Organisational compliance management: when having policies is no longer enough
As organisations grow, compliance can no longer rely on isolated initiatives, fragmented decisions and improvised evidence. At this stage, compliance management can no longer depend solely on scattered documentation and begins to require an organisational compliance system capable of ensuring coherence, consistency and evidence.
⏱️ Estimated reading time: 6 minutes
Employee Readiness: why organisational maturity can no longer remain concentrated in the hands of just a few people
In more regulated, more auditable and more risk-exposed environments, it is no longer enough for critical topics to be defined. They must be understood and applied by those with execution responsibilities.
⏱️ Estimated reading time: 6 minutes
Digital compliance, privacy and cybersecurity: critical skills to respond to real priorities with sound judgement
Between GDPR, ISO 27701, NIS 2, cybersecurity and ISO/IEC 27001, organisations need less and less generic awareness and more and more applicable, structured and decision-relevant skills.
⏱️ Estimated reading time: 6 minutes
Behaviour enters 2026 with new courses designed to respond to increasingly concrete organisational demands. Amid regulatory pressure, greater operational maturity, stronger resilience requirements and growing expectations around audit and evidence, it is no longer enough to know concepts: it is necessary to understand priorities, interpret requirements and turn them into real capability.
⏱️ Estimated reading time: 4 minutes
Cybersecurity incidents affecting personal data have become a structural risk for organisations with high digital exposure. More than the incident itself, what truly differentiates mature organisations is the way they respond.
⏱️ Estimated reading time: 2 minutes
The end of the year is not just an arrival point. It is an in-between space,
often invisible, where the foundations of future decisions are built.
⏱️ Estimated reading time: 6 minutes
Information Security • Article
⏱️ Estimated reading time: 7 minutes
Information Security is no longer just technical.
Today, it requires strategic vision, decision-making ability and informed leadership.
Continuity & Resilience • Article
⏱️ Estimated reading time: 9 minutes
Hyperscaler dependencies, systemic failures and third-party concentration are changing the expectation: proving continuity and recovery capability, with evidence and testing.
Information Security • Article
⏱️ Estimated reading time: 8 minutes
In a context of growing demands, maturity is synonymous with trust.
Information Security & Compliance • Article
⏱️ Estimated reading time: 7 minutes
Implemented controls, treated risks, reported incidents and auditable logs are no longer optional.
Audit & Governance • Article
⏱️ Estimated reading time: 7 minutes
It is about understanding whether there is real control, applied practices and consistent maturity across the organisation.
Audits are critical moments: they assess whether the organisation is merely “doing the minimum” or whether it has consistent and mature practices.
Resilience & Testing • Article
⏱️ Estimated reading time: 6 minutes
Cyber Stress Tests only create value when they test real decisions, uncertainty and response capability – not when they create false certainty.
Cyber Stress Tests have become an increasing requirement in sectors such as financial services,
healthcare, digital services and critical infrastructure.
Culture & Cybersecurity • Article
⏱️ Estimated reading time: 7 minutes
True resilience starts with people — and with the culture that sustains secure day-to-day decisions.
Privacy & Compliance • Article
⏱️ Estimated reading time: 10 minutes
The 2025 edition makes ISO/IEC 27701 independent, aligned with Annex SL 2024 and focused on a standalone, certifiable PIMS.
The new edition of ISO/IEC 27701:2025 marks a historic turning point in the way organisations manage privacy.
It is no longer an extension of ISO/IEC 27001 and becomes an independent standard, with its own structure and aligned with the latest version of Annex SL, the 2024 edition.
NIS 2 & Compliance • Article
⏱️ Estimated reading time: 7 minutes
A turning point in risk management, cybersecurity and incident reporting for essential, important and critical sectors.
Frameworks & Regulations • Article
⏱️ Estimated reading time: 8 minutes
In a world saturated with standards and rules, the advantage lies in knowing how to integrate what is required with what creates real maturity.
Continuity & Resilience • Article
⏱️ Estimated reading time: 8 minutes
Technology incidents and third-party failures continue to prove that continuity is built in practice, every day.
People & Cybersecurity • Article
⏱️ Estimated reading time: 6 minutes
Technology is essential, but it is people, decisions and behaviour that determine the real effectiveness of security.
