Risk Crew Blog

Your source of expert insights on risk management, compliance and security.

Maximising Security and Efficiency with CISO-as-a-Service

Many organisations are turning to implementing a CISO-as-a-Service option. The service is not only efficient, [...]

Unlocking the Potential: Exploring the Benefits of a vCISO

There is no doubt that the number of qualified and available cyber security experts is [...]

Hiring a Virtual CISO Verses a Full Time CISO Comparison

Most of us are aware that there is a huge gap of qualified cyber security [...]

Data Protection and Privacy

PPI Principals of GDPR for Small Businesses: Navigating Data Protection

“So, all we have to do to implement these 11 chapters containing 91 articles in [...]

3 Triggers for Conducting a DPIA

Here’s a funny thing – recital 84 of the EU’s GDPR legislation states “…where processing [...]

Personal Data Deletion Done the Right Way

Are you managing personal data deletion correctly under the DPA and GDPR? Does everyone in [...]

Data Protection Officer Questions – Answered by a DPO

There are many questions about why a Data Protection Officer (DPO) is needed and what [...]

Data Protection by Design and Default Explained

Previously known as ‘privacy by design’, “data protection by design and default” has always been [...]

When Must You Complete a Data Protection Impact Assessment?

Data protection impact assessments (DPIAs) are a legal requirement for GDPR, to ensure people’s private [...]

Supply Chain Risk Management

MOVEit Attack – Security Tool Vendors Have Failed Us… AGAIN!

2023 MOVEit Cyber Attack to Affect the Masses Yet again, here’s a prime example of [...]

Cyber Security Supply Chain Challenges in the Agrifood Sector

Guest Contributor: Benjamin Turner, Former Chief Operating Officer, Agrimetrics Shortly after Russia’s invasion of Ukraine, [...]

Supply Chain Cyber Attacks & How to Prevent Them

“There has been a 742% average annual increase in software supply chain attacks over the [...]

Cyber Supply Chain Risk Management – Should Penetration Testing be Required?

Let us begin by describing how to approach Cyber Supply Chain Risk Management (C-SCRM) and [...]

Get WFH Cyber Security at the Forefront of Staff’s Minds

Is your staff is staying resilient with protecting company information assets whilst Working from Home? [...]

What’s a Mature Security Awareness Programme?

Good news. Bad news. The bad news is that cyber security threats to businesses are [...]

Malware and Ransomware

How a Ransomware Readiness Assessment Can Help Your Business Stay Safe

Ransomware is a type of malware that encrypts files and then seeks payment in exchange [...]

What is Ransomware? Four Examples You Should Know About

By now we all know the effect a Ransomware attack can have on an organisation. [...]

How to Outsmart the DarkSide Ransomware Group

The DarkSide Ransomware Group is one of the many gangs that continue to rebrand themselves [...]

Protecting Your Organisation After a Ransomware Attack

So, here is the scenario: you’re sitting at your desk working away and suddenly realise [...]

Information and Cyber Security

How Do You Conduct an Information Security Risk Assessment?

Information security risk assessments are crucial for any businesses that deal with any sensitive information [...]

SaaS Security 101: Essential Strategies for Businesses

Software companies have naturally embraced the cloud. It provides countless benefits for their clients, ranging [...]

As a nation, are we cyber security aware?

In the following blog post, we are going to shine a spotlight on the general [...]

How to Submit a Data Breach Breach Compensation Claim

What is a Data Breach Claim? “Someone stole my personal information and I want something [...]

How to Respond When Data Breaches Hit the Fan

Not many companies anticipate being the focal point of a significant data breach incident. However, [...]

How to Implement a Clear Desk & Clear Screen Policy for Your Organisation

You know that feeling when you walk into an office, and it looks like a [...]

ISO 27001 Clauses 4-10: A Complete Guide

ISO/IEC 27001  is an international standard for creating an information security management system (ISMS). It [...]

How to Prepare for an ISO 27001 Audit

In the world of information security, there are many frameworks and countless guidelines. But among [...]

