InfoSec Insider

By URM ConsultingBusiness Technology Management

InfoSec Insider episodes

November 05Business Continuity Planning: 5 Essential Actions to Strengthen Organisational Resilience
In this episode of InfoSec Insider podcast, Lisa Dargan, CEO at URM is joined by Phil Knight, Senior Consultant at URM, to discuss the five essential actions organisations should take to improve resilience, strengthen recovery capabilities, and prepare for disruption. Drawing on real-world experience gained from supporting organisations across a wide range of sectors, Phil shares practical advice for building an effective and sustainable business continuity programme.
Phil and Lisa discuss:
Why conducting a robust Business Impact Analysis (BIA) is the foundation of effective business continuity planning.
The importance of awareness, training, and ensuring employees understand their role during a disruption.
How to establish a practical recovery and response approach that goes beyond simply creating a business continuity plan.
Why communication planning is critical and how poor communication can undermine even well-designed recovery arrangements.
The value of exercising business continuity arrangements and using realistic simulations to identify gaps before a real incident occurs.
How organisations can strengthen resilience by managing critical suppliers and third parties more effectively.
Common mistakes organisations make when developing business continuity plans and how to avoid them.
And more.
Whether you're responsible for business continuity, risk management, operational resilience, information security, compliance, or organisational governance, this episode provides practical guidance to help you improve preparedness, respond more effectively to disruption, and build long-term resilience across your organisation
This episode was based on our webinar, 5 Business Continuity Must‑Dos to Strengthen Your Organisation’s Resilience. If you'd like to watch more of our webinars or find out about upcoming events, please visit https://urmconsulting.com/events
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts           
Brought to you by URM, the UK’s leading information and cyber security specialists.       
39 min
October 29How to Manage DSARs and Other Data Subject Rights Efficiently
In this episode of InfoSec Insider Rachel Salter and Amy Brown, both data protection consultants at URM, discuss the challenges organisations face when dealing with DSARs, the most common pitfalls that lead to compliance issues, and the practical steps organisations can take to respond effectively.
Rachel and Amy discuss:
Why DSARs should be viewed as an opportunity for organisational learning, not just a compliance burden.
The challenges of managing requests involving large volumes of emails, documents, HR records and collaboration platforms.
Retention schedules, data minimisation, and how poor record management can significantly increase DSAR complexity.
The full range of data subject rights, including access, rectification, erasure, and objection to processing.
And more
Whether you're responsible for data protection, compliance, HR, information governance or operational management, this episode provides practical guidance to help you reduce risk, improve efficiency and build a more mature approach to handling data subject rights requests.

This episode was based on our webinar, Managing DSARs and Other Data Subject Rights. If you'd like to watch more of our webinars or find out about upcoming events, please visit https://urmconsulting.com/events           
Brought to you by URM, the UK’s leading information and cyber security specialists.       
53 min
October 22ISO 27001 Risk Management Explained: Practical Strategies for Better Security
In this episode of InfoSec Insider Wayne Armstrong, Senior Information Security Consultant at URM, and Lisa Dargan, CEO at URM, discuss how organisations can gain greater value from their ISO 27001 risk management processes. Moving beyond compliance and certification, Wayne and Lisa explore how effective risk management can become a genuine business enabler, supporting informed decision-making, business growth, and continual improvement. They discuss:
The mandatory ISO 27001 risk management requirements, including risk assessment, risk treatment, risk acceptance criteria, and documented information requirements.
How to align information security risk management with business objectives, helping organisations support growth opportunities while managing risk effectively.
Practical approaches to identifying and prioritising critical information assets based on confidentiality, integrity, and availability requirements.
Why transparency, inclusivity, and organisation-wide participation are essential for accurate risk assessments and successful risk ownership.
The growing importance of threat intelligence, third-party risk management, and maintaining a dynamic risk management process that adapts to a changing threat landscape.
Common risk management pitfalls, including risk aggregation, control-driven risk creation, and static assumptions about organisational context, together with practical advice on how to avoid them.
Whether you are implementing ISO 27001 for the first time or looking to mature an existing ISMS, this episode provides practical guidance on transforming risk management from a compliance exercise into a valuable tool for improving business resilience and information security performance.

