Clause 5.1 asks top management to demonstrate leadership but requires no document. Three ways to evidence it, from a signed policy to the audit interview.
Tag: #iso27001
What You Govern Is the Harness, Not the Model
Short answer Most AI governance effort goes into choosing and restricting the model. The Australian Signals Directorate’s position, published on 11 September 2026, is that the risks an organisation can genuinely control sit in the layer around the model: the software that decides what the model sees, what tools it can reach, what it is […]
Origin Says the Breach Is “Potential”. That Word Starts a 30-Day Clock.
Origin Energy said on 22 July that it is “currently investigating a potential security incident which may involve unauthorised access to some customers’ data”. It added that it does not believe the affected data includes credit card or bank details, and that it has notified the Australian Cyber Security Centre and the Australian Federal Police. […]
Your Risk Matrix Has Numbers. Who Decided What They Mean?
The short answer A residual risk score is meaningless on its own. It only says something when measured against a threshold your business agreed in advance, which is your risk appetite, and against written consequence criteria that let two different people score the same event the same way. Most organisations have a matrix and no […]
Preparing for an ISO 27001 Audit (Stage 1 and Stage 2)
ISO 27001 certification is a two-stage audit, preceded by your own internal audit and followed by annual surveillance. Here’s what each stage involves and how to prepare.
The Patch Directive Went Out the Same Day. Not Every School Applied It.
ASD alerted at 10am, the Department told every school by 4.32pm, and one unpatched school exposed student data. Why sending a directive is not a control.
One Breach, 21 GP Practices: The Multi-Site Security Scope Problem in Healthcare
A cyber attack on one head office exposed patient data from 21 GP practices at once. An ISO auditor on multi-site ISMS scope, health data under APP 11, and how a clinic network closes the gap.
Your Staff Treat AI Chats Like a Diary. Here Is Who Else Can Read Them.
Every major AI vendor scans consumer chats, and people can read the flagged ones. What that means for staff on personal accounts, and what to fix under ISO 27001 and ISO 42001.
Who Owns Your Company’s AI Account? ASD Says Attackers Are Asking the Same Question
ASD says attackers are taking over business AI accounts through leaked API keys, stolen sessions and supplier access. What to fix this month, and where it sits in ISO 27001.
What’s Your Microsoft Secure Score? (And Why It Makes a SMARTER ISO 27001 Objective)
Microsoft Secure Score is a single, measurable number for your Microsoft 365 security posture. Here is how to find it, improve it, and use it as a SMARTER ISO 27001 clause 6.2 objective.
