Insights & Blogs
Practical guidance on cybersecurity, data protection, service and AI compliance, across global standards and regional regimes.
Meet GRCLens at the G[P]RC Summit Africa 2026 in Johannesburg
We are growing: in the same week as Kuala Lumpur, GRCLens and Security Solution Consultants are exhibiting at the G[P]RC Summit Africa in Johannesburg on 10 and 11 November 2026.
Meet GRCLens at the PCI SSC 2026 Asia-Pacific Community Meeting in Kuala Lumpur
GRCLens and Security Solution Consultants are exhibiting at the PCI SSC 2026 Asia-Pacific Community Meeting Vendor Showcase in Kuala Lumpur on 11 and 12 November 2026.
From incident to crisis: how ISO/IEC 27035, ISO 22320 and ISO 22361 work together
Incident handling, incident command and crisis leadership are usually run by three teams with three plans. Read together, ISO/IEC 27035, ISO 22320 and ISO 22361 describe one escalation, and the hand-offs between them are where most crises go wrong.
ISO 22000 certification in 2026: what a food safety management system has to show, site by site
ISO 22000:2018 certification is won or lost at the plant, not at head office. What the standard requires, how the HACCP plan and prerequisite programmes fit, which food laws apply in Australia, New Zealand, the Pacific, Southeast Asia, the Gulf and South Asia, and how to run one FSMS across many sites without a major nonconformity.
GRC Platform Requirements for Regulated Entities: A Buyer's Checklist
A GRC platform holds your risk register, control weaknesses and incident records, and your regulator may treat its vendor as material. What to require from the product, the contract and the hosting before you sign.
Post-Quantum TLS in 2026: How to Test, Evidence and Govern Hybrid Key Exchange
Most browsers already offer post-quantum key exchange. Whether your connections actually use it depends on servers, load balancers and suppliers you control. How to test it, fix it and prove it to an auditor.
Autonomous Fleets Meet Critical Infrastructure Law: SOCI, New Zealand and the Gulf
Once an autonomous fleet moves freight or carries the public at scale, its operator starts to look like a critical infrastructure operator. What the SOCI Act, New Zealand's proposed regime and the Gulf rules ask for, and how to evidence it.
Running Post-Quantum Readiness as a GRC Programme: Inventory, KRIs and Regulator Dates
Post-quantum migration fails the same way most multi-year security programmes fail: an inventory nobody maintains, risks nobody scores, and dates nobody tracks. How to run it as a governed programme instead.
Governing AI Agents Under ISO/IEC 42001: Registers, Impact Assessments and Evidence
ISO/IEC 42001 was published before most organisations ran AI agents, but its structure fits them well. How to extend an AI management system to agents: the register, the impact assessment trigger, the life cycle controls and the evidence.
Continuous Compliance: One Piece of Evidence for NCA ECC, ISO 27001 and SOC 2
Organisations that answer to the Saudi NCA, an ISO certification body and SOC 2 customers often collect the same access review three times. How evidence captured once really works, and the traps that make auditors reject reused evidence.
Cyber Incident Reporting Deadlines in 2026: Australia, New Zealand, Singapore, Malaysia and the Gulf Compared
A bank in Singapore has one hour. An Australian critical infrastructure operator has twelve. A Saudi controller has seventy-two. One incident can start five clocks at once. Every major reporting deadline across Asia-Pacific and the Gulf, in one place.
AI Model Risk Management for Banks in 2026: What APRA, MAS, BNM, HKMA and the CBUAE Now Expect
In April 2026 APRA told banks their AI governance is not keeping pace with adoption. MAS is finalising AI risk guidelines, the CBUAE has issued its own, and US supervisors have rewritten model risk guidance. What regulators across the region now expect, and where they agree.
Critical Infrastructure Cyber Laws Compared: Australia, New Zealand, Singapore, Malaysia, Saudi Arabia, the UAE and Qatar
Seven countries, three models of regulation. Australia, Singapore and Malaysia legislate; Saudi Arabia, the UAE and Qatar regulate through mandatory controls and standards; New Zealand is still designing its regime. What each one demands of operators and boards, side by side.
One Supplier Assurance Programme for APRA CPS 230, MAS, HKMA, SAMA and the CBUAE
Third parties featured in 48% of breaches in Verizon's 2026 report, and regulators now want registers, audit rights, exit plans and concentration analysis. How to run one supplier assurance programme across Australia, Singapore, Hong Kong and the Gulf.
APRA CPS 230 vs CPS 234: which one you need, and how they fit together
Banks, insurers and super trustees ask whether they need CPS 230 or CPS 234. The answer is both, with different owners, different clocks and one shared supplier list. What each requires, what changed on 1 July 2026, and where they overlap.
