https://opensecurityalliance.org/blog Expert analysis on ISO 27001, RBI and SEBI regulation, DPDP Act, ransomware defence, zero trust, cloud security and CISO leadership from the Open Security Alliance advisory practice. en-in Sat, 24 Oct 2026 11:22:55 GMT https://opensecurityalliance.org/blog/iso-27001-2022-annex-a-changes https://opensecurityalliance.org/blog/iso-27001-2022-annex-a-changes Sat, 24 Oct 2026 11:22:55 GMT OSA Research Desk Compliance & Regulation ISO/IEC 27001:2022 reorganised Annex A into 93 controls across four themes and added 11 new ones. Here is what changed and how to update your ISMS without starting over. https://opensecurityalliance.org/blog/ransomware-playbook-board-checklist https://opensecurityalliance.org/blog/ransomware-playbook-board-checklist Fri, 23 Oct 2026 11:22:58 GMT OSA Research Desk Threat Intelligence Ransomware is a business-continuity event, not an IT incident. A board-level checklist covering backups, identity, detection, decision rights and recovery testing. https://opensecurityalliance.org/blog/cert-in-6-hour-incident-reporting-playbook https://opensecurityalliance.org/blog/cert-in-6-hour-incident-reporting-playbook Tue, 20 Oct 2026 11:22:56 GMT OSA Research Desk Compliance & Regulation CERT-In requires reportable cyber incidents to be notified within six hours of noticing them. A practical playbook for detection, triage, decision-making and evidence. https://opensecurityalliance.org/blog/dpdp-act-2023-readiness-roadmap https://opensecurityalliance.org/blog/dpdp-act-2023-readiness-roadmap Sat, 17 Oct 2026 11:22:56 GMT OSA Research Desk Data Privacy The Digital Personal Data Protection Act changes how Indian organisations collect, use and protect personal data. A step-by-step readiness roadmap with ownership and evidence. https://opensecurityalliance.org/blog/rbi-it-governance-master-direction-board-obligations https://opensecurityalliance.org/blog/rbi-it-governance-master-direction-board-obligations Wed, 14 Oct 2026 11:22:57 GMT OSA Research Desk Compliance & Regulation RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices sets clear expectations for boards, IT committees and the CISO. Here is what each must own. https://opensecurityalliance.org/blog/rbi-papg-security-requirements-payment-aggregators https://opensecurityalliance.org/blog/rbi-papg-security-requirements-payment-aggregators Sun, 11 Oct 2026 11:22:57 GMT OSA Research Desk Compliance & Regulation Payment aggregators and gateways regulated by RBI must meet baseline technology and security expectations. A guide to the controls, audits and data storage rules involved. https://opensecurityalliance.org/blog/sebi-cscrf-what-regulated-entities-need https://opensecurityalliance.org/blog/sebi-cscrf-what-regulated-entities-need Thu, 08 Oct 2026 11:22:57 GMT OSA Research Desk Compliance & Regulation SEBI's Cybersecurity and Cyber Resilience Framework sets graded obligations for market participants. Here is how to identify your category and build a compliant programme. https://opensecurityalliance.org/blog/soc-2-type-1-vs-type-2 https://opensecurityalliance.org/blog/soc-2-type-1-vs-type-2 Mon, 05 Oct 2026 11:22:58 GMT OSA Research Desk Audit & Assurance SOC 2 reports build trust with enterprise customers, but Type I and Type II answer different questions. Learn the difference, timelines and how to prepare for each. https://opensecurityalliance.org/blog/zero-trust-identity-first-roadmap https://opensecurityalliance.org/blog/zero-trust-identity-first-roadmap Fri, 02 Oct 2026 11:22:58 GMT OSA Research Desk Zero Trust Zero trust does not require a multi-year rebuild. A 12-week identity-first roadmap to replace broad VPN access with per-application, policy-based access. https://opensecurityalliance.org/blog/cloud-misconfigurations-aws-azure-gcp https://opensecurityalliance.org/blog/cloud-misconfigurations-aws-azure-gcp Tue, 29 Sep 2026 11:22:58 GMT OSA Research