Awareness & Phishing • Article
⏱️ Estimated reading time: 9 minutes
A ready-to-use plan to engage employees, measure impact and build capabilities that last beyond October.
Below is a ready-to-use plan to engage employees, measure impact and deliver results that last beyond October.
AI & Audit • Article
⏱️ Estimated reading time: 7 minutes
But it will replace those who ignore it.
Artificial Intelligence is no longer the future; it is the present. It is transforming the way we deal with data, control, decision-making and risk. And auditing is not exempt from that revolution.
Resilience & Testing • Article
⏱️ Estimated reading time: 7 minutes
Simulate, test and demonstrate operational and cyber resilience under realistic pressure.
Continuity & Resilience • Article
⏱️ Estimated reading time: 6 minutes
Real continuity is measured when the right people are not there and the organisation still manages to respond.
In most continuity or recovery plans, there is a silent but critical error: it is assumed that the right people will be available at the right time.
Artificial Intelligence & Regulation • Article
⏱️ Estimated reading time: 6 minutes
And qualified professionals are becoming a central part of the new digital economy.
In a context of accelerated growth in global cybersecurity investment, expected to reach 213 billion dollars in 2025, according to IDC forecasts, the European Union is consolidating its regulatory framework to ensure that Artificial Intelligence evolves with security, responsibility and transparency.
The new AI Act (Regulation 2024/1689) places Europe at the forefront of ethical AI governance and establishes concrete obligations for public and private organisations across the entire value chain.
This scenario creates a new urgency: the need for qualified professionals who understand not only the potential of AI, but also its legal, operational and ethical implications.
The AI Act is the European Union’s first horizontal regulation on Artificial Intelligence.
Its main objectives include:
The AI Act enters into force in phases, but companies need to start preparing now.
As the world invests increasingly in cybersecurity, cloud and intelligent automation, Europe is taking a decisive step by requiring AI solutions to be auditable, explainable and aligned with democratic values.
Organisations will need:
Behaviour is a pioneer in Portugal in creating a structured training programme in Artificial Intelligence based on international standards and European legislation.
All courses are practical, professionally oriented and updated with the AI Act, ISO/IEC 42001 and the principles of responsible AI governance.
Artificial Intelligence is already present in organisations.
Now it must also be in the hands of those who know how to govern, implement and audit it responsibly.
With Behaviour, professionals prepare themselves with technical knowledge, strategic vision and direct alignment with the European Union’s requirements. Because the future of AI is not only a matter of innovation, it is a matter of trust.
Author: Behaviour
Published on: 20 August 2025
Copying or reproduction of this article is not authorised.
Information Security • Article
⏱️ Estimated reading time: 7 minutes
Far more than training, it is real preparation for those who want to lead in information security.
The ISO/IEC 27001:2022 standard is now the global reference for those who want to protect assets, manage risks and build trust in information systems. But learning the standard is not enough. It is necessary to know how to apply it, audit it and update it, and to do so with method, confidence and results.
At Behaviour, we believe that training only makes sense if it turns knowledge into practice.
That is why every ISO/IEC 27001 course we offer goes beyond theory and prepares participants to act in the real world.
Ideal for those who want to understand the principles of the standard, even without previous experience.
Recommended for technical teams, operational staff or decision-makers who need to master the foundations clearly and in an applied way.
Training aimed at those who already know the previous versions and/or hold a Behaviour certification in the 2013 edition
and need to adapt the ISMS to the requirements of the new edition or transition their Lead Implementer or Lead Auditor certification to the new edition.
Ideal for consultants, auditors, security managers or compliance officers with active systems.
Advanced and certified training for those who want to audit with excellence, lead teams and contribute to the continuous improvement of the ISMS.
Recommended for professionals with or without experience who want to prepare for and/or act as lead auditors with technical command and strategic vision.
A complete course for those who want to implement and maintain an Information Security Management System (ISMS)
in conformity with ISO/IEC 27001:2022.
Suitable for those who hold or intend to hold responsibility for leading ISMS implementation: technicians, managers, consultants, CISOs or compliance leads.
