If you’ve ever sat in a meeting where someone talked about risk appetite and someone else talked about risk tolerance, and you quietly wondered whether they meant the same thing, you’re in good company. They are two of the most muddled terms in risk management, and I regularly see them used interchangeably in policies and […]
Risk Appetite vs Risk Tolerance: What’s the Difference? Read More »
Short answer: no. Slightly longer answer: no, and the difference is worth five minutes of your time, because getting it wrong in a tender response or a job description is one of those small mistakes that quietly tells a reader you haven’t quite done your homework. We hear the two terms swapped constantly — in
Information security vs cyber security: are they actually the same thing? Read More »
This week, Outlook and email hosted through Microsoft went down for hours, for a huge number of people, all over the world. If you tried to send an email on Monday and it just sat there, or you couldn’t log in at all, that wasn’t your computer. That was everyone. The cause turned out to
If you’ve had an email recently telling you your data was caught up in a “cyber security incident”, Manchester Airport’s recent breach notification will be a familiar shape to a lot of people right now. The natural reaction is to read it once, feel briefly uneasy, and then do nothing with it. That’s understandable. Most
Got a Data Breach Email? Here’s What to Actually Do Read More »
I’ve spent a chunk of this week reading National Occupational Standards, which is not a sentence I expected to type. It started because I wanted to check how our own loggist training holds up against the Resilience and Emergencies NOS — the official competency framework for this sector. Sensible enough. Then I noticed that the
What “Aligned to the National Standards” Actually Tells You Read More »
The National Cyber Security Centre published new guidance in late July on recovering from a disruptive cyber attack. It’s genuinely good advice, but it’s written for organisations with a CISO, a Board and a dedicated IT team. If you run a smaller business, some of it won’t map onto your world at all. Here’s what
What to do when a cyber attack hits your business (in plain English) Read More »
In July, a company called Hugging Face got hacked. Hugging Face is a platform that hosts AI models and datasets, used by developers all over the world. What made this one different is who did the hacking: an AI system belonging to OpenAI, which had been let loose in a test environment, escaped it, and
When Your Supplier Has a Bad Day, You Have One Too Read More »
What Every Public Inquiry Is Really Telling Us About Logging I’ve been watching the news around the various public inquiries running at the moment, and there’s a pattern that keeps showing up. It’s not really about the disaster, the failure, or the tragedy itself. It’s about what happened afterwards, when someone asks the question that
What Every Public Inquiry Is Really Telling Us About Logging Read More »
What England’s World Cup night can teach you about crisis management (even if, like me, you couldn’t care less about football) I woke up this morning to the news discussing the England match (and the update to my position in the family sweepstake….I still have Norway, France and Spain which I am told is good!).
ISO Spaghetti: Making Sense of the Standards You Keep Hearing About If you work in any kind of professional role, you have probably come across ISO standards. They get mentioned in tender documents, supplier questionnaires, job adverts, and LinkedIn profiles. ISO 27001. ISO 22301. ISO 31000. Sometimes all three in the same sentence. But what
ISO Spaghetti: Making Sense of the Standards You Keep Hearing About Read More »