This episode was based on our webinar, Getting More from ISO 27001 Risk Management. If you'd like to watch more of our webinars or find out about upcoming events, please visit  https://urmconsulting.com/events
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts       
Brought to you by URM, the UK’s leading information and cyber security specialists.       
53 min
October 15Common Nonconformities in Clauses 4,5,6 of ISO 27001
In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, discuss some of the most common nonconformities they encounter when auditing organisations against the management system requirements of ISO 27001, focusing on Clauses 4, 5 and 6. Drawing upon their auditing and consultancy experience, they provide practical guidance on common mistakes and how organisations can strengthen their approach.
George Ryan and Jack Woods discuss:
Common issues relating to Clause 4, including keeping internal and external issues up to date, considering climate change, correctly identifying the needs and expectations of interested parties, and understanding how ISMS processes interact.
Why leadership involvement and commitment are critical to meeting Clause 5 requirements, from aligning information security objectives with wider business objectives to ensuring information security policies are appropriately approved and endorsed by top management.
Common pitfalls under Clause 6, including risk assessments without a clearly defined methodology, objectives that are not measurable or time-bound, and the importance of producing valid, comparable and repeatable risk assessment results.
How organisations can avoid problems with their Statement of Applicability, including weak justifications for excluding Annex A controls and assumptions that physical or development-related controls do not apply to their organisation.
Why changes to the ISMS need to be properly planned and recorded, and how overlooking business and organisational changes, rather than simply technical changes, can lead to nonconformities.
And more.

If there's a GRC or cyber security related issue you'd like us to explore, share it with us here here: https://urmconsulting.com/podcasts/common-nonconformities-in-clauses-4-5-and-6-of-iso-27001

We use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to organisations like yours.
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts          
Brought to you by URM, the UK’s leading information and cyber security specialists.       
28 min
October 08Building Your Cyber Resilience
In this episode of InfoSec Insider – Talk Cyber, Wayne Armstrong, Senior Consultant at URM, and Mike Emery, Senior Security Consultant at URM, explore how organisations can build greater cyber resilience in the face of an increasingly sophisticated threat landscape. Drawing on practical experience, they examine where organisations are most vulnerable and discuss the steps businesses can take to strengthen their defences and prepare for cyber incidents.
The episode explores:
Today’s cyber threat landscape and common organisational weaknesses, including phishing, impersonation and spoofing, malware and ransomware, as well as the risks created by human error, poor access management, unpatched systems and third-party suppliers.
Practical approaches to strengthening cyber resilience, from understanding and assessing information assets and cyber risks to improving security awareness, access controls, supplier management, vulnerability management and layered technical protection.
How to prepare for and respond effectively to cyber incidents, including developing and testing incident response plans, maintaining effective communications, protecting business continuity and considering the often-overlooked human impact of a cyber breach.
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts
Brought to you by URM, the UK’s leading information and cyber security specialists.     
56 min
October 01Successful Business Continuity Exercises: From Planning to Practice
In this episode of InfoSec Insider – Talk BC, Phil Knight, Senior Consultant at URM, explores the different types of business continuity exercises organisations can undertake and what makes an exercise genuinely effective. Drawing on his extensive experience supporting organisations with business continuity and resilience, Phil discusses:
The different types of business continuity exercises, from walkthroughs and tabletop exercises to simulations and full-scale exercises
How to choose the right type of exercise based on your organisation’s needs, objectives and available resources
The importance of realistic scenarios, careful planning and securing stakeholder buy-in
The role of effective facilitation in keeping participants engaged and ensuring exercises deliver meaningful results
How to capture lessons learned and turn the outcomes of an exercise into practical improvements to business continuity arrangements
Phil also shares real-world examples of business continuity exercises, demonstrating how realistic testing can uncover gaps that may otherwise remain hidden until a genuine disruption occurs.
Have a question about business continuity?
Submit your question using the link below or leave it in the comments, and we may answer it in a future episode of InfoSec Insider – Talk BC.
Please use the form here: https://urmconsulting.com/podcasts/successful-business-continuity-exercises-from-planning-to-practice
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts
Brought to you by URM, the UK’s leading information and cyber security specialists.       
50 min
September 24The Lawful Basis Minefield: Why Getting It Wrong Undermines Everything
In this episode of InfoSec Insider – Talk DP, Aimee Brown and Rachael Salter, both Consultants at URM, explore lawful basis under the General Data Protection Regulation (GDPR), why choosing the right basis is fundamental to compliant processing, and some of the common mistakes organisations make in practice. Aimee and Rachael discuss:
Why identifying the correct lawful basis is fundamental to GDPR compliance
Why organisations so often misuse consent and how to determine whether it is appropriate
How legitimate interests, legal obligation, public task and vital interests apply in practice
What changes when processing special category personal data
The most common lawful basis mistakes and how organisations can avoid them.

