brivellisClear thinking for complex technology decisions
Practical perspectives on IT service management, cybersecurity, business resilience and governance, for teams worldwide.
BIA and RTO/RPO: the numbers IT cannot set alone
How a business impact analysis sets the MTPD, RTO and RPO, why IT cannot set them alone, and how one number should run from the BIA to the exercise report.
NIST CSF 2.0 explained: how to answer it from the ISO/IEC 27001 system you already run
NIST CSF 2.0 in plain terms: the six functions, what changed in version 2.0, and how an ISO/IEC 27001 ISMS answers it without a second control set.
ISO/IEC 27090 is out: how the new AI security standard fits with ISO/IEC 42001
ISO/IEC 27090:2026 gives guidance on AI-specific security threats. Here is how it differs from ISO/IEC 42001 and how to use the two together.
How to implement ISO/IEC 27001:2022: the seven ISMS documents to build first, in order
ISO 27001 implementation, step by step: the seven ISMS documents to build first, the order that works, and how risk, controls and evidence stay linked.
How to build a security awareness programme: a 12-month plan, step by step
Build a security awareness programme in six steps: policy, audiences, a 12-month plan, phishing simulation rules, one register and a few measures.
Security awareness that auditors accept: the evidence behind ISO/IEC 27001 and NIST CSF 2.0
Training alone does not pass an audit. The five pieces of security awareness evidence that satisfy ISO/IEC 27001 A.6.3 and NIST CSF 2.0 PR.AT.
Why technology transformations lose momentum
Five patterns that quietly separate ambition from execution—and the leadership moves that reconnect them.
Responsible AI begins with operating clarity
The essential decisions organizations need before AI pilots become scaled capability.
Resilience is an executive capability
Why recovery plans are not enough, and how leaders can make resilience part of everyday technology governance.
The Brivellis Briefing
One practical insight, one regulatory update and one free tool, every two weeks. Free, and we never ask for your email.
Follow on LinkedIn