All Behaviour ISO courses follow a 100% practical and applied approach:
Learners leave with documents and templates ready to adapt, useful for internal audits or real consultancy projects.
The standard is here. The risks are too. What changes is the quality of your preparation. At Behaviour, courses do not exist only to teach; they exist to ensure people know how to do.
Behaviour-certified professionals are subject to a demanding assessment process, including a challenging evaluation exam and a rigorous scrutiny of their professional experience and capabilities (for applicable certifications under ISO/IEC 17024 requirements).
With Behaviour, you do not just take away a certificate. You take away real capability, documents ready to apply, the confidence of someone who knows what they are doing, and a certification that validates competence, not only knowledge.
Author: Behaviour
Published on: 18 August 2025
Copying or reproduction of this article is not authorised.
Risk Management • Article
⏱️ Estimated reading time: 6 minutes
Intensive and immersive training for those who want to lead risk decisions in information systems.
The CRISC certification is now an international benchmark for professionals who manage risk in information systems
and who play an active role in strategic governance and control decisions.
At Behaviour, preparation for the CRISC exam goes beyond the content.
With Behaviour, you will master the four CRISC domains with confidence, structure and real-world application.
Throughout Behaviour’s CRISC course, you will explore in depth the four major domains of the certification programme:
1. Enterprise Risk Governance
– Integration of risk into strategy, organisational culture and decision-making.
2. IT Risk Assessment
– Identification, analysis and evaluation of risks related to information systems.
3. Risk Response and Mitigation
– Planning and implementation of effective responses aligned with business objectives.
4. Risk and Control Monitoring and Reporting
– Ongoing oversight, effectiveness metrics and communication with stakeholders.
All topics are covered through real examples, simulation exercises for exam preparation, visual support maps and mock exams.
The course is intensive, with an optimised workload to accelerate preparation without losing depth.
It includes moments of individual assessment, question-and-answer sessions
and access to post-course support, should you need to reinforce your preparation before the exam.
With Behaviour, you gain more than exam preparation — you gain the confidence to act with assurance.
You gain structure, clarity and the ability to make decisions that truly protect the business.
Secure your place now and prepare with those who take certification seriously.
Author: Behaviour
Published on: 13 August 2025
Copying or reproduction of this article is not authorised.
Security & Continuity • Article
⏱️ Estimated reading time: 7 minutes
Practical preparation to protect information security, business continuity and organisational resilience during the holiday period.
Minimum access. Limited time. Everything traceable.
Continuity is not only presence — it is preparation and response.
Stay extra alert. Apply cyber hygiene. Always report.
A plan that does not work during the holiday period… is not a plan.
Today’s convenience may become tomorrow’s incident.
Smart automation protects even when you switch off.
A larger digital footprint means more opportunity for social engineering attacks.
Post-holiday period = mandatory check-up.
Start with confidence. Without technical doubts.
Behaviour helps teams anticipate risks, respond to incidents and strengthen continuity before, during and after the holiday period.
Recommended courses:
Preparation is protection. Even when everyone else is switching off. Security does not take holidays. But with the right planning, you can.
Author: Behaviour
Published on: 4 August 2025
Copying or reproduction of this article is not authorised.
Information Security • Article
⏱️ Estimated reading time: 7 minutes
Implement, adapt and demonstrate value to the business through ISO/IEC 27001.
That is exactly why the Behaviour ISO 27001 Lead Implementer course exists: an immersive, demanding training programme focused on real results.
Far more than simply complying with the standard, you will learn how to implement and adapt a holistic model for information security management capable of responding, proportionately, to an organisation’s needs, balancing risk exposure and the selection of controls at an optimal cost.
From the need for agile business strategies in an increasingly competitive global market, to the new challenges of the current geopolitical context, the new and demanding legal and regulatory requirements, and the new normal of emerging technologies and the uncertainty of new related risks.
Investing in information security is investing in the business itself; it is investing in the capability of teams. It means being able to defend, justify and demonstrate to the business the value of every investment and every decision.
Being able to demonstrate to the business the benefits of its investment, while optimising risk and the use of resources, is what it means to deliver value through the implementation and operation of ISO/IEC 27001.
In this Behaviour course, you will not only learn how to implement; you will prepare yourself to respond to the greatest challenge in information security: learning how to deliver value to the business through ISO/IEC 27001.
