Everyone asks what ISO certification costs. The better question is what poor quality and incidents cost: 10-30% of revenue in quality failures, $4.26M average data breaches, $10M environmental penalties and a $28.6B-a-year safety problem, paid in people, reputation and dollars.
Articles
OpenAI’s Medicare Breach: What It Means for Australian Businesses Using AI Agents
OpenAI’s models reached four Australian government bodies in June, and the warning took months to arrive. What that means for your own AI incident process, from both sides.
The Patch Was Published on 6 August. Mathspace Applied It on 29 August. The Breach Was on the 10th.
On 6 August 2026 Metabase published a critical security advisory and patched versions. On 10 August an attacker was inside Mathspace’s self-hosted Metabase instance. On 27 August they downloaded a database. On 29 August Mathspace applied the patch. On 3 September, reviewing historical access logs, Mathspace worked out what had happened. 1,079,819 people in Australia […]
What Your Data Breach Response Plan Has to Prove, and the 72-Hour Clock Coming With It
Some organisations have a data breach response plan. Few can show it has ever been tested. The privacy exposure draft released on 31 August 2026 would make that gap explicit, and add a 72-hour clock to the existing 30-day one.
A Federal Inquiry Just Asked What Is Stopping You Adopting AI
The short answer Australia now has three AI processes running with dates attached. Submissions to the federal Joint Select Committee on Artificial Intelligence closed on 14 September 2026 and it held its first public hearing on 18 September. The committee reports by 30 November 2026, a South Australian royal commission began on 1 October 2026 […]
Your Supplier Lost the Data. The Notification Is Still Yours.
The Quest Apartment Hotels breach shows why outsourcing customer data does not outsource responsibility, and what ISO 27001 expects from third-party risk management.
Your Plant Risk Assessment Is a Document. Is It a Control?
There is a question I ask early in a safety audit that tells me more than an hour of reading policies: when was this machine’s risk assessment last reviewed, and what changed as a result? The first half gets an answer. The plant risk assessment exists and it is signed. The second half goes quiet, […]
Your Visitor Policy Says No Cameras. Your Visitors Are Wearing Them.
The Privacy Commissioner has put surveillance wearables on the record. Your visitor rules assume the camera is a phone, and ISO 27001 Annex A 7.6 assumes you can see it.
ISO Clause 4.3: Determining Your Scope (Inside Your Periscope, Not Boiling the Ocean)
Clause 4.3 says the organisation shall determine the boundaries and applicability of the management system to establish its scope. Read that first word again. The organisation. Not the certification body, not the auditor, not the consultant. You decide what your management system covers, and you are entitled to draw that line deliberately. That freedom comes […]
ISO 9001 Clause 8.3: Design Inputs, Outputs, Review, Verification and Validation
Clause 8.3 of ISO 9001 covers the design and development of products and services, and it works as a chain: you define the inputs (what the design has to satisfy), you control the work through review, verification and validation, and you produce outputs that can actually be used to make or deliver the thing. Get […]
- « Previous Page
- 1
- 2
- 3
- 4
- 5
- …
- 19
- Next Page »
