Risk Management Should Drive Decisions, Not Just Maintain a Risk Register
Many organizations maintain a risk register. Risks are documented, assigned ratings, given owners, and reviewed periodically. Yet the information in […]
Governance & Risk
Cybersecurity & Compliance
NIST SP 800-171: Moving From a Checklist to Sustainable Compliance
NIST SP 800-171 requirements can easily become a checklist exercise. A requirement is reviewed, evidence is located, a status is […]
Cybersecurity & Compliance
CMMC Readiness: Why Waiting for the Assessment Is Too Late
For organizations subject to Cybersecurity Maturity Model Certification requirements, the assessment should not be the event that determines whether the […]
Cybersecurity & Compliance
Compliance Is Not Security: Understanding the Difference
Organizations sometimes use the terms security and compliance interchangeably. They are related, but they are not the same thing. Compliance […]
Governance & Risk
Connecting Service Management, Governance, and Risk
Service management, governance, and risk management are often treated as separate disciplines. In practice, they are deeply connected. Services create […]
Service Management
Why Governance Matters More Than Another Service Management Tool
When service management is not working effectively, organizations often look for a technology solution. A new ITSM platform promises better […]