With Behaviour, you go far beyond theory.
You will understand why each clause exists,
how it connects to real risks,
and how it can (or should) be applied to the specific reality of each organisation.
All of this takes place in a learning environment led by trainers with practical experience and focused on the real transfer of knowledge, and acquired practice, to leadership in implementation projects.
Leading the implementation of ISO/IEC 27001 is a serious responsibility and a clear competitive advantage.
If you want to prepare yourself with rigour, support and a methodology that takes you further, this is the right training for you.
At Behaviour, we create courses that do not simply train technicians. They develop professionals with vision, ethics, critical thinking and leadership. This training is delivered in Portuguese or English.
Author: Behaviour
Published on: 29 July 2025
Copying or reproduction of this article is not authorised.
Cybersecurity & Leadership • Article
⏱️ Estimated reading time: 6 minutes
A benchmark training course for those who want to go beyond the exam and transform the way they work in information security.
The Behaviour CISSP course was designed to prepare demanding professionals for the most complex cybersecurity challenges. With Behaviour, you go far beyond mechanical memorisation.
You will build a solid understanding of the critical concepts in each domain, understanding why each principle matters, how it applies, and why it has to be done that way and not another. This is conscious learning, focused on clarity, logic and practical application, and not merely on the need to succeed in the exam.
Here, each domain is addressed with depth and practical meaning. You will understand the critical concepts, know how to apply them to real contexts and develop the perspective needed to lead security projects with authority.
This is not training designed just to fill a schedule. It is a complete learning experience, rigorous, engaging and focused on concrete results.
If you are ready to take information security to a new level, this is the right training.
Author: Behaviour
Published on 23 July 2025
Copying or reproduction of this article is not authorised.
Business Continuity • Article
⏱️ Estimated reading time: 9 minutes
How to structure a robust BCP to respond to disruptive events, protect assets and ensure organisational resilience.
The first step in developing a BCP is to carry out a Business Impact Analysis (BIA). This involves identifying critical business processes, assessing the potential impact of a disruption on those processes and prioritising their recovery.
A BIA helps organisations understand the potential consequences of a disruption, including financial losses, reputational damage and loss of customer trust.
As part of the BIA process, the organisation will identify business continuity objectives, which support the definition of the goals and objectives of the BCP, including recovery time objectives (RTOs) and recovery point objectives (RPOs).
RTOs define the maximum time required to recover critical business processes or functions, while RPOs define the maximum amount of data that can be lost during a disruption.
These objectives will be important so that, at a later stage, it becomes possible to select and establish the business continuity and disaster recovery strategies that will be included in the BCP.
Risk assessment is a critical component in establishing a BCP, as it helps organisations identify potential risks that may disrupt business activities, impacting critical processes, resources and other interdependencies, such as, for example, an information technology supplier that forms part of the supply chain.
This includes identifying potential natural disasters, cyberattacks, failures or breakdowns in critical infrastructure and other types of disruptive events that may affect the organisation. A risk assessment will also help organisations prioritise the development of mitigation strategies and contingency plans, making it possible to reduce the likelihood of disruptive events and prepare the capabilities required for a rapid response and the consequent reduction of impacts.
3.1 Business Continuity Strategy
The business continuity strategy describes the organisation’s approach to maintaining business operations in the event of disruptions. This includes identifying alternative processes, procedures and resources that may be used to maintain business continuity. Business continuity strategy(ies) help organisations develop a plan to respond to disruptive events, minimising downtime and ensuring the continuity of critical business processes.
3.2 Recovery Strategy
Although ensuring business continuity is fundamental, it is also necessary and relevant to consider how to recover critical business functions. The organisation should define a recovery strategy in order to set out the steps required to restore critical business functions to the new “business-as-usual”.
Such strategy(ies) may involve the activation of recovery teams, coordination with previously identified external parties, contact with insurers, the recovery of systems and data from backups, and other actions required to ensure a return to the “new normal”.
The Business Continuity Operational Plan (BCOP) ensures the continuity of the operations of each business area in the event of a disruption or crisis, minimising the impact on customers, employees and other stakeholders. This plan describes the procedures and protocols to be followed in the event of a disruptive incident, ensuring the rapid recovery of operations and the preservation of the organisation’s reputation.
