NIST CSF Risk Assessment: How to Run One Under CSF 2.0
On February 21, 2024, UnitedHealth Group detected ransomware inside Change Healthcare, the clearinghouse that … Read more
Cyber risk stopped being a technology topic the moment regulators started asking boards to evidence oversight of it. The hard part is no longer knowing that NIST CSF exists. It is deciding which of the six overlapping frameworks and four supervisory regimes on your desk actually applies, and how to avoid running the same assessment four times.
The emphasis here is therefore comparative and practical: what changed between CSF 1.1 and 2.0 and how to transition, how NIST CSF and ISO 27001 differ in use, whether SOC 2 or ISO 27001 is the right certification to pursue, where DORA and NIS2 overlap, and walkthroughs of the FFIEC assessment tool, the FTC Safeguards Rule and 23 NYCRR 500. Quantification gets real treatment too, including the FAIR model applied in financial services.
Pair this with information security management systems, third-party risk and governance, risk and compliance.
FFIEC Cybersecurity Assessment Tool Walkthrough for Community Banks
On June 26, 2024, Evolve Bank & Trust, a roughly $1.5 billion community-class bank … Read more
OSHA Recordkeeping Risks for US Warehouses Under 50 Employees
US warehouse workers logged injuries at a rate of 4.5 cases per 100 full-time … Read more
SOC 2 vs ISO 27001: Which Security Certification to Pursue
Figure 1. SOC 2 vs ISO 27001 at a glance — a US attestation … Read more
NIST CSF 2.0 vs 1.1: What Changed and How to Transition
Figure 1. NIST CSF 2.0 vs 1.1 at a glance — a decade-apart structural … Read more
DORA vs NIS2: How EU Cyber Resilience Regulations Differ and Overlap
Figure 1. DORA vs NIS2 at a glance — scope, timing, and core obligations … Read more
CISSP vs CISM vs CRISC: Comparing Cybersecurity and Risk Certifications
In March 2026, a CISO at a mid-cap US bank described her last three … Read more
NIST CSF vs ISO 27001: Which Cybersecurity Framework Is Right for You?
Between the first half of 2023 and the first half of 2024, mentions of … Read more
Ransomware Business Impact Analysis: Linking Cyber Incidents to BIA and BCP
Change Healthcare lost $2.46 billion from a single ransomware incident because its BIA failed … Read more
Cyber Risk Quantification in Financial Services: FAIR Model Applied
Cyber risk quantification in financial services has become an urgent priority. In January 2024, … Read more
CPS 234 vs NIST CSF: Cyber Risk Framework Comparison for Multinationals
The debate over CPS 234 vs NIST CSF matters most when real breaches expose … Read more
FTC Safeguards Rule Compliance: Risk and Security Requirements
FTC Safeguards Rule Compliance is a critical obligation for financial institutions, and recent enforcement … Read more