Desk Cloud Security Most cloud breaches start with a misconfiguration, not a zero-day. The most common mistakes across AWS, Azure and Google Cloud, and the guardrails that prevent them. https://opensecurityalliance.org/blog/spf-dkim-dmarc-email-authentication-guide https://opensecurityalliance.org/blog/spf-dkim-dmarc-email-authentication-guide Sat, 26 Sep 2026 11:22:59 GMT OSA Research Desk Email Security Email authentication is the cheapest defence against spoofing and a requirement for bulk senders. A step-by-step path from DMARC monitoring to full enforcement. https://opensecurityalliance.org/blog/vapt-vs-red-teaming https://opensecurityalliance.org/blog/vapt-vs-red-teaming Wed, 23 Sep 2026 11:22:59 GMT OSA Research Desk Offensive Security Vulnerability assessment, penetration testing and red teaming answer different questions. How to choose the right exercise for your maturity, budget and regulator. https://opensecurityalliance.org/blog/risk-based-vulnerability-management https://opensecurityalliance.org/blog/risk-based-vulnerability-management Sun, 20 Sep 2026 11:22:59 GMT OSA Research Desk Offensive Security Scanning is easy; reducing risk is hard. How to build a risk-based vulnerability management programme with clear ownership, SLAs and metrics leadership understands. https://opensecurityalliance.org/blog/soc-siem-use-cases-day-one https://opensecurityalliance.org/blog/soc-siem-use-cases-day-one Thu, 17 Sep 2026 11:22:59 GMT OSA Research Desk Security Operations A SIEM full of logs is not a SOC. The detection use cases to build first, the log sources they need, and how to keep alert quality high as you grow. https://opensecurityalliance.org/blog/virtual-ciso-vciso-when-it-makes-sense https://opensecurityalliance.org/blog/virtual-ciso-vciso-when-it-makes-sense Mon, 14 Sep 2026 11:23:00 GMT OSA Research Desk GRC Not every organisation needs a full-time CISO, but every organisation needs security leadership. When a virtual CISO fits, what to expect and how to measure success. https://opensecurityalliance.org/blog/security-awareness-training-that-works https://opensecurityalliance.org/blog/security-awareness-training-that-works Fri, 11 Sep 2026 11:23:00 GMT OSA Research Desk Security Awareness Annual click-through courses rarely change behaviour. How to design an awareness programme with role-based content, realistic simulations and meaningful metrics. https://opensecurityalliance.org/blog/governing-generative-ai-iso-42001 https://opensecurityalliance.org/blog/governing-generative-ai-iso-42001 Tue, 08 Sep 2026 11:23:00 GMT OSA Research Desk AI Security Generative AI adoption is outpacing policy. A practical governance model covering acceptable use, data protection, model risk and ISO/IEC 42001 alignment. https://opensecurityalliance.org/blog/third-party-risk-management-regulated-entities https://opensecurityalliance.org/blog/third-party-risk-management-regulated-entities Sat, 05 Sep 2026 11:23:00 GMT OSA Research Desk GRC Your vendors' weaknesses are your exposure. A risk-tiered third-party risk management process that satisfies regulators without drowning teams in questionnaires. https://opensecurityalliance.org/blog/pci-dss-v4-future-dated-requirements https://opensecurityalliance.org/blog/pci-dss-v4-future-dated-requirements Wed, 02 Sep 2026 11:23:01 GMT OSA Research Desk Compliance & Regulation The PCI DSS v4.0 requirements that were best practice until March 2025 are now mandatory. What changed, where organisations struggle and how to evidence compliance. https://opensecurityalliance.org/blog/regulator-ready-cybersecurity-audit-preparation https://opensecurityalliance.org/blog/regulator-ready-cybersecurity-audit-preparation Sun, 30 Aug 2026 11:23:01 GMT OSA Research Desk Audit & Assurance Regulatory cybersecurity audits test evidence, not intentions. A preparation plan covering scoping, evidence packs, interviews and closing findings on time.