Latest Articles

Do Your Service Requests Actually Meet SLAs? Here's How to Know — and Fix What Doesn't Why SLA Tracking Matters Service-level agreements (SLAs) for service requests need to be tracked, reported, and managed. Cross-client dashboards for leadership provide visibility into SLA compliance across all accounts. Client-facing portals provide real-time visibility into service request status and SLA status. Setting Meaningful SLAs Differentiated SLAs Set SLAs by request type, not as a single blanket target. A password reset that misses a 4-hour SLA is a different kind of failure than a hardware provisioning request that misses a 3-day SLA . Request Type SLA Target Why Password reset 1 hour Critical for productivity Software installation 24 hours Less urgent Hardware provisioning 5 days Longer process Access request 2 hours Security sensitivity What to Track Metric Description SLA compliance % Percentage meeting targets Average fulfillment time Time from submission to completion Breach count Number of SLA breaches Breach frequency Which request types breach most often Escalation rate How many requests need escalation Using SLA Data for Improvement Common Patterns to Investigate: Pattern What It May Mean Frequent breaches for a specific request type Process or resource issue Escalations in certain teams Resourcing or skill issue Breaches increasing over time Growing backlog or capacity issue Dashboard Best Practices Element Purpose Real-time view See current SLA status Trend views See SLA over time Drill-down Investigate root causes Alerting Proactively prevent breaches Conclusion SLA tracking is essential for accountability and improvement. Organizations that track and report SLAs effectively can identify problems, meet commitments, and continuously improve. Action Items for Your Organization Define SLAs by request type (not blanket targets) Set up SLA tracking and reporting Create dashboards for visibility Investigate SLA breaches Use SLA data to drive improvement

Sanctions Screening Is No Longer Optional — It's a Critical VRM Requirement The Sanctions Reality Sanctions, tariff wars and trade restrictions are impacting nearly all geographies . New vendor onboarding processes should include due diligence around sanctions and ownership structures . Why Sanctions Screening Matters Regulatory Compliance Non-compliance with sanctions can result in significant penalties, legal action, and reputational damage. Business Continuity A vendor that becomes sanctioned may have services abruptly restricted. The Microsoft suspension following EU sanctions on Russia serves as a clear example . Hidden Risks A company may appear operating solely within one jurisdiction but might have a parent company or key investors subjected to regulations from a different country . Key Screening Areas 1. Sanctions Lists Screen vendors and their parent companies against sanctions lists . This includes: UN sanctions lists US OFAC sanctions lists EU sanctions lists Other national sanctions lists 2. Ownership Structures Evaluate ownership structures to identify hidden risks . Who owns the vendor? Who are the key investors? What jurisdictions are they subject to? 3. Connections with Sensitive Regions Evaluate connections with sensitive regions . Does the vendor operate in high-risk regions? Does the vendor have dependencies on high-risk third parties? Integrating Sanctions Screening into VRM Pre-Onboarding : Screen vendors before engagement Evaluate sanctions exposure Assess ownership structures Identify hidden risks Ongoing Monitoring : Monitor sanctions lists continuously Screen for changes in ownership or structure Stay informed of evolving regulations  Contractual Protection : Include sanctions compliance clauses Define suspension or termination triggers  Require immediate notification of compliance changes  The Regulatory Environment Government agencies have begun actively offboarding contractors who fail to meet strict cybersecurity mandates or cannot guarantee that controlled unclassified information is housed in authorized environments . Conclusion Sanctions screening is no longer optional—it's a critical VRM requirement. Organizations that integrate sanctions screening into vendor onboarding and ongoing monitoring will protect themselves from regulatory penalties and operational disruptions. Action Items for Your Organization Integrate sanctions screening into vendor onboarding Screen vendors and parent companies against sanctions lists Evaluate ownership structures and hidden risks Monitor sanctions lists continuously Include sanctions clauses in vendor contracts  

