All news with #iso 27001 tag

🔐 The author contends that cyber risk failures are often architectural and cultural, not purely technological, and argues for an ongoing cyber risk management process integrated with information security governance. He outlines a practical, strategic recipe—stakeholder mapping, framework selection (e.g., NIST CSF, ISO 27001), KPIs/KRIs, asset and threat assessments, and guardrails for cloud and generative AI workloads. The piece stresses building a mature risk culture, aligning GRC with the CISO role, enforcing technical controls and secure development practices (SAST/DAST/SCA), and running tabletop exercises to improve resilience and compliance with laws such as GDPR, CCPA and LGPD.

🔒 Amazon Web Services (AWS) announced that EY CertifyPoint completed an onboarding audit and reissued ISO and CSA STAR certificates on August 13, 2025, with no findings. The audit expanded the certified scope to include AWS Resource Explorer and AWS Security Incident Response alongside the other services covered under multiple ISO standards and CSA STAR CCM v4.0. Customers can retrieve certificates through AWS Artifact and view the full certified service list on the AWS ISO and CSA STAR Certified page.

🔒 Security leaders are entering budget season facing skepticism; success now requires translating technical needs into clear business impact. Presentations that tie investments to revenue protection, uptime, regulatory compliance, and quantified loss avoidance resonate with boards. Adopt a risk-focused framework, define measurable KPIs such as time to detect and remediate, and employ continuous validation to expose exploitable weaknesses and track remediation velocity. Use standards like ISO 27001 and NIST as familiar anchors while showing real-world validation to avoid shelfware.