ISO 27001: Steps to Write a Statement of Applicability

ISO 27001 Statement of Applicability A central component of becoming compliant with ISO 27001 is [...]

How Agrimetrics Successfully Attained ISO 27001 Certification | CASE STUDY

About the Company Agrimetrics, founded in 2014, is a leading Agri-tech Centre dedicated to revolutionising [...]

ISO 27001 Penetration Testing Requirements – Risk Crew

A common question that comes up when implementing ISO 27001 is: Should I include security [...]

ISO 27001 Information Security Tips to Jump the Hurdles of Compliance

When looking to embark on achieving ISO 27001 Compliance, every organisation should know what challenges [...]

ISO 27001:2022 Update – What You Need to Know

The revised version of ISO 27001 finally landed on 25 October 2022. It’s been almost [...]

Ideation to Execution: Building Your AI Governance Framework

AI governance is the foundation of responsible AI usage. It’s a framework of policies, practices [...]

Get Ahead of the UK AI Regulation: Comply and Thrive

As artificial intelligence continues to reshape the way we all work and how enterprises operate, [...]

AI Governance – Secure the Future by Embracing Responsible AI Practices

AI in Simple Terms  At its core, AI is simply software that can ‘think’, ‘learn’, [...]

Don’t Be Afraid of AI. Treat It Like an Insider Threat

If artificial intelligence wants to be human so badly, let’s start treating it like one. [...]

Are You Getting Ready for a SOC 2 Audit? 5 Steps to Follow

Thinking About Getting Your Cloud Platform SOC 2 Compliant? If your company handles sensitive data, [...]

Why Are SOC 2 Assessments Becoming More Popular in the UK and Europe?

This is a guest article written by Ty Brush. The author’s views are entirely his [...]

12 Critical Policies for SOC 2 Compliance

If you are considering getting your organisation SOC 2 compliant, this blog should be an [...]

How Long Does SOC 2 Compliance Take and How Can You Get Certified?

It seems like a long project to reach SOC compliance, right? Well, not if you [...]

ISO 27001 vs SOC 2: Apples and Oranges

What’s the difference between ISO 27001 verses SOC 2? Good question. SOC 2 is becoming [...]

NIS 2 Directive Timeline & Requirements to Minimise Risks

NIS 2 is Changing It’s getting Risky out there… The protection of our networks and [...]

Essential Information | The DORA Regulation in the UK

How does DORA apply in the UK? Although the Digital Operational Resilience Act (DORA) is [...]

DORA Compliance Checklist: Your Guide to Actionable Steps

Achieving compliance with the Digital Operational Resilience Act (DORA) may seem challenging, but with the [...]

An Overview to DORA’s Regulatory Technical Standards (RTS)

What is DORA and How Does it Differ from Existing Risk Management Frameworks? Well, DORA [...]

A Comprehensive Overview of the Digital Operational Resilience Act

Trying to understand DORA? Think of it like this: The Digital Operational Resilience Act (DORA) [...]

Why Cyber Essentials is Not Just a Tick Box – Interview with Dr Emma Philpott

As the question ‘why do I need a Cyber Essentials certification?’ continues to arise, Dr [...]

Going Beyond Cyber Essentials Plus Certification

Once you have successfully attained Cyber Essentials Plus (CE+) certification and the celebrations are over, [...]

What Are the Benefits of Cyber Essentials Plus?

Certifying to Cyber Essentials Plus Although many organisations pursue Cyber Essentials Plus (CE+) certification in [...]

Can I get Cyber Essentials Plus Certification Remotely?

Many organisations have sought to achieve Cyber Essentials Plus (CE+) certification remotely (as opposed to [...]

Cyber Essentials Plus – Your Burning Questions Answered

In our recent webinar, Achieving Cyber Essentials Plus, Nick Roberts and Taras Sachok provided valuable [...]

Are You Considering the Cyber Essentials Framework?

If you’re considering gaining formal certification to Cyber Essentials Plus (CE+)…good for you!  Complying with the security requirements [...]

