ISACA CISM: Incident Management at the Program Level
Incident management at the program level is the discipline of turning individual security events into a repeatable management capability. Technical responders still investigate…
Read article03 / THE LATESTFresh thinking
From the editorial desk.
New technical explainers, certification perspectives and practical ideas.
ISACA CISM: Executive Communication for Security Leaders
Security leaders are responsible for more than identifying threats and operating controls. They must explain risk, priorities, incidents, investment needs, and program performance…
Read articleISACA CISM: Enterprise Risk Management for Security Managers
Security managers operate inside a broader enterprise risk environment. Cyber threats, data protection, resilience, third-party dependency, fraud, safety, financial exposure, compliance, and strategic…
Read articleISACA CRISC: Third-Party Technology Risk Management
Organizations increasingly rely on cloud providers, SaaS platforms, managed services, payment processors, software vendors, contractors, data suppliers, and specialist technology partners. Those relationships…
Read articleISACA CISM: Business-Aligned Security Strategy
An information security strategy should explain how security enables the organization to pursue its goals while keeping risk within acceptable boundaries. It is…
Read articleISACA CRISC: Technology Risk in Cloud and AI Programs
Cloud platforms and artificial intelligence programs can accelerate product delivery, analytics, automation, and new customer experiences, but they also change the way technology…
Read articleISACA CRISC: Risk Monitoring with KRIs and Control Metrics
Risk monitoring converts a periodic assessment into an ongoing management process. The organization needs evidence that exposure is moving toward or away from…
Read articleISACA CRISC: Risk Identification & Scenario Analysis
Risk identification is the discipline of describing what could happen to an organization in a form that can be analyzed, owned, and acted…
Read articleISACA CRISC: Risk Responses and Control Objectives
Risk management becomes operational when an organization decides what it will do about identified exposure. A risk assessment may describe threats, vulnerabilities, likelihood,…
Read articleISACA CISA: Risk-Based Audit Planning
Risk-based audit planning directs limited assurance resources toward the areas where failure would matter most. Instead of building the annual audit plan from…
Read articleISACA CISA: IT Operations and Service Management Controls
IT operations controls are the disciplines that keep production technology dependable after systems have been designed and deployed. They cover the daily work…
Read articleISACA CISA: IT Governance and Management Controls
IT governance determines how the organization directs technology, assigns decision rights, balances value and risk, and holds leaders accountable for outcomes. IT management…
Read articleISACA CISA: Business Resilience from an Auditor’s Perspective
Business resilience is the ability to continue delivering critical outcomes when technology, facilities, suppliers, people, or data are disrupted. From an auditor’s perspective,…
Read articleISACA CISA: Auditing Systems Development and Change Management
Systems development and change management determine how ideas become production technology and how production technology evolves without losing control. Auditors need to assess…
Read articleISACA CISA: Auditing Cloud Services and Third-Party Providers
Auditing a cloud service or third-party provider requires more than reviewing a contract and checking whether the vendor holds a certification. The auditor…
Read article