All Posts

Colleagues review documents beside a laptop. A business can be based in Calgary, serve customers elsewhere and use suppliers outside Canada. Its address is a starting point for a privacy-law assessment. The information and activities matter too. This guide covers selected private-sector rules. Public-sector, health, and other sector-specific requirements need their own assessment. It is general information, not legal advice. Start with the activities and information Alberta a

A professional reviews an inventory spreadsheet at a desk beside a window Before I write an AI policy, I want a list of the AI the business actually uses. The meeting assistant in a video tool may matter just as much as a model built in-house. If it captures sensitive discussions, someone needs to own the decision to use it. An AI register brings those uses into one place. It gives the business a starting point for deciding what to assess, what to approve, and what needs clos

If you've sat through a vendor security review, an RFP response, or a board conversation about AI risk any time in the last couple of years, there's a decent chance someone said "NIST AI RMF" without explaining what it actually is. This is that explanation. The NIST AI Risk Management Framework, officially NIST AI 100-1, came out of the U.S. National Institute of Standards and Technology back in January 2023. It's voluntary. There's no certificate, no logo, and no accredited

For most organizations, AI governance starts with the tools they already use. Managing vendor-built AI means treating AI risk as a third-party risk issue—covering data use, privacy, contractual obligations, AI-specific controls, and ongoing monitoring. Most of what gets written about AI governance assumes you're the one training or fine-tuning a model. Most organizations I talk to aren't doing that at all. They're using AI features already built into tools they've already bou

The EU AI Act timeline is no longer moving as one block: Article 50 transparency obligations took effect on August 2, 2026, while certain high-risk AI requirements were pushed to December 2027, making precise deadline tracking essential for compliance planning. The EU's Digital Omnibus package has genuinely reshaped the AI Act's timeline — just not evenly, and the part that didn't move is the one I keep seeing people get wrong. Here's what actually shifted: high-risk AI syste

Preparing for an ISO 42001 internal audit means looking beyond a standard ISO 27001 checklist to evaluate AI governance, impact assessments, lifecycle controls, accountability, and continual improvement. Internal audits under ISO 42001 need to be conducted objectively and impartially, which in practice usually means bringing in someone who wasn't involved in building the AIMS and isn't the same person who'll run your external certification audit. That independence isn't a box

AI system impact assessments go beyond policy. They evaluate how an AI system is used, who it affects, the risks it creates, the controls in place, and how those risks are monitored over time. A one-page AI use policy is common. An actual impact assessment is much rarer, and it's the document ISO 42001 expects to see before a system goes anywhere near production. Here's the gap I keep running into: a use policy tells employees what they're allowed and not allowed to do with A

A practical operating model connecting privacy inventories, impact assessments, vendor oversight and accountable decisions—with enterprise-scale worked examples.

A practical breakdown of what ISO 42001 adds beyond ISO 27001 and which parts of an existing ISMS already meet AI Management System requirements. If you already hold ISO 27001, I get why the first instinct with ISO 42001 is to reuse everything: the internal audit checklist, the management review agenda, and even the risk methodology. Some of that instinct is right. The mistake is stopping there. ISO 42001 borrows the same high-level structure every recent ISO management-syste

If you've been in a vendor security review, an RFP response, or a board risk conversation about AI in the last two years, there's a decent chance someone has said the words "NIST AI RMF" without explaining what it actually is. This post is that explanation.

In many organizations, security awareness training means one long e-learning module a year and a quiz nobody takes seriously. On paper that is compliant. In practice it changes very little about how people work. The case for doing it properly is strong. Organizations that run continuous training see phishing susceptibility fall sharply over a year, and research on small and mid-sized businesses points the same way: training works when it is specific to the organization and re

Every GRC program has a risk register. Rows of risk IDs, likelihood scores, impact ratings, control references, owners, statuses. Auditors love them. In most organizations, nobody else reads them. That's a problem, because a risk register is supposed to be a communication tool. If the COO can't look at it and understand what might go wrong for the business, what you have is a tracking sheet, not a register. The usual failure is language. An entry like "R-014: Ransomware on Fi

It's been a little over three months since my last post. The silence wasn't intentional. I've simply been focused on doing the work. Over the past few months, I've been investing heavily in strengthening my cybersecurity governance, risk, and compliance capabilities—not just through study, but through practical application. On the certification front, I successfully earned the CompTIA CySA+ and ISACA CISM, while also completing training in PCI DSS v4.0. Each of these has deep

Risk management can feel overwhelming when treated as a large, one-time exercise. The Find the Risk in 60 Seconds series takes a different approach: short, focused conversations that fit into regular leadership meetings. These quick checklists, spread over six weeks, assist leaders in pinpointing the actual areas of risk concentration within their organization. Each week focuses on a different layer of business risk. Week 1: Shadow IT: The Tools You Don’t See Focus: Understan

Operational risk often accumulates quietly in everyday processes, people decisions, and system changes. Not all risk comes from dramatic external attacks. Often, it accumulates quietly in day‑to‑day activities: a rushed email to the wrong recipient, a change made under pressure without a full review, an incident that becomes more serious because roles and responsibilities are unclear, etc. Looking at how work is actually done can reveal important sources of operational risk.

Many organizations now run on a network of external providers. Payroll, customer relationship management, cloud hosting, marketing platforms, and collaboration tools—the list grows every year. Each vendor can improve efficiency and capability. At the same time, each one extends the organization’s risk surface. Why Vendor Risk Deserves Attention When an incident involves a vendor, customers and regulators usually look first at the organization that chose and relied on that ven

Ask a simple question in most organizations: “Who can see our most sensitive data?” The answer is often, “We’re not entirely sure.” Over time, access is easier to grant than to remove. People change roles, projects end, and teams restructure, but the permissions stay. That quiet accumulation becomes weak access control. Why weak access controls matter Access control can sound like a technical detail, but its impact is very practical: • Increased data leakage risk: more people

Shadow IT: The Hidden Risk Most Businesses Miss | Find the Risk You don’t need a major breach to be at risk. Often, the most dangerous tools in your environment are the ones nobody has officially approved. A team signs up for a free project-management app. Marketing connects a new email platform to your CRM. Finance uses a “temporary” spreadsheet in the cloud that quietly becomes permanent. Individually, these don’t feel like big decisions. Together, they create Shadow IT: sy

Many organizations believe they understand their third-party risk. They assess vendors, send questionnaires, and file SOC reports and ISO certificates. Then they stop. However, what many fail to govern is their third party’s third party—often called fourth-party risk. This blind spot is where some of the most damaging cyber, ethical, financial crime, and operational failures have originated. Regulators, courts, customers, and the public have been consistent on one point: Acco

The financial and operational impact of cyber incidents in 2025 is increasingly driven by governance failures rather than technical gaps. In 2025, cyber incidents became less about novel exploits and more about systemic failure. Organizations with mature toolsets continued to suffer costly breaches, regulatory penalties, and prolonged outages. The emerging pattern is consistent: responsibility is assigned, but accountability is fragmented. Security programs frequently assign