Posts on financial services

Third-party cyber risk is the chance a supplier causes you a security incident. Manage it by tiering suppliers, setting requirements, contracting and checking.

DORA reaches UK tech suppliers through EU bank contracts: mandatory clauses, register data, an LEI, subcontracting controls and, for a few, direct EU oversight.

Fintechs use AI for fraud detection, alert triage and automation and attackers use it against them. What the FCA expects and the controls that actually reduce risk.

NIS2, DORA, NIST CSF 2.0 