Category Insights

An impact assessment is an ongoing process. Which changes should trigger a new DPIA, how do you build it into the change process, and who owns the decision?

When the DPO becomes the entire GDPR function, both independence and business accountability disappear. How to separate the DPO, the operational data protection function and business ownership.

DORA's first aggregated incident data: system and process failures and third-party dependencies account for most serious ICT incidents – only about 10% were cyber-related. How to build broader operational resilience.

The Swedish Cybersecurity Act is in place. The question is less about when NIS2 arrives and more about how the requirements become effective security work. Here are five common mistakes that create a lot of documentation but too little actual risk reduction.

Since 1 October 2026, new regulations on security measures and management training apply. Five areas to check now – from management responsibility and risk to continuity, suppliers and follow-up.

An incident is rarely just an incident. Incident triage helps you decide what needs to be activated, who to involve and which deadlines are already running – connecting incident, continuity, recovery, crisis and reporting.

DORA Article 45 enables – but does not require – cyber threat information sharing between financial firms. How to make it a practical approach that creates value.

Operational resilience is a management and supplier issue – not just IT. Starting from Sweden's FI 2026:1 stability report: how to move from requirement to a capability that holds.

Third-party management is more than a supplier register. How to move from a static list to working supplier governance that holds up to EBA, DORA and NIS2 – as a lifecycle.

A bigger consultancy doesn't automatically mean more competence. In information security, GRC and CISO support, senior expertise often decides – and how you assess it.