An emergency management plan sets out the procedures for responding to scenarios that represent an immediate threat to life, property or the environment. Its main focus is to ensure people’s safety and minimise damage to property and the environment.
The recovery plan sets out the steps required to restore the normal state of the organisation’s operations after a disruptive event, minimising downtime and ensuring the continuity of critical business processes.
7.1 Crisis Management Plan
The crisis management plan sets out the procedures for managing scenarios that may significantly damage an organisation’s reputation, finances or operations.
7.2 Crisis Management Team (CMT)
The crisis management team coordinates, responds to and manages disruptive events, involving representatives from several areas of the organisation, with clearly defined roles and responsibilities.
Training and awareness ensure that all team members understand the BCP, their roles and responsibilities, reinforcing the importance of business continuity.
Testing and exercising the BCP makes it possible to validate its effectiveness, identify gaps and prepare teams to respond with confidence.
The BCP should be reviewed and updated regularly, ensuring that it remains effective and aligned with the reality of the organisation and its risk context.
11.1 IT Disaster Recovery Plan (IT DRP)
Defines procedures for restoring IT systems and data in the event of a disaster, minimising downtime and data loss.
11.2 Communication Plan
Ensures clear, timely and transparent communication with employees, customers, suppliers and other stakeholders during a disruption.
11.3 Supply Chain Continuity Plan
Defines measures to ensure supply chain continuity in crisis scenarios.
11.4 Human Resources Plan
Focuses on the safety, wellbeing and management of employees during and after a disruptive event.
11.5 Financial Plan
Defines procedures to ensure the continuity of financial operations in crisis scenarios.
To ensure the continuity of business operations in the event of a disruption, it is essential to establish a comprehensive Business Continuity Plan (BCP). A well-designed BCP strengthens resilience, reduces the impact of unexpected events and increases stakeholder confidence.
Behaviour offers a catalogue of training and certification dedicated to the area of Best Practices, Methodologies and Management Systems.
Explore the Training Catalogue and the courses in the Business Continuity Area.
Author: Behaviour
Published on: 6 December 2024
Copying or reproduction of this article is not authorised.
Business Continuity • Article
⏱️ Estimated reading time: 9 minutes
Best practices and practical tips to prepare the organisation for disruptive events and recover effectively.
Business continuity means ensuring that your organisation can continue to operate effectively even when faced with unexpected disruptive events. It is about having a plan in place to minimise downtime, protect your reputation and return business operations to normal as quickly as possible. In today’s digital era, the risks are higher than ever. A single hour of downtime can result in significant financial losses, damage to your brand and loss of customer trust.
Disruptions can take many forms, from natural disasters such as hurricanes and earthquakes to cyberattacks or supply chain failures. The consequences can be devastating, including:
How can you build a system that can withstand and recover from disruptive events? Below are some practical tips:
In practice, what are robust systems? Below are some examples of real cases:
Unfortunately, Delta Air Lines, and many other companies around the world, were not prepared for an “unthinkable” and “unlikely” scenario and were unable to adapt and respond quickly to the most recent disruptive IT event at the beginning of 2024, caused by the CrowdStrike update.
According to the avweb.com website,
“Delta Air Lines CEO Ed Bastian criticised cybersecurity company CrowdStrike and software provider Microsoft, reporting that the IT disruption cost the airline US$ 500 million.
Delta’s massive computer disruption on 19 July interrupted the airline’s crew tracking system for almost a week, preventing the company from locating pilots and flight attendants to operate flights. As a result, Delta had to cancel around 30% of its flights. (…)
Bastian said Delta’s recovery was significantly hindered due to its high dependence on CrowdStrike and Microsoft for cybersecurity. The company had to manually reinstall 40,000 servers to restore operations.”
Conclusion
Building robust systems that can withstand and recover from disruptions is essential to the success of any business. By developing a business continuity plan, identifying critical systems, implementing redundancies, carrying out regular testing and staying informed, it is possible to minimise the impact of disruptions and ensure that your business continues to operate effectively. Remember that business continuity is not just about avoiding downtime; it is about protecting your reputation, minimising financial losses and ensuring that your customers continue to trust you.
