Introduction This is the very first article from a series of articles that will be merged with the existing SDLC Process “From Idea to Proof of Concept to MVP” previously written, finally to be rewritten in an AI-Native SDLC. What is an “AI-Native” organization? “AI-Native” describes an organization that has restructured how it works […]
I wrote here about the CRA and the deployment plan: https://www.sorinmustaca.com/eu-cyber-resilience-act-cra-overview/ We are past September 11th and the Art. 14 of CRA is applying. Who is affected? Is a a company from a non EU country, which sells software globally affected by the CRA Art. 14? Any company is affected if the software is made […]
Intro I talk a lot about AI these days… and I know I am not alone. People talk a lot about “agentic AI” or “AI Agents” or simply “Agents”. During these discussions, I see there is confusion sometimes what is an Agent and what’s the difference between “AI” and “AI Agents”. Here’s the core distinction, […]
The Data Protection catalog is the shortest of the three in ISA 6.0.3 and the one most often underestimated. Twelve control questions across eight subchapters, all numbered under chapter 9. Compared to the roughly sixty questions in Information Security, it looks like an afterthought. It isn’t. It is the part of the assessment where an […]
Software Delivered the Same Way Every Time Before security enters the picture, SDLC exists to solve a simpler problem: making software delivery repeatable. A team that builds features ad hoc, without a defined sequence of requirements, design, coding, testing, and release, ends up with wildly inconsistent outcomes — some releases solid, others full of regressions, […]
I wrote some time ago about “How to create security user stories” and I received in the meanwhile a lot of good feedback and questions about it. For these reasons, I decided that it is time to write again on the topic, this time with focus on two importat groups in any software developer team: […]
This is the part 5 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 5) — Information Security Sheet: Supplier Relationships, Compliance Chapter 6 — Supplier Relationships This chapter addresses how the organization manages information security risks arising […]
This is the part 4 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 4) — Information Security Sheet: IT Security / Cyber Security Chapter 5 — IT Security / Cyber Security This is the largest chapter in the Information […]
This is the part 3 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 3) — Information Security Sheet: Human Resources, Physical Security, Identity and Access Management Chapter 2 — Human Resources This chapter addresses the people dimension of […]
This is the part 2 of the series about the TISAX label: TISAX getting started: A Deep Dive into the ISA Assessment Workbook (part 1). ISA VDA 6.0.3 (part 2) — Information Security Sheet: IS Policies and Organization Chapter 1 — IS Policies and Organization This chapter establishes the governance foundation of the […]
You must be logged in to post a comment.