by alexmtro | Jul 3, 2026 | GRC
For years, protecting Controlled Unclassified Information to the NIST 800-171 standard has mostly meant one audience: defense contractors, and the CMMC program built to enforce it. The proposed FAR CUI rule changes who’s on the hook. It would extend NIST SP...
by alexmtro | Jul 3, 2026 | GRC
CMMC certification is how a company stays eligible for US Department of Defense contracts, and it asks for more than a binder of policies. To reach Level 2 you have to meet the practices in NIST SP 800-171, and two of them are about your people, not your paperwork....
by alexmtro | Jul 3, 2026 | GRC
DORA made operational resilience testing a legal duty for financial entities across the EU, not an internal best practice. It expects a real testing programme and business-continuity arrangements that actually work. Plenty of firms are handling that with a documented...
by alexmtro | Jul 3, 2026 | GRC
NIS2 turned board-level security training into a legal obligation, not a nice-to-have. Article 20 puts accountability for cyber risk on the management body itself, and Article 20(2) requires those same people to be trained. Most organisations are dealing with that by...
by alexmtro | May 18, 2026 | HackBack
I have seen this scene too many times.A group of people in a meeting room. Coffee on the table. Laptops open. A slide deck on the screen. The title says something like Ransomware Scenario Q2.Someone from security reads the scenario. People nod. A few people answer...
