https://azbers.com/articles/ Writing on compliance, security operations and resilient infrastructure from Azbers Innovations. en https://azbers.com/articles/article.html?a=does-ai-belong-in-compliance https://azbers.com/articles/article.html?a=does-ai-belong-in-compliance The honest answer is that it belongs in the reading and nowhere near the deciding. Here is where we draw that line and why we draw it there. AI 2026-09-16 https://azbers.com/articles/article.html?a=iso-27001-or-nist-csf https://azbers.com/articles/article.html?a=iso-27001-or-nist-csf They are not competing standards and you are not really choosing between them. One is a certifiable management system, the other is a way of describing where you stand. Here is how to tell which you need first. Frameworks 2026-09-15 https://azbers.com/articles/article.html?a=what-is-continuous-compliance https://azbers.com/articles/article.html?a=what-is-continuous-compliance The phrase is used to sell dashboards. What it really describes is a change in when evidence is produced, and that change is the only part that matters. Compliance 2026-09-12 https://azbers.com/articles/article.html?a=the-access-review-nobody-reads https://azbers.com/articles/article.html?a=the-access-review-nobody-reads Quarterly access reviews are one of the most widely performed controls in security, and one of the least effective. The reason is not laziness. It is how we ask the question. Identity 2026-09-10 https://azbers.com/articles/article.html?a=compliance-after-the-audit https://azbers.com/articles/article.html?a=compliance-after-the-audit The assessment is almost never where a compliance programme fails. It fails quietly afterwards, in the gap between an action being agreed and anyone being able to prove it was done. Compliance 2026-09-08 https://azbers.com/articles/article.html?a=answering-security-questionnaires https://azbers.com/articles/article.html?a=answering-security-questionnaires Two hundred rows arrive from a customer, due Friday, and the person who knows the answers is on leave. There is a way to make this a two hour job instead, and it starts long before the questionnaire arrives. Compliance 2026-09-05 https://azbers.com/articles/article.html?a=patching-what-is-actually-being-exploited https://azbers.com/articles/article.html?a=patching-what-is-actually-being-exploited A CVSS score describes how bad a vulnerability could be in theory. It says nothing about whether anyone is using it against you. There are better signals, and they are free. Vulnerability 2026-09-02 https://azbers.com/articles/article.html?a=shadow-ai-at-work https://azbers.com/articles/article.html?a=shadow-ai-at-work Your staff are pasting company information into AI tools today. A ban will not stop it, it will only stop you seeing it. Here is the position that actually works. AI 2026-08-30 https://azbers.com/articles/article.html?a=what-a-regulator-actually-wants-to-see https://azbers.com/articles/article.html?a=what-a-regulator-actually-wants-to-see Most teams prepare for the wrong conversation. A regulator is not testing whether you are perfect. They are testing whether you know where you stand and can show your working. Compliance 2026-08-27 https://azbers.com/articles/article.html?a=how-to-run-a-tabletop-exercise https://azbers.com/articles/article.html?a=how-to-run-a-tabletop-exercise Most tabletops are a meeting where everyone agrees the plan is good. A useful one finds the three decisions nobody can make, in ninety minutes, without anybody being embarrassed. Incident Response 2026-08-22 https://azbers.com/articles/article.html?a=infrastructure-fails-in-chains https://azbers.com/articles/article.html?a=infrastructure-fails-in-chains Every organisation in a dependency chain can be individually compliant while the chain as a whole is assured by nobody. That gap is where national scale outages actually come from. Resilience 2026-08-19 https://azbers.com/articles/article.html?a=the-incident-you-will-actually-have https://azbers.com/articles/article.html?a=the-incident-you-will-actually-have Most incident plans are written for a dramatic breach. The one that arrives is usually smaller, slower and more confusing, and it tests things the plan never mentions. Incident Response 2026-08-12 https://azbers.com/articles/article.html?a=mfa-is-not-the-finish-line https://azbers.com/articles/article.html?a=mfa-is-not-the-finish-line Multi factor authentication stopped being a complete answer some time ago. Attackers adapted, and most organisations have not. What still works, and what to fix first. Identity 2026-08-06 https://azbers.com/articles/article.html?a=ransomware-readiness-questions https://azbers.com/articles/article.html?a=ransomware-readiness-questions Not a product list. Twelve questions that take an afternoon to work through, and whose answers decide almost everything about how the bad week goes. Resilience 2026-07-30 https://azbers.com/articles/article.html?a=one-control-many-frameworks https://azbers.com/articles/article.html?a=one-control-many-frameworks Multi framework compliance multiplies paperwork rather than security. The control never changed between regimes, and treating that overlap as real is the difference between a manageable year and an impossible one. Frameworks 2026-07-24 https://azbers.com/articles/article.html?a=qatar-nia-compliance-where-to-start https://azbers.com/articles/article.html?a=qatar-nia-compliance-where-to-start Most teams open the control list first. The framework does not expect that, and beginning there is why programmes stall six months in. The right order costs less and finishes sooner. Compliance 2026-07-15