In addition, business continuity helps to create a culture of resilience so that the organisation is prepared to respond to the most “unthinkable and unpredictable” scenarios. In this way, the company can adapt and respond quickly to such situations, minimising the impact on the business.
Behaviour offers a training and certification catalogue dedicated to the area of Best Practices, Methodologies and Management Systems. Explore the Training Catalogue and the courses in the Business Continuity Area.
Author: Behaviour
Published on: 6 December 2024
Copying or reproducing this article is not authorised.
Disclaimer: this article is based on public external research gathered from various sources. The information provided is for reference purposes only, and users assume full responsibility for relying on it. BEHAVIOUR accepts no responsibility for the accuracy of this information or for any consequences arising from its use.
Information Security • Article
⏱️ Estimated reading time: 8 minutes
Key capabilities that all Information Security professionals should develop in order to lead effectively.
Information Security professionals who aspire to become effective managers must possess a diverse set of skills and knowledge. If that is your goal, here are the 10 essential areas that can help you stand out in management roles:
1. Strategic Vision
Information Security managers must develop a strong strategic vision for their organisation’s security posture. This involves understanding the company’s overall business objectives and aligning security initiatives with those objectives. A successful Information Security manager knows how to anticipate new and emerging threats and design proactive strategies to address them.
2. Risk Management
Mastering risk management is crucial for Information Security managers, as they need to identify and analyse risks, determine whether the level of risk falls within the organisation’s acceptance criteria, and support the planning and implementation of controls. This capability makes it possible to better understand and respond to the organisation’s security needs in alignment with business objectives, transforming potential risk scenarios into opportunities for the business.
3. Communication Skills
Effective communication is essential for Information Security managers, who must be able to communicate technical concepts in a simplified way to non-technical stakeholders, including executives and board members. By building strong relationships across departments, they ensure that information security is integrated into the organisation’s processes.
4. Technical Knowledge
Although Information Security managers do not need to be experts in every technical aspect, they should have a solid understanding of core ICT technologies and emerging concepts. This knowledge enables them to make informed decisions, lead teams effectively and assess security measures reliably.
5. Adaptability
The cybersecurity landscape is constantly evolving, requiring Information Security managers to have the ability and flexibility to adapt to change. They must therefore keep up to date with the latest threats, best practices and advanced technologies, adjusting their strategies to current business needs.
6. Leadership and Team Building
Information Security managers must be able to motivate their teams, which involves setting expectations, providing support and guidance, and fostering a culture of information security awareness. Effective leaders also focus on talent development, aligning human capital with the organisation’s strategic objectives, promoting competitiveness, innovation and long-term sustainable success.
7. Compliance Knowledge
Having up-to-date knowledge of compliance matters is essential for Information Security managers, who must be familiar with relevant legislation, directives, standards and frameworks, such as NIS 2, DORA, GDPR, PCI, ISO/IEC 27001 and ISO/IEC 27701. This knowledge makes it possible to ensure the implementation of the necessary measures and compliance with applicable legal and regulatory obligations.
8. Incident Response and Crisis Management
Information Security managers must be prepared to manage incidents and crises effectively. This involves developing and implementing incident response plans, coordinating efforts with multiple stakeholders, and defining clear criteria for activating responses in crisis scenarios.
9. Continuous Learning
The field of information security is constantly evolving. This reality requires managers to adopt a mindset of continuous learning, keeping up to date, taking part in training, webinars and conferences, and encouraging their teams to do the same.
10. Ethical Conduct
Finally, Information Security managers must adhere to codes of conduct and adopt ethical behaviours in the performance of their roles. This includes protecting the privacy and confidentiality of sensitive data, reporting security breaches when necessary, and maintaining integrity in all professional relationships.
By mastering these 10 areas, as an Information Security professional, you can significantly improve your management effectiveness and lead your organisation towards a more resilient and secure future.
Behaviour offers a training and certification catalogue dedicated to the area of Best Practices, Methodologies and Management Systems.
Explore the Training Catalogue
and the courses in the Information Security Area.
Author: Behaviour
Published on: 29 November 2024
Copying or reproducing this article is not authorised.
