The Catch-22 of Policy Updates

Since the role of the Chief Information Security Officer (CISO) and how he or she reports has a major impact on security and risk, I think it’s interesting to look at how different organizations have structured the position. With that said, there is very little consistency other than a correlation with the industry vertical’s understanding of IT risk.

Explains what a vulnerability disclosure policy is and why the EU CRA and NIS2 now make it a compliance expectation, then walks through the key decisions behind each policy section, offering a free template for security and legal teams to adapt.

Risk Neutral CEO Jeff Sauntry on the Chief Risk Officer role's evolution, the five enterprise risk categories, and how security leaders can translate technical risk into board-level language.

A six-activity starting guide for application security programs: define S-SDLC governance gates, adopt secure design review, and integrate penetration and security testing into QA.

Debunks four application security myths—'an AppSec team is optional,' 'we're too small'—and shows how small teams, governance, and security champions programs can embed security into the SDLC.

Four myths hold back application security programs, from 'AppSec teams are optional' to 'DevOps shops do not need one'; successful journeys start with a central governing team and defect discovery.