Your questions matter
If there’s a data protection or GDPR issue you’d like us to explore, share it with us: https://urmconsulting.com/podcasts/the-lawful-basis-minefield-why-getting-it-wrong-undermines-everything
We’ll use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to businesses like yours.
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts           

Brought to you by URM, the UK’s leading information and cyber security specialists.       
41 min
September 17Cyber Security Training, Awareness and Benefits of Tailored Training
In this episode of InfoSec Insider, George Ryan and Jack Woods, both Consultants at URM, provide practical advice on how organisations can improve cyber security training and awareness, and why tailoring training to specific roles, responsibilities and risks can help build a stronger security culture. George Ryan and Jack Woods draw upon their experience of helping organisations strengthen their information security to discuss:
The difference between cyber security training, awareness and competence, and why organisations should understand the distinction
Why a one-size-fits-all approach to cyber security training may provide a useful baseline, but often fails to address the different risks faced by specific roles, teams and sectors
How tailored training can make cyber security more relevant to employees, encourage behavioural change and help organisations develop a stronger security culture
How the growing use of AI is creating new security risks and training requirements, as well as new opportunities to make cyber security awareness more effective
And more.

If there's a GRC or cyber security related issue you'd like us to explore, share it with us here here: https://urmconsulting.com/podcasts/cyber-security-training-awareness-and-benefits-of-tailored-training

We use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to organisations like yours.
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts        
Brought to you by URM, the UK’s leading information and cyber security specialists.       
31 min
September 10PCI DSS Compensating Controls vs. Customized Approach
In this episode of InfoSec Insider, Alastair Stewart and Tibor Laczko, both Senior Consultants and Qualified Security Assessors (QSAs) with URM, examine one of the most frequently misunderstood areas of PCI DSS: the difference between compensating controls and the customised approach. Drawing on their extensive PCI DSS assessment experience, they discuss:
The key differences between compensating controls and customised approaches, and the specific scenarios where each can be used
Why compensating controls are not a “get out of jail free” card for non-compliance and the strict conditions that must be met before they can be applied
The legal, regulatory, technical, and financial constraints that may justify the use of compensating controls
How customised approaches were introduced in PCI DSS v4.0 to support innovative and non-traditional methods of meeting security objectives
Why customised validations require significant planning, documentation, evidence collection, and assessor involvement before they can be approved
And more.

If there's a PCI DSS related issue you'd like us to explore, share it with us here here: https://urmconsulting.com/podcasts/pci-dss-compensating-controls-vs-customized-approach
We use listener questions to guide future discussions and ensure our episodes tackle the challenges that matter most to organisations like yours.

You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts    
    
Brought to you by URM, the UK’s leading information and cyber security specialists.       
32 min
September 03Benefits of Business Continuity Exercising
InfoSec Insider Podcast - Season 3, Episode 1 (101)
Benefits of Business Continuity Exercising
In this episode of InfoSec Insider – Talk BC, Phil Knight, Senior Consultant at URM, explores exercising of business continuity plans, and the benefits this can provide to organisations. Phil draws upon his extensive experience supporting organisations to strengthen their business continuity arrangements and resilience to discuss:
What business continuity exercising is
ISO 22301 (the best practice standard for BC management), the business continuity lifecycle and where exercising fits into these
The benefits that exercising can provide to organisations
The consequences or costs of not performing exercises.
Learn more about this topic: https://www.urmconsulting.com/blog/business-continuity-exercising
5 Business Continuity Must‑Dos to Strengthen Your Organisation’s Resilience webinar: https://www.urmconsulting.com/event/5-business-continuity-must-dos-to-strengthen-your-organisations-resilience
You can find more episodes of InfoSec Insider here: https://urmconsulting.com/podcasts          
Brought to you by URM, the UK’s leading information and cyber security specialists.       
41 min

About InfoSec Insider

From the publisher's feed

The InfoSec Insider podcast brings you weekly interviews with practicing senior consultants, who draw upon their extensive experience to provide detailed and practical guidance on all things…

Share InfoSec Insider

Sign up to save your podcasts

InfoSec Insider

InfoSec Insider episodes

About InfoSec Insider