I wrote some time ago about “How to create security user stories” and I received in the meanwhile a lot of good feedback and questions about it. For these reasons, I decided that it is time to write again on the topic, this time with focus on two importat groups in any software developer team: […]
This is the part 5 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 5) — Information Security Sheet: Supplier Relationships, Compliance Chapter 6 — Supplier Relationships This chapter addresses how the organization manages information security risks arising […]
This is the part 4 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 4) — Information Security Sheet: IT Security / Cyber Security Chapter 5 — IT Security / Cyber Security This is the largest chapter in the Information […]
This is the part 3 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 3) — Information Security Sheet: Human Resources, Physical Security, Identity and Access Management Chapter 2 — Human Resources This chapter addresses the people dimension of […]
This is the part 2 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 2) — Information Security Sheet: IS Policies and Organization Chapter 1 — IS Policies and Organization This chapter establishes the governance foundation of the […]
TISAX — the Trusted Information Security Assessment Exchange — or Trusted ISA Exchange – is the automotive industry’s answer to a decades-old problem: every OEM was running its own supplier security questionnaire, and tier-1 and tier-2 suppliers were drowning in redundant audits. ENX Association, backed by the VDA (Verband der Automobilindustrie), formalized the exchange […]
AI Security Best Practices: What Every Employee Needs to Know A summary of an AI Security Policy — covering the risks that matter, with real examples of what goes wrong when they are ignored. AI tools are now part of everyday work — writing, coding, summarizing, automating. That is not going to change. But most […]
This is the extension of the original article AI Adoption for companies (based on OECD data) What US Companies Are Actually Spending — And Where It Maps The OECD data gives you the strategic framework. US-specific data gives you a reality check on spending. Here is what verified US sources report. Adoption in the […]
Why You Need to Read This Now Between 2020 and 2024, the share of firms using AI across OECD countries more than doubled — from 5.6% to 14%. Large firms (250+ employees) are at 40% adoption. Small firms (10–49 employees) are at 11.9%. Mid-sized firms sit in the middle at 20.4%. That gap is […]
We started to talk about the SOC2 Type 2 certification and I feel that we neglected it a bit. I wrote a bit about SDLC, Secure SDLC in particular, but now it is time to bring them together. SOC 2 Type 2 and Secure SDLC — the big picture SOC 2 Type 2 evaluates whether […]
You must be logged in to post a comment.