A manager receives a list of 200 accounts, half of them named after roles nobody recognises. The deadline is Friday, so everything is approved in four minutes. Nobody checks the few removals requested ...

Most incident exercises rehearse a script. Everyone reads their part, the plan is declared fit, and nobody learns that the out-of-hours alert goes to the wrong desk until it does so at 6 a.m. This ...

Most organisations have security policies; few have policies anyone reads. They were copied from a template years ago and name people who have left. When an auditor asks who has read them, nobody can ...

A fire at a warehouse, a failed storage array, a carrier that cannot collect, a ransomware attack: each stops a service customers rely on, and each is recovered differently. This pack plans for all of ...

Replaces raw CVSS ranking with a defensible model combining exploitability, asset criticality and exposure to produce remediation deadlines management will accept. This model decides how urgent each ...

Update, October 2026: Most of the scanners below were built in December 2021 and are no longer maintained: Google’s and CISA’s scanners are archived, Qualys has deprecated its utility in favor of its ...

Gives each DORA article's own text, what an entity must be able to show and the CISO Times documents that help. It maps nothing to ISO 27001 or NIST CSF (D-51). The workbook's sheets as you will ...

Assigns who supplies, validates, interprets and reports each metric so no number arrives without an owner. The workbook's sheets as you will receive them, with its example rows and the values its ...

Prepares the reporter for the questions a board will actually ask, including the uncomfortable ones, with guidance on answering honestly. It is used with the report written to the Board Reporting ...

Turns an abstract appetite discussion into stated tolerance thresholds that can actually be tested against the register. The document from section 1, as you will receive it. Highlighted [[text]] is ...

Structure for the documented ICT risk management framework, including its review and approval record. The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; ...