Blog

As a Payment Card Industry Qualified Security Assessor (PCI QSA) company, we are often asked by organisations which process card payments....

There’s no getting away from the fact that preparing for a PCI DSS ROC can be a bit of a trial....

In this blog, we turn our attention to service providers. The PCI Security Standards Council defines a service provider....

We are often asked, both by those new to PCI DSS and those who have been involved for a while....

For an organisation to achieve and maintain compliance to the Payment Card Industry Data Security Standard (PCI DSS)....

In this article, we aim to clarify what requirements the Payment Card Industry Data Security Standard (PCI DSS) places around....

In our previous blog, we looked at where your PCI compliance journey starts. The first step is understanding the flow of your payment card data....

Often referred to as the PCI DSS or quite simply PCI, the Standard was developed by the founding payment brands....

The Payment Card Industry Security Standards Council (PCI SSC) defines scoping as “the process of identifying all system components....

PCI remediation is an essential activity for any organisation wishing to fully comply.....

URM’s PCI DSS gap analysis service is aimed at those organisations which are looking to benchmark....

Many organisations have had to adapt very quickly to the rapidly changing restrictions brought in across the globe to help combat the spread of COVID-19.

We are going to explore why the focus on a risk-based approach has helped turn ISO 27001, the International ISM Standard, into such a world-beater.

One of the long-held beliefs underpinning many a password policy is that forcing a regular password change is a good thing.

There is some confusion about the difference between having an ISMS which is certified to ISO 27001 and one which is compliant or aligned to the Standard.

With this blog, the spotlight turns to internal audit and specifically in the context of ISO 27001, the International Standard for ISM.

With the news often including stories regarding high-profile information security breaches, many of us find ourselves asking how we can avoid it.

This blog takes a look at onboarding information systems. When onboarding is mentioned will conclude it’s referring to people but there is a lot more to think

This blog talks about information classification. So, what exactly do we mean by information classification?

In this blog, we are going to look at governance. We are regularly asked, ‘is information governance the same as IT governance?’

When managing the security of your organisation’s information assets, you will need to consider the scope of what you are doing.

The answer depends on your goals and knowledge of your current position. This blog will look at which is best and when.

Let’s face it, there is nothing straightforward or simple about responding to a data subject access request (DSAR).

On 2 February 2022, the Information Commissioner’s Office (ICO) laid before Parliament changes around restricted international personal data transfers.

One of the fundamental rights of an individual (data subject), under the UK GDPR is to be able to access and receive a copy of their personal information.

We are focussing on transfer risk assessments (TRAs), commencing with the background that led to their introduction and then addressing the five questions.

The GDPR (EU) 2016/679 is an EU regulation which came into effect on 25 May 2018 and set a new benchmark for the processing of personal data.

On 16 July 2020, the CJEU issued its judgement on the adequacy of both the Privacy Shield and standard contract clauses (SCCs).

The need for guidance on how organisations should best protect privacy and manage personal information has never been more pertinent.

The EU GDPR and the UK DPA both require organisations to protect and ensure the privacy of any personal data which they process.