Information Security • Article
⏱️ Estimated reading time: 9 minutes
Evolving threats, regulation, resources, cloud, third parties and operational resilience in a demanding digital landscape.
Resource Constraints
Despite the growing threats, many CISOs manage their organisations’ security strategy with limited resources, making it difficult to implement the security measures required in the current and constantly evolving context. This limitation, often financial in nature, is further aggravated by the shortage of qualified cybersecurity professionals.
Regulatory Compliance
The obligation to remain compliant with increasingly complex legislation, including the publication of new laws, regulations and directives, increases the challenge for CISOs, who currently face an avalanche of obligations, including the new NIS 2 Directive and the European Union’s Digital Operational Resilience Act (DORA). Ensuring compliance while maintaining operational efficiency is therefore a delicate balancing act that consumes significant time and resources.
Cloud Security and Digital Transformation
Organisations continue to adopt cloud services and undergo digital transformation, creating new challenges in ensuring the protection of data and other assets across diverse environments.
Managing security across multi-cloud and hybrid infrastructures requires new skills and advanced tools, often placing additional pressure on already scarce resources.
Third-Party and Supply Chain Risk
The growing dependence on third parties, including suppliers and partners, together with increasingly complex supply chains, increases the attack surface and adds further vulnerabilities.
CISOs must assess the security risks arising from third parties, establish the necessary outsourcing requirements and ensure security measures aligned with the security policies defined by their organisation. This need arises from the fact that the organisation does not have full visibility over, nor control of, the security practices of those third parties. This challenge increases with the growing use of open-source software, the current cyber geopolitical landscape, and the complexity and interdependencies of these parties’ supply chains, with particular relevance for suppliers and critical infrastructure entities.
Emerging Technologies
The rapid adoption of emerging technologies, particularly artificial intelligence and machine learning, presents both opportunities and challenges for security leaders.
While these technologies offer powerful tools for threat detection and response, they also introduce new risks and vulnerabilities that must be managed.
CISOs must balance the potential benefits of these technologies with the associated security implications, adopting the implementation of good practices that make it possible to mitigate threats quickly and efficiently across multiple complex systems.
Communication with the Board and Risk Management
CISOs are increasingly expected to communicate complex security concepts and risk assessments to board members and executives.
Translating and simplifying technical subjects into business-relevant topics, and demonstrating the return on security investment (ROSI), continues to be a significant challenge. CISOs must therefore develop communication skills so that they are able to convey, effectively and clearly, the importance of cybersecurity initiatives, secure the necessary resources, and demonstrate the benefits to the business.
Insider Threats and Security Culture
Building a strong security culture within organisations is a daily challenge for CISOs.
Human error continues to be one of the main causes of security incidents, making it crucial to include, in the annual training plan, participation in training programmes that equip employees with the skills required to use secure practices within the organisation. Employee capability-building helps mitigate risks, reduce incidents, improve the experience of using resources and increase productivity.
Operational Resilience
Given the increase in cyber threats and potential disruptions to business operations, CISOs are responsible for ensuring the improvement of their organisations’ operational resilience. This involves developing appropriate incident response plans, implementing robust backup systems, and ensuring business continuity, information systems recovery and crisis management measures and plans in the event of cyberattacks.
Adapting to Remote Work
The shift to remote and hybrid working models has expanded the attack surface and introduced new security challenges.
CISOs must adapt their security strategies to protect a distributed workforce, ensure the security of home networks and manage the risks associated with personal devices accessing corporate resources.
In conclusion, Information Security Managers and CISOs, as security leaders, face a complex and dynamic set of challenges in today’s digital landscape.
Success in these roles requires a combination of technical knowledge, strategic thinking and strong leadership skills, while remaining informed and up to date on emerging threats, fostering a security-aware culture and leveraging innovative technologies. In this way, it becomes easier for security leaders to respond to these challenges and build resilient organisations capable of withstanding evolving cyber threats.
Behaviour offers a training and certification catalogue dedicated to the area of Best Practices, Methodologies and Management Systems. Explore the Training Catalogue and the courses in the Information Security Area.
Author: Behaviour
Published on: 29 November 2024
Copying or reproducing this article is not authorised.