SENTINEL42
Free · From Sentinel42

Ask the CISO

A security question you need a straight answer to? Ask it here. You'll get a practitioner's view – the decision, the clause or control behind it, what to do next and what evidence an auditor will want to see.

Ask your question
16+ years in GRC and information security ISO 27001 Lead Auditor & Implementer ISO 42001 Lead Auditor & Implementer CISMCCSK Cyber Essentials Assessor SC Cleared

What you can ask

The full breadth a CISO is expected to hold – the eight CISSP domains, the ISO/IEC 27000 series and the UK and EU rules that sit around them.

Strategy and the board

Roadmaps, risk appetite, budgets, board reporting, the Cyber Governance Code of Practice, fractional CISO models.

ISO 27001 and the 27000 series

Scope, risk assessment, Statement of Applicability, all 93 Annex A controls, internal audit, certification and nonconformities.

Risk and third parties

Risk registers, risk acceptance, supplier assurance, SOC 2 reports, ISO certificates, contract security clauses.

Identity, cloud and architecture

Phishing-resistant MFA, privileged access, zero trust, Microsoft 365 and Azure, AWS, segmentation, encryption.

Security operations

Vulnerability SLAs, logging and monitoring, EDR and MDR, backups that survive ransomware, pen testing and remediation.

Regulation and frameworks

Cyber Essentials, NCSC CAF, NIS Regulations, NIS2, DORA, PCI DSS, Cyber Resilience Act, NIST CSF 2.0, CIS Controls.

Secure development and AI

Secure SDLC, OWASP, software supply chain, AI security and ISO 42001, the AI Cyber Security Code of Practice.

Incidents

Severity, containment, evidence and notification clocks. If you are in a live incident, call your incident response provider or insurer first – then ask us.

What a good answer looks like

Every reply follows the same structure, so you can act on it and show your working to an auditor or a board.

  1. Bottom lineThe answer in a sentence or two
  2. BasisThe exact clause, control, requirement or article
  3. Risk viewThe scenario and how serious it is
  4. What to doNow, next and later – with owners
  5. Evidence to keepWhat an auditor or regulator will sample
  6. Framework mappingISO 27001, Cyber Essentials, CAF, NIS2, DORA and more
  7. Board lineOne sentence your board will understand
  8. ConfidenceHigh, Medium, or Verify – and what to check

Ask your question

Free and without obligation. Simon Green, founder of Sentinel42, or a member of the team will reply by email.

Not sure where to start? Try one of these:

Please don't include passwords, keys, vulnerability details for live systems, or personal data about others. Describe the situation in general terms – we'll ask for more if needed.
Up to 4,000 characters.