How to Prepare for a Penetration Test

It is an undeniable fact that all applications and infrastructures are essentially in need of [...]

Mobile Banking Apps: The Risks, Threats and Solutions

Mobile banking apps have become the new normal for millions of people around the world, [...]

Cloud Technology Risks – The Cloudy Truth

Navigating the Treacherous Landscape of Security Risks In today’s fast-paced digital world, the adoption of [...]

What is Open-Source Intelligence? How to Get Started

Imagine a world intricately woven with connections, where information flows like a meandering river of [...]

Importance of Black Box Testing for Your Cyber Security Defence

In a world where the digital landscape keeps changing, how can we effectively protect our [...]

External Penetration Testing and How to Do It

What is External Penetration Testing External penetration testing also known as external network penetration testing [...]

How Much Does Penetration Testing Cost | Risk Crew

Penetration testing, also known as ethical hacking or white-hat hacking, is like putting on a [...]

What are the Different Types of Penetration Testing?

If you’re considering a penetration test to identify and fix vulnerabilities within your business, you [...]

Why a Red Team Security Assessment is Crucial for Every Business

In today’s digital age, businesses are more vulnerable than ever to cyber-attacks. As a result, [...]

7 Key Benefits of Red Team Testing for Your Organisation

In an information or cyber security context, a Red Team is a group of ethical [...]

Red Team Vs Blue Team – A Comprehensive Guide

With the ever-increasing threat of data breaches for many organisations, testing your security systems is [...]

Should You Conduct Red Team Testing Without a Blue Team?

We often hear the question: “Should we perform Red Team Testing without a Blue Team?” [...]

Clearing the Confusion: Red Team vs Penetration Test

More than often when organisations are directed by the board to deploy a Red Team [...]

Try Red Team Testing to Improve ROI

Typically, ROI is seen as money spent vs money received to see if the investment [...]

Top 8 Metrics to Collect During a Red Team Test

Why should we collect metrics in a red team test? Metrics are a valuable way [...]

Ready for Red Teaming?

Are you considering conducting Red Team testing? Have you ever conducted one? Maybe it’s time [...]

10 Social Engineering Attacks You Need to Know

Simply put — social engineering works. Ask any Threat Actor in the business. Social engineering [...]

How to Spot a Phishing Attack

Yes. We know. A lot has been written on how to spot phishing attacks over [...]

Social Engineering Techniques – Hacking Human Behaviour | Risk Crew

Social engineering is a term used for a wide variety of activities used by threat [...]

Top 5 Signs of Social Engineering Attacks

What are the Signs of a Social Engineering Attack and How Can You Prevent Them? [...]

Don’t be Vulnerable to Vishing – Identify and Mitigate Risk

In this post, you’ll learn why vishing is successful and what you can do to [...]

Why you should deploy Simulated Social Engineering Testing against your workforce

Social Engineering can be summed up as ‘hacking the human’. Traditional malicious hacking attacks a [...]

Spear Phishing – Why you should “Fear the Spear”

SPEAR PHISHING, WHALING, BUSINESS EMAIL COMPROMISE AND CEO FRAUD IS ON THE RISE AND COSTING [...]

Security Vulnerabilities

Enhancing the Security in Blockchain | Risk Crew

The Emergence of Blockchain Technology  How did we arrive at blockchain technology? Let’s start from [...]

4 Business Questions About IoT Devices

Are your IoT devices secure? Internet of things (IoT) devices have seen year on year [...]

How to Mitigate DNS Hijacking

The term Domain Name System (DNS) hijacking unfortunately tends to be misused in the industry, [...]

Secure Your SME to Detour Hacker Attacks

It is estimated that six in ten SMEs that suffer a breach are likely to [...]

The Importance of Minimising Your Attack Surface

With every security test, Risk Crew has performed, there has been at least one attack [...]

Let’s Chat

Whether you are just starting out with you GRC or have not begun, our experts are here to answer your questions.