Enhanced CIRMP Rules 2026: What to Do and When
The enhanced CIRMP Rules commenced on 10 June 2026. What nine high-risk asset classes must do, which frameworks now qualify, and the deadlines.
Saudi OTCC and CSCC: Which NCA Controls Apply?
OTCC-1:2022 covers critical OT and ICS. CSCC-1:2019 covers other critical systems. Scope, control counts, facility levels and the ECC link.
PCI DSS 6.4.3 and 11.6.1: An ANZ Guide for 2026
What PCI DSS v4.0.1 requires for payment page scripts, how SAQ A changed in 2025, and what Australian and NZ merchants must evidence now.
SBP Payment Security Rules vs PCI DSS: 2026
How SBP card security rules, the 2025 technology risk framework for payment institutions and PCI DSS fit together for Pakistani banks, PSPs and EMIs.
AI Governance in Australia and NZ: 2026 Guide
Australia and New Zealand chose existing laws over an AI Act. What is mandatory, what is voluntary, and what starts in December 2026.
AI Governance in Saudi, UAE and Pakistan 2026
Saudi Arabia, the UAE and Pakistan have no general AI law yet. Which AI rules bind you, which are voluntary, and where ISO 42001 fits.
Malaysia's cyber risk landscape in 2026: three laws, one board agenda
The Cyber Security Act, the amended PDPA and Bank Negara's revised RMiT arrived within eighteen months of each other. Here is how they fit together, and what the threat picture behind them looks like.
The Cyber Security Act 2024, two years on: what an NCII entity actually has to do
Act 854 is short on prose and long on duties. A plain reading of the annual risk assessment, the biennial audit, incident notification, the NCSB self-assessment and the sector Codes of Practice.
Malaysia's PDPA after the 2024 amendments: 72 hours, a DPO, and processors in scope
The Personal Data Protection (Amendment) Act 2024 phased in during 2025. The changes that matter operationally (breach notification, the mandatory DPO, direct processor duties and portability) and how they compare with the Gulf's privacy laws.
RMiT 2025 for Malaysian financial institutions: the 90-day clock, cloud, and the supplier you forgot
Bank Negara Malaysia's revised Risk Management in Technology took effect on 28 November 2025. What changed, why external-party assurance and cloud consultation are where most gaps sit, and how to keep the annual self-assessment honest.
Driverless cars: the security problems nobody has solved yet, and the controls that help
An autonomous vehicle is a data centre on wheels with a physical blast radius. The attack surface, the incidents that have already happened, and how ISO/SAE 21434, UN R155 and ordinary GRC discipline address them.
GRC platforms in Australia: an honest comparison
Protecht, 6clicks, Sentrient, CAMMS, Pali and GRCLens compared for Australian organisations, including where GRCLens is the wrong choice.
Cyber governance in the Gulf: how KSA and the UAE set the pace
A regional map of the regulators and frameworks shaping cybersecurity governance across Saudi Arabia and the UAE, and what they have in common.
Security assurance in Saudi Arabia: making NCA-ECC stick
Implementing the Essential Cybersecurity Controls is only half the job. Sustaining assurance, proving controls keep working, is where programs succeed or fail.
Cyber governance in Dubai: DESC ISR and the UAE IA Standards
Dubai government entities and their suppliers operate under the DESC Information Security Regulation. Here's how it connects to the wider UAE assurance landscape.
Data protection across the Gulf: KSA PDPL and the UAE compared
Saudi Arabia's PDPL and the UAE's federal data protection law share DNA with global privacy regimes, but the details differ. A side-by-side orientation.
Building a security assurance program for Gulf enterprises
A practical blueprint for standing up continuous assurance across multiple regional frameworks without burning out your team.
Third-party and cloud risk under GCC frameworks
Regulators in KSA and the UAE increasingly hold organizations accountable for their suppliers and cloud providers. Here's how to get ahead of it.
ISO/IEC 27001:2022 explained: from scope to Statement of Applicability
The world's most recognised information-security standard, in plain terms, the management-system clauses, the 93 Annex A controls, and how the SoA ties it together.
ISO/IEC 20000-1: why service management underpins security
Strong IT service management is the operational backbone that keeps security controls working. An orientation to the ITSM standard and where it overlaps with ISO 27001.
ISO/IEC 42001: governing AI responsibly
The first management-system standard for artificial intelligence. What an AI Management System covers, and why it matters as AI moves into regulated workflows.
SOC 2 for service organizations: the Trust Services Criteria
SOC 2 is the assurance report customers ask for before they trust you with their data. How the Trust Services Criteria work and how SOC 2 relates to ISO 27001.
Want a specific topic covered? Email us.