InfoSec Insider

In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, discuss some of the most common nonconformities they encounter when auditing organisations against the management system requirements of ISO 27001, focusing on Clauses 4, 5 and 6. Drawing upon their auditing and consultancy experience, they provide practical guidance on common mistakes and how organisations can strengthen their approach. George...

In this episode of InfoSec Insider – Talk Cyber, Wayne Armstrong, Senior Consultant at URM, and Mike Emery, Senior Security Consultant at URM, explore how organisations can build greater cyber resilience in the face of an increasingly sophisticated threat landscape. Drawing on practical experience, they examine where organisations are most vulnerable and discuss the steps businesses can take to strengthen their defences ...

In this episode of InfoSec Insider – Talk BC, Phil Knight, Senior Consultant at URM, explores the different types of business continuity exercises organisations can undertake and what makes an exercise genuinely effective. Drawing on his extensive experience supporting organisations with business continuity and resilience, Phil discusses:

• The different types of business continuity exercises, from walkthroughs and tableto...

In this episode of InfoSec Insider – Talk DP, Aimee Brown and Rachael Salter, both Consultants at URM, explore lawful basis under the General Data Protection Regulation (GDPR), why choosing the right basis is fundamental to compliant processing, and some of the common mistakes organisations make in practice. Aimee and Rachael discuss:

• Why identifying the correct lawful basis is fundamental to GDPR compliance
• Why organisa...

In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, provide practical advice on how organisations can improve cyber security training and awareness, and why tailoring training to specific roles, responsibilities and risks can help build a stronger security culture. George Ryan and Jack Woods draw upon their experience of helping organisations strengthen their information security to discuss:

In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, examine one of the most frequently misunderstood areas of PCI DSS: the difference between compensating controls and the customised approach. Drawing on their extensive PCI DSS assessment experience, they discuss:

• The key differences between compensating controls and customised approac...

InfoSec Insider Podcast - Season 3, Episode 1 (101)

Benefits of Business Continuity Exercising

In this episode of InfoSec Insider – Talk BC, Phil Knight, Senior Consultant at URM, explores exercising of business continuity plans, and the benefits this can provide to organisations.  Phil draws upon his extensive experience supporting organisations to strengthen their business continuity arrangements and resilience to disc...

In this episode of InfoSec Insider – Talk DP, Rachael Salter and Aimee Brown, both Consultants at URM, share their insights on how to effectively manage the immediate aftermath of a personal data breach.  Aimee and Racheal draw on over 20 years’ combined data protection experience to discuss: 

• What actually counts as a data breach and when it needs to be reported to the Information Commissioner’s Office ...

In this episode of InfoSec Insider – Talk Cyber, Jamie Leavers, Security Consultant at URM, and Lauren Gotting, New Business Director at URM, share real-world lessons learned from conducting hundreds of CE and CE+ assessments, including early assessments against the new Danzell requirements.   Jamie and Lauren leverage their extensive experience with the Cyber Essentials scheme to discuss:

• Lessons from real CE/CE+...

In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, provide expert advice and guidance on how organisations can maintain the physical security of their information, and where physical security most often goes wrong.  George and Jack draw upon their extensive combined experience of helping organisations strengthen their information security to discuss:

• Whether organisations are underest...

In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, share their insights on complying with periodic requirements within the Payment Card Industry Data Security Standard (PCI DSS).  Alastair and Tibor leverage nearly 30 years’ combined experience with the PCI DSS to discuss:  

• Why PCI DSS v4 moved away from fixed frequencies ...

In this episode of InfoSec Insider – Talk DP, Aimee Brown and Rachael Salter, both Consultants at URM, break down cookies compliance under the General Data Protection Regulation (GDPR) and Privacy and Electronic Communications Regulations (PECR).  Aimee and Racheal draw on over 20 years’ combined data protection experience to discuss: 

• Why cookies are so important to businesses commercially
• What the law a...

In this episode of InfoSec Insider, Neil Jones, Senior Consultant at URM, shares key advice and guidance on ISO 27001 Clause 10.2 (Nonconformity and corrective action), its requirements and how organisations can meet them.  Neil leverages over 20 years of experience working with risk and information security-related standards to discuss: 

• What Clause 10.2 is and why it is important for organisations managing problems...

In this episode of InfoSec Insider, Tibor Laczko and Alastair Stewart, both Senior Consultants and Qualified Security Assessors (QSAs) at URM, explore scoping in the Payment Card Industry Data Security Standard (PCI DSS). Alastair and Tibor leverage nearly 30 years’ combined experience with the PCI DSS to discuss:     

• When an organisation stops being ‘just a merchant’ and becomes a PCI DSS service provi...

In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, break down the key steps to establishing control over the use of artificial intelligence (AI) within organisations.  Jack and George leverage their extensive experience supporting organisations to strengthen their information security and risk management to discuss:

• Why organisations should be paying attention to AI right no...

In this episode of InfoSec Insider – Talk DP, Rachael Salter and Aimee Brown, both Consultants at URM, consider emerging trends in the field of data protection and privacy, and the practical implications for organisations that need to maintain compliance.  Aimee and Rachel leverage 20 years’ combined experience in data protection to discuss:

• What they think will define privacy risk over the next 12 months
• Why ...

In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, explore some of the most misunderstood areas of PCI DSS scoping, focusing on service providers, merchants, and complex modern payment architectures. Alastair and Tibor leverage nearly 30 years’ combined experience with the PCI DSS to discuss:

• When an organisation stops being &ld...

In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, answer some of the niche and unusual questions around governance, risk and compliance (GRC).  Jack and George leverage their extensive experience supporting organisations to strengthen their information security and risk management to discuss:  • The key questions clients rarely ask despite being extremely important • Whether a policy...

In this episode of InfoSec Insider – Talk DP, Rachael Salter and Aimee Brown, both Consultants at URM, answer key, real-world questions around data protection and how organisations can stay compliant.  Aimee and Rachel leverage 20 years’ combined experience in data protection to discuss:

• When data is genuinely anonymous, and how easy it is to lose that status
• Whether things like voice, handwriting, CCTV, emoji...