Advisory notes. Standards updates. Audit playbooks.
Short, regulator-grade notes — no clickbait, no listicles. Written for CISOs, internal auditors, and heads of compliance who need a working read on a control, a framework change, or a regulator's expectation.
This month's note.
The most recent piece is up top — the rest are indexed below.
ISO 27001:2022 — what the Annex A control merges actually changed.
The 114→93 control consolidation has produced a wave of misreads. A short note on what merged into what, where the new themes (organisational, people, physical, technological) actually move the auditor's needle, and where the surveillance audits are catching teams out.
Runal R. Bawaskar Reading time
~ 9 min
All notes.
Filtered chronologically. Tags indicate topic and audience.
How to fail a Stage 2 audit on purpose.
The five most common Stage 2 non-conformities — and the policy-level reasons they keep recurring.
Regulator briefIRDAI Cyber Security audit — what's new in 2026.
Recent IRDAI inspection observations and the controls insurers are being asked to evidence.
VAPT governanceSLA on closure, not discovery.
Why VAPT programs that measure discovery rate without closure SLA produce growing backlogs.
Risk registerA risk register that the audit committee actually reads.
Two formatting choices that move the risk register from a 200-row spreadsheet to a board-grade document.
PCI DSS v4Customised approach — when it's worth it.
PCI DSS v4 customised-approach option is now in force. A short take on when to use it and when not to.
BCMSTabletop exercises that don't waste anyone's time.
Three design choices that determine whether a BCMS tabletop produces a real after-action report or a wallpaper one.
Vendor riskThird-party security questionnaires — the inversion problem.
Why most vendor questionnaires inadvertently measure the vendor's documentation department, not their security program.
AwarenessSmishing and vishing — the missing simulation.
Most security awareness programs simulate phishing only. What changes when you add the other two channels.