Latest edition
Blog · 267 analyses
Context for better decisions.
Analysis on AI, cybersecurity, regulation, governance and digital systems. With sources, practical consequences and one clear next action.
All analyses
229–240 of 267
Current knowledge, organised by topic, date and practical consequence.
The initial notification is not an early final report. DORA separates classification, initial communication, intermediate update, and closure so the authority receives essentials early and consolidated evidence later.
Read analysis
Revision 3 replaced the 2012 guide and structures incident response as a CSF 2.0 Community Profile. Govern, Identify, and Protect prepare; Detect, Respond, and Recover execute — with learning returning to risk management.
Read analysis
‘Low appetite for cyber risk’ makes no decision on its own. Leadership must decompose it into objectives, tolerances, indicators, thresholds, and authority to act before deviation becomes loss.
Read analysis
RFC 9700 makes today's baseline explicit: authorization code, PKCE for public clients, exact redirect URI matching, mix-up protection, and retirement of implicit and password grants.
Read analysis
Article 4 still requires providers and deployers to take AI-literacy measures, now without mandating a specific individual level. Supervision began in August 2026; a generic annual course does not prove that each role can operate the systems it actually uses.
Read analysis
High-risk requirements moved to December 2027 — or August 2028 where AI is embedded in certain products. The additional time should be used to test human intervention, not to add an approval button at the end of a process.
Read analysis
The clock does not wait for a perfect forensic report. Once a controller has sufficient awareness of a personal data breach, it must assess risk and, where required, notify the CNPD within 72 hours — using phased updates if facts remain incomplete.
Read analysis
Article 25 prohibits online platforms from designing interfaces that deceive, manipulate, or materially impair free and informed decisions. Portugal added its national enforcement framework in 2026, with coordination across ANACOM, ERC, and CNPD.
Read analysis
Known exploitation, exploitation probability, and technical severity are not synonyms for local risk. Remediation starts by confirming product and version, exposure, impact, controls, vendor guidance, and the ability to verify the fix.
Read analysis
A valid signature is not enough. Before promoting an artifact, verify its digest, expected identity, build origin, provenance integrity, declared components, and the policy for the target environment.
Read analysis
An Organizational Profile describes current and/or desired outcomes using CSF language. It is not a compliance questionnaire or universal grade: it connects mission, threats, requirements, and evidence to a prioritised set of decisions.
Read analysis
A missing or ineffective control does not disappear when approved. An exception needs bounded scope, risk analysis, a compensating measure, an accountable acceptor, expiry, and retesting before closure.
Read analysisHow we publish
Every analysis links the official documentation it relies on.
We translate change into decisions, owners and evidence.
We update the analysis when facts or guidance change.
We disclose generated photography and credit documentary photography.
From context to execution
We map the problem, write the scope and build the solution with acceptance criteria.