Are You Doing Controls or Just Going Through the Motions? — The Controls Maturity Model The Maturity Model Controls maturity describes how advanced your controls management practice is. Maturity Levels Level 1: Initial/Ad-Hoc Characteristics: Controls exist but are not documented Ad-hoc implementation Inconsistent execution No ownership Reactive Signs you're at Level 1: Controls are not documented No formal control testing No evidence of operation Level 2: Repeatable Characteristics: Basic documentation Inconsistent execution Emerging ownership Some testing Signs you're at Level 2: Controls are documented Some control testing Some evidence collection Level 3: Defined Characteristics: Standardized controls Documented processes Clear ownership Regular testing Signs you're at Level 3: Controls are consistently documented Formal testing schedule Clear ownership Level 4: Managed Characteristics: Performance measured Proactive improvement Continuous monitoring Integration with other processes Signs you're at Level 4: Control metrics tracked Continuous monitoring Evidence is automated Level 5: Optimizing Characteristics: Continuous improvement AI-driven controls Predictive analytics Fully integrated controls Self-healing controls Signs you're at Level 5: AI for controls monitoring Automated remediation Always audit-ready Maturity Assessment Questions Area Question Documentation Are controls documented? Ownership Is ownership assigned? Testing Are controls tested regularly? Monitoring Are controls monitored continuously? Evidence Is evidence collected automatically? Automation Are controls automated? Building a Roadmap Level 1 → Level 2: Document controls Assign ownership Implement basic testing Level 2 → Level 3: Standardize processes Formalize testing schedule Establish evidence collection Level 3 → Level 4: Implement continuous monitoring Track metrics Integrate with other processes Level 4 → Level 5: Implement AI-driven controls Enable automated remediation Achieve continuous improvement Conclusion Controls maturity is a journey. Organizations that assess their maturity and build a roadmap for improvement will achieve more effective controls, better risk management, and audit readiness. Action Items for Your Organization Assess your current controls maturity Identify gaps Build a roadmap to the next level Measure progress Celebrate improvements

AI-First, Continuous, Connected — The Future of GRC Is Here The GRC Transformation The future of GRC is AI-first, continuous, and connected . In 2026, Cyber GRC will move from reacting faster to predicting earlier, governing smarter, and connecting risk across the enterprise . Key Trends 1. AI-First Cyber GRC Organizations are embedding AI across risk identification, assessment, and response to move beyond manual processes and backward-looking analysis . AI-first solutions, including AI cyber agents, will correlate signals across vulnerabilities, incidents, threat intelligence, and business context, enabling faster prioritization and more informed decision-making . What this means: Predictive intelligence, automated controls testing, and real-time risk insights will allow security and risk teams to anticipate threats before they materialize. 2. Continuous Cyber Compliance Point-in-time compliance assessments are quickly becoming obsolete. Compliance will no longer be a periodic exercise—it will be an always-on capability embedded into daily operations . What this means: Continuous monitoring, automated evidence collection, and ongoing controls validation will be the new enterprise standard. 3. Connected GRC Cyber risk no longer exists in isolation. It is deeply interconnected with third-party risk, operational risk, regulatory risk, and enterprise resilience . A connected GRC approach will be essential for understanding how risks cascade across the organization and for coordinating response efforts. What this means: Connected GRC enables better prioritization, faster response, and stronger alignment between cyber risk management and business objectives. 4. Agentic AI in GRC Agentic AI is reshaping GRC by enabling systems that can independently plan and execute multi-step workflows . Autonomous response and remediation is the most transformative development—closed-loop GRC systems where risks are not only detected but also acted upon through orchestrated workflows . What this means: AI agents can initiate remediation workflows, orchestrate cross-functional actions, and generate executive-level insights. 5. AI Governance as a Core Pillar 87% of organizations identified AI-related vulnerabilities as the fastest-growing cyber risk . AI governance will be a core GRC priority, with clear accountability structures, risk assessments for AI use cases, and controls aligned to emerging regulations . What this means: Without robust governance, AI can amplify risk faster than traditional systems. 6. The Evolution of the CISO Role The CISO role will evolve from oversight to orchestration, with CISOs overseeing AI-driven systems that automate risk management processes across the enterprise . What this means: New operating models, greater collaboration across business and technology functions, and a stronger emphasis on human-in-the-loop governance. The 2026-2027 GRC Roadmap Timeframe Actions Now Assess current capabilities, identify gaps, define strategy Q3-Q4 2026 Implement AI-first capabilities, establish AI governance, adopt continuous compliance 2027 Scale connected GRC, enable autonomous risk management, achieve continuous improvement Conclusion The future of GRC will not be defined by compliance alone, but by the ability to operationalize intelligent, autonomous, and governed risk management at scale . Organizations that embrace these trends—AI-first, continuous, and connected—will be better positioned to adapt with purpose and resilience. Security, governance, and risk have become pillars of strategic advantage . They define how quickly a company can innovate, how confidently it can enter new regions, and how it can demonstrate to customers, partners, and investors that it is prepared for the future. Action Items for Your Organization Assess your current GRC capabilities against future trends Build a roadmap for AI-first GRC Plan for continuous compliance Establish connected GRC Prepare for agentic AI in GRC Evolve the CISO role

Measuring Change Adoption Without Measuring Impact Is a Trap The Measurement Problem Traditional change management metrics focus on activity: training completion, licenses issued, adoption rates. But these don't show whether change is delivering value. Activity vs. Impact Activity Metrics Impact Metrics Training completion Behaviour change Licenses issued Active usage Communications sent Message retention Survey participation Sentiment change Adoption rates Business outcomes What to Measure 1. Awareness Are employees aware of the change? Communication engagement Survey awareness scores Message retention  2. Preparedness Are employees prepared to adopt the change? Training participation Training effectiveness Help desk metrics (tickets, escalations)  3. Adoption Are employees using the new tools or processes? Usage and utilization reports Compliance and adherence reports Behavioral observations  4. Impact Is the change delivering business value? Benefit realization ROI Quality metrics Customer satisfaction The Outside-In Mindset Otto recommends a change manager focuses on two outside-in outputs : Awareness: Measuring if employees understand the change Preparedness: Measuring if employees have the knowledge and ability to make the change and sustain it Measuring Performance Zendesk's Dana Otto recommends the following approach: 1. Focus on Two Main Outputs: Awareness and Preparedness Make sure employees understand the change and have the tools to adopt it. 2. Quantify Qualitative Data Frame qualitative questions in employee surveys on a scale to quantify responses. "Measuring change management is one of the most difficult parts of the process because you're measuring people and their emotions, which is hard to quantify" . 3. Ask Managers to Hold Teams Accountable A major component of measuring change is assessing if people are doing their part to meet project goals . 4. Measure if the Business Is Prepared Evaluate if the business is ready to move from its current state to the desired future state . 5. Leverage Technology to Track Communications Use tools to track if communications are impactful . 6. Incorporate Feedback Early On Foster a feedback loop between impacted groups and business leaders early on . 7. Measure if the Change Stuck Continue measuring to see if people continue to incorporate the change over time . Conclusion Measuring change success requires moving beyond activity metrics to impact metrics. By focusing on awareness, preparedness, adoption, and impact, organizations can understand whether change is actually working. Action Items for Your Organization Define success metrics for your change initiative Measure awareness and preparedness Track adoption over time Measure business impact Use outside-in metrics (employee perspective) Continue measuring after rollout

Headline: Stop Spending 30% of Your Time on Manual Control Assessments — Automate Instead The Assessment Challenge Manual control assessments are time-consuming, error-prone, and unsustainable at scale. According to industry research, 76% of GRC professionals still spend 30% or more of their working hours on repetitive, manual administrative tasks . The problem: Manual evidence collection is slow and error-prone Point-in-time assessments miss issues between audits Audit fatigue is unsustainable Manual processes don't scale with growth The Automation Opportunity Organizations that automate control assessments can: Reduce assessment time by 50% or more Improve accuracy and consistency Achieve continuous compliance Free up teams for higher-impact work Real-world impact: By automating the assessment and monitoring of technical controls, organizations have been able to automate over 50% of the yearly assessed controls . How to Automate Control Assessments Step 1: Identify Automatable Controls Not all controls can be automated. Prioritize controls that: Have clear, measurable criteria Generate data that can be collected automatically Have a defined pass/fail condition Step 2: Define the Automation Logic For each control, define: Element Example Control RA-05d: Vulnerabilities remediated within defined time frame Data Source Vulnerability scan results Logic "Failed" if any overdue vulnerabilities exist Action Update control status, send alert Step 3: Implement Automation Using a controls automation platform: Configure the data source connection Define the assessment logic Set up automated alerts Configure automated status updates Set up reporting Real-world example: A federal agency used Q-Compliance to create a search that finds overdue vulnerabilities : text Search: vulnerabilities with remediation date > current date Condition: Any results found = Control Failed Action: Update control status to "Failed", send alert Step 4: Create Remediation Workflows When a control fails, trigger remediation: Alert: Notify the security team Ticket: Create a remediation task Tracking: Track progress Verification: When fixed, re-run assessment Status Update: Update control status to "Passed" Step 5: Scale Across Systems From one system to hundreds: Group similar systems together Automate a control on several systems with one search Results split by system so no false failures or passes  Example: Multi-System Alerting One alert can monitor RA-05d across hundreds of systems: System Vulnerability Status Control Status System A 0 overdue Passed System B 3 overdue Failed System C 0 overdue Passed The Continuous Assessment Cycle Manual Assessment Cycle: Wait for annual audit Collect evidence manually Assess control status Find gaps Remediate Repeat next year Automated Assessment Cycle: Monitor continuously Assess automatically Detect gaps immediately Alert automatically Remediate promptly Reassess automatically Benefits of Automated Control Assessments Benefit Impact Time savings Automate 50%+ of control assessments Better accuracy Consistent, auditable logic Immediate gap detection Identify issues immediately Continuous compliance Always audit-ready Team productivity Focus on higher-value work Conclusion Automating control assessments is essential for modern GRC programs. Organizations that automate assessments will reduce manual effort, improve accuracy, and achieve continuous compliance. Action Items for Your Organization Identify controls suitable for automation Define assessment logic for each Implement automation using a controls platform Create automated remediation workflows Scale across systems Measure the reduction in manual assessment time