ISMS.online

Business no longer operates on an annual cycle. Regulations change. AI evolves. New tools get deployed, and new risks emerge. Yet governance is still too often treated as something that's revisited once a year. That's where the resilience gap appears. Organisations that embed governance across information security, data privacy and AI governance are better equipped to adapt to change, demonstrate trust and strengthen business resilience. The Resilience Loop shows how continuous governance helps turn compliance from a point-in-time achievement into an ongoing business capability. Learn more:

Parts of the EU AI Act are already in force, and full enforcement on regulations against high-risk AI systems is set to take effect in stages. Yet a majority of C-suite leaders identify regulatory non-compliance as their primary AI concern. The regulatory obligation is real, but governance hasn’t kept pace. In her blog, Rebecca Harper discusses how the EU AI Act is driving boards to address gaps in compliance, and why proactive governance will outperform last-minute implementation. Key takeaways: ✔️ An appliedAI study of enterprise AI systems found that 40% could not clearly identify their own risk classification under the Act ✔️ AI governance cannot be treated in isolation from information security and data privacy ✔️ The AI Act is not the ceiling on what governance requires. It is the floor. Learn why organisations must start building the integrated governance infrastructure needed to meet the December 2027 EU AI Act deadline 👇 https://lnkd.in/eDSMvPKZ #EUAIAct #AI #AIGovernance #Compliance #InformationSecurity

The National Institute of Standards and Technology (NIST) recently formally abandoned its longstanding mission to enrich all information about vulnerabilities published to its National Vulnerability Database (NVD). Instead, it will focus on high-priority common vulnerabilities and exposures. In his blog, Danny Bradbury shares why NIST's pullback should prompt organisations to take a resilience approach to vulnerability management. Key takeaways: ✅ Submissions to the NVD increased 263% between 2020 and 2025, as vulnerability exploits become one of the leading breach vectors ✅ Vulnerability scanners that rely exclusively on NVD-derived enrichment data will be impacted and unable to match vulnerabilities to products ✅ Companies must begin looking at vulnerability management as one part of a broader resilience initiative. Learn more about NIST’s NVD pullback and how businesses can build resilience into vulnerability management 👇 https://lnkd.in/ezajCHTp #NIST #NationalVulnerabilityDatabase #VulnerabilityManagement #Cybersecurity #InformationSecurity

The EU’s Cyber Resilience Act (CRA) is the first major regulation to treat cybersecurity as a product safety requirement rather than an organisational governance one. For organisations selling products into the EU market, the implications extend far beyond compliance. In her blog, Rebecca Harper deep dives into the CRA: what it is, who it applies to and how businesses can ensure compliance. She covers: 📌 Notable aspects of the legislation, including mandatory incident and vulnerability reporting requirements 📌 What businesses often get wrong about the CRA 📌 Key dates organisations need to know 📌 Steps businesses can take to ensure compliance with the regulation. Learn more about the CRA 👇 https://lnkd.in/ey83ue_2 #CyberResilienceAct #BusinessResilience #InformationSecurity #IncidentResponse #ProductSafety

Cyber-risk management has grown in scope over the years, now spanning everything from traditional security disciplines to supply chain risk, AI governance, operational resilience and more. In his blog, Phil Muncaster discusses how organisations can navigate potential silos and coverage gaps to achieve joined-up governance. He covers: 📌 How AI, supply chains and the regulatory environment have intensified the already complex cyber-risk management landscape 📌 Three key barriers to integrated risk management and how organisations can tackle them 📌 How frameworks like ISO 27001 and NIST support synchronisation across governance domains. Discover how organisations can achieve unified cyber-risk management: https://lnkd.in/eBMdF2x7 With insight from Dom Glavach, CISSP- Black Duck, Muhammad Yahya P.- Huntress, Ronald Lewis, CISSP, CSM- Black Duck #CyberRisk #RiskManagement #InformationSecurity #Cybersecurity #ISO27001

Much of the early commentary around the UK’s Data (Use and Access) Act (DUAA) focused on the divergence it introduced. But the DUAA doesn’t dilute accountability, it redistributes it. Organisations that will navigate the Act successfully are those who can consistently evidence how decisions are made, reviewed and improved over time. In the blog, Rebecca Harper shares how the integrated application of ISO 27001, ISO 27701 and ISO 42001 can operationalise compliance with the DUAA. Key takeaways: ✅ The DUAA fundamentally intersects information security, privacy operations, marketing compliance, AI governance, and international data transfer functions ✅ Strategic integration of ISO 27001, 27001 and 42001 creates one risk model and one evidence base ✅ Organisations operating integrated management systems will absorb further regulatory change incrementally. Learn more about the strategic advantage provided by the ISO 27001, ISO 27701 and ISO 42001 loop 👇 https://lnkd.in/e3eWf52V #DUAA #ISO27001 #ISO27701 #ISO42001 #BusinessResilience