Risk
Risk appetite: from sentence to number
A statement approved in the minutes does not tell an analyst what to do. How to turn appetite into a limit, and a limit into acceptance criteria.
Read article →
Blog
Insights & updates
Guides, analysis and news on Enterprise Risk Intelligence, cyber risk, GRC and compliance.
Regulatory
Brazil's CMN Resolution 5,274/2025: what changed for financial sector cybersecurity
Compliance deadline passed in March 2026. The 14 mandatory minimum controls, the Pix requirements, and what ISO 27001 already covered.
Read article →
Third party
Third-party risk and CMN Resolution 4,893
An institution that outsources data processing or cloud still answers for the service. What the rule requires, article by article.
Read article →
Frameworks
NIST CSF 2.0: the six functions and what Govern changed
Version 2.0 added Govern and dropped the critical-infrastructure framing. What changes, and how it sits alongside ISO 27001.
Read article →
Risk
The 5×5 matrix does not say what risk costs
The heat map ties together risks two orders of magnitude apart. When the decision is about budget, a colour is not enough.
Read article →
Implementation
ISO 27001 checklist: the 93 Annex A controls
The 93 controls across four themes, the eleven that are new in 2022, and what an auditor accepts as evidence.
Read article →
Exposure
48,000 CVEs a year: where to start
Nobody fixes 48,000 vulnerabilities a year. The question is not how many you close but which — and CVSS alone answers that badly.
Read article →
Fundamentals
ISO 27000, 27001 and 27002: what is the difference
The numbers look alike; the roles do not. What each standard in the 27k family does, and which one you actually need.
Read article →
Risk
ISO 27005: the risk assessment 27001 demands
The standard you get audited against demands a risk assessment and does not say how to run one. ISO 27005 answers that — and it changed in 2022.
Read article →
Fundamentals
What ISO 27001 is, and what it is actually for
Not a list of IT controls. What the standard actually requires, what changed in 2022, and when certification pays off.
Read article →