A few forward-looking themes that might get us thinking a bit differently.
If organisations take one thing away, it's this, you need time. Getting the basics right and understanding where you are buys you that time.
Quantum, Not New, but getting Real
The themes from our events in Edinburgh and the Quantum World Symposium in Paris, are now echoed clearly by the NCSC. Timelines have stepped up.
NCSC migration guidance: https://lnkd.in/dm6qmq4J Prefer audio? CyberUK Podcast on Spotify: https://lnkd.in/d-YMQQA7
At Verity Digital, we are completely aligned with the NCSC view, don't panic, but don't wait.
And don't forget the supply chain, this doesn't stop at our boundary - Start asking:
- where are we relying on third-party cryptography?
- what are our key suppliers doing about PQC?
- who handles sensitive data on our behalf?
The organisations that move fastest won't do it all themselves. They'll set expectations, ask better questions, and build PQC into contracts and assurance.
Give me a shout if you need advice on creating a PQC Bill of Materials.
UK regulation is moving and is moving quickly. Having had the humbling opportunity to feed into the new UK Cyber Resilience Bill, and its impact on industry (likely landing ~2027), the direction is clear. More board accountability, clearer expectations (including 3rd Party Supply Chain impact) and less room for assumptions.
Tip of the day: focus on managing the risk, not just passing the audit
Preparedness is the benchmark
Controls aren't enough, we need to show how we understand risk, how decisions get made, and how we respond when it matters.
Obvious statement alert now! Cyber risk isn't an IT problem, it's a business risk, but do we actually treat it that way in practice? I am not so sure to be fair.
Boards and Execs, this is the bit for you
- Drive ownership that’s challenged and understood, not just assigned to IT Security
- Ensure honest reporting
- Be relentless about response capability (rehearse, rehearse, rehearse)
- Lead a culture where people feel engaged and able to speak up
Most of it just needs someone at the top to actually care.
Not exactly headline-grabbing is it? However, it is what keeps us out of the headlines.
Yes, I do talk about this at dinner parties. No, I don't get invited back.
Stay updated with our latest posts
Discuss this topic