platforms like Drata centralise the control framework, evidence and ownership structure that an auditor interrogates. Their value depends entirely on whether what is in them reflects the organisation's actual control environment.
Deciding What the Board Needs to Know About Cyber Risk
A board cannot delegate accountability for the adequacy of the information on which it oversees material cyber risk. Management may develop and produce the reporting, but the board must determine whether it supports the judgements the board is required to make. Where the board never exercises that accountability, its oversight is defined by management by default.
The Governance Foundations of a NIS2 Programme
NIS2 places substantive, ongoing obligations on the management body. Building a compliance position that meets them requires a governed programme, with a mandate, a defined scope and formal close conditions. Organisations that treat NIS2 as a list of controls to check off will find the position they have built is difficult to demonstrate and harder to sustain.
What ISO 27001 Certification Tells the Board About NIS2 Readiness
ISO 27001 certification provides useful evidence of how an organisation manages information security. For an organisation within NIS2 scope, showing that every applicable obligation is met requires a further comparison of scope and evidence.
The Scope Decision Behind a Credible NIS2 Programme
A programme scoped too broadly cannot be delivered in time. One scoped too narrowly produces gaps that surface during supervisory inspection rather than during the programme. Both result from the same mistake: treating regulatory scope as programme scope rather than as its starting point.
The Human Oversight Gap in AI Deployment
For high-risk AI systems, the AI Act requires effective human oversight and places a specific obligation on deployers to assign that oversight to individuals with the necessary competence, training, authority and support. Greater system autonomy does not reduce that obligation.
NIS2 Is Not One Rulebook Across Europe
NIS2 is a European directive, not a regulation. Unlike a regulation, it does not apply identically across all EU Member States. Each Member State must enact its own implementing legislation, and scope, supervision and enforcement can differ materially between jurisdictions.
What Leadership Needs to Know Before Funding a NIS2 Programme
Leadership that approves a NIS2 programme without knowing which entities are in scope, which measures already exist and where the material gaps lie risks funding work in the wrong places and missing work that matters.
What ISO 42001 Certification Tells the Board About AI Act Readiness
ISO 42001 certification can support EU AI Act compliance. It does not, by itself, establish that every applicable obligation is met. Leadership needs a system-level view of the organisation's role, the requirements that apply and the evidence supporting compliance.
The CRA Makes EU Market Access Conditional on Product Cybersecurity
From 11 December 2027, products with digital elements within the CRA's scope can be placed on the EU market only if they meet the Cyber Resilience Act's essential cybersecurity requirements and carry the CE marking. For manufacturers selling hardware or software into the EU, compliance becomes a condition of EU revenue.
NIS2 Makes Cybersecurity a Leadership Duty
NIS2 requires the management bodies of in-scope entities to approve the cybersecurity risk-management measures, oversee their implementation and follow training. The duties apply through national law, so leadership first needs to establish which law applies, when it takes effect and which body carries the duty in each entity.
When a Fractional CISO Is the Right Appointment
The CISO appointment is often approached as a headcount question. The prior question is what governance structure cybersecurity leadership requires, and whether a permanent appointment is proportionate to the organisation's scale, risk profile and current circumstances.
Zero Trust and Cloud Security Assurance
Boards approve cloud migrations. They rarely have equivalent visibility into the access governance model that determines who can reach the workloads afterwards, or who is accountable for it.