The risk was accepted. By whom is less clear.
A brief investigation into the mysterious person who owns every exception.
THE PART THAT SURVIVED THE MITIGATION.Everything is
Everything is
under control.*
Music and field notes from the space between “we should fix that” and “the business has accepted the risk.”
EXPLORE THE MUSIC ↗EXHIBIT AFOR INTERNAL COMFORT
WHAT
WE KNOW
WE KNOW
WHAT WE
PUT IN THE
REPORT
PUT IN THE
REPORT
ASSESSMENT SUMMARY
Some uncertainty remains.
ACCEPTED, APPARENTLYSTATUS UPDATEThe risk register has been updated. The risk has not.
Notes from the risk register
A SMALL COLLECTION OF LARGE ASSUMPTIONS.
Nothing is more permanent than a temporary exception.
Thirty days. Six renewals. One business-critical spreadsheet.
The dashboard is green. Please stop asking questions.
A field guide to measuring everything except the thing that happened.
“We take security seriously” is the beginning of a sentence. We’re interested in the rest of it.
Cybersecurity humor for people who have sat through the meeting, read the exception, and kept the receipt. About this project ↗