Insights · Notes from practice
What matters,
in practice.
Occasional notes from our consulting work on standards, enforcement decisions and the choices they create for businesses.
Occasional notes from our consulting work on standards, enforcement decisions and the choices they create for businesses.
Publication is a milestone, not a deadline. Your 2015 certificate has years left to run, you cannot transition as early as you think, and the date that governs your plan is your certification body's, not ISO's.
May 2026Three decisions, read side by side. None of them turned on a clever attack, the largest penalty tracked the volume of data rather than the sophistication of the failure, and three ordinary controls address most of what was found.
Feb 2026CSA's two marks serve different organisations at different stages, and neither is chosen by headcount. How the choice actually works, the two mistakes that cost the most, and when the answer is "neither yet".
We'd rather publish little than publish filler. Entries appear when we have something worth sharing, not on a content calendar.
Ask us about the Regulatory Watch digest. A short note when something changes that affects your certification or data protection obligations. Nothing else.