Building the Enterprise Identity Operating Model
Building the Enterprise Identity Operating Model challenges the legacy view of identity as simply an access permission model. Instead, it defines identity as a continuously evaluated risk construct, requiring centralized visibility, policy orchestration, and lifecycle control.
My new release provides a step-by-step model of controls enterprise's must consider when building out a modern identity management infrastructure.
Identity Maturity Calculator v2
Eight years ago, I gave the industry a way to ask where its identity program really stands. The Identity Maturity Calculator is back as version 2.0, rebuilt for today’s threats, including non-human identities and AI agents. It turns an honest self-assessment into a clear picture of your gaps and a prioritized plan for what to fix first. Free to download, and built to complement my new book.
Q&A with Expert Insights
An interview with Expert Insights on the challenges of CISO liability, organization structure, and breach response time.
Root to CISO Podcast
Root to CISO podcast where we discuss the security industry, and topics like certifications, experience, and the need for college degrees.
Security Chiefs Unfazed by Federal AI Oversight
An interview with the Wall Street Journal around the new AI Executive Order and the federal 'safety check' being proposed.
Interview with CISO Voice
An interview with CISOVoice around on Identity sprawl, being a CISO, the gap between authority and expectations, and why boards that understand the difference end up with better security programs.
2025 Top-20 Best CISO Blogs
Chronicles of a CISO has been ranked 8th of the Top-20 Best CISO blogs on Feedspot
Risk Preparedness in the Age of Policy Volatility
This panel discussion, as part of the Digital Risk North America virtual event, focuses on Risk Preparedness in the Age of Policy Volatility
The Virtual CISO Moment Interview
Virtual CISO Moment podcast with Greg Schaffer. We discussed the challenges facing SMBs when it comes to security and how we need to fix the model.
2025 Top-100 Best Security Blogs
Chronicles of a CISO has been named to the Top-100 Best Information Security blogs on Feedspot
The Compliance Equation: Preparing for Regulatory Shifts Under Trump 2025
This panel discussion, as part of the Digital Risk North America virtual event, focuses on the anticipated regulatory changes from the incoming Trump administration.
Inside Out: Unveiling and Mitigating Insider Threats in the Modern Workplace
A panel discussion, as part of the PrivSec Global event, that focuses on the complexities of insider threats, exploring the motivations behind them, detection methods and effective mitigation strategies.
Zero Trust Architecture: Implementing Best Practices in the US
This panel discussion, as part of the GRC World Forums Digital Risk US virtual event, focuses on implementing best practices for Zero Trust Architectures.
Compliance, Due Diligence, & More: Navigating Upcoming TPRM Trends
A discussion with Scott Lang, VP of Product Marketing at Prevalent, as we explore the emerging trends in TPRM and provide actionable insights to help you stay ahead of your third-party risks.
Inherent Risk vs. Residual Risk: The Foundation of Effective TPRM
An on-demand webinar around effectively managing inherent and residual third-party risks and their importance for a durable third-party risk management (TPRM) program.
Updated NIST Cybersecurity Framework (CSF) Tool Released
The NIST CSF toolkit has been updated to reflect the new Cybersecurity Framework v2.0.
The Action That Shook An Industry
The SEC has put the executives of SolarWinds, including the CFO and CISO on notice. How will this impact the future of the security industry?
Technology Risk in the Private Equity World
New regulations and business drivers are forcing Private Equity firms to take a closer look at cybersecurity risk pre & post-acquisition.
A CISOs Guide to ESG
The term ESG has become a common parlance in the corporate world. How can a CISO leverage ESG to further their program and be better corporate citizens?
Cyber Resources For Veterans
Career and education resources for those on active duty or veterans who are looking to move into cybersecurity or S.T.E.M. careers.
The Evolving Game Of Cyber Insurance
Cyber insurance is increasingly difficult to obtain and more expensive than ever. A recent study identified the top 10 controls insurance carriers look for when determining coverage and cost. By leveraging specific areas of the NIST CSF, you can qualify for better coverage and effectively lower premiums.
The Interrupt-driven Life of a CISO
The interrupt-driven life of a CISO and how stress impacts our thought process and the changes we make to how our minds work.
Simplify Your Value Statement
In order to communicate their message quickly, Vendors need to develop a value statement that appeals to a CISO by quickly articulating how your solution reduces risk, minimizes staffing issues, or enhances budget.
New Version of the NIST CSF Tool
Please note: Version 2.1 of the tool was uploaded to the site on February 28, 2022, due to a formula bug in the privacy worksheet. The NIST CSF Tool I…