Insights
What we observe in the field
Practice analyses, written from exercise and audit findings rather than from the texts.
The RTO nobody had tested
A declared four-hour RTO, an exercise measured at four hours forty-seven, and three time items almost no plan counts.
28 August 2026·7 min read
The register of information, DORA's most underestimated deliverable
Not a supplier list but a set of linked tables with dozens of fields, contract-level granularity and mandatory annual submission.
15 July 2026·6 min
Why your BIA bogs down, and how to unblock it
A hundred and twenty questionnaires, six months, and a table where every activity is four-hour critical. The cause is a sequencing error.
10 June 2026·6 min
The backup that survives a compromised administrator
"We're active-active" is not an answer to the ransomware question. Here is what is.
20 May 2026·5 min
An impact tolerance is not an RTO in disguise
One looks at harm suffered by the client; the other at the organisation's capability. Conflating them empties the exercise of meaning.
18 April 2026·5 min
A successful exercise is one that reveals a gap
"Everything went well" is a negative signal. Here is how to design an exercise that produces usable information.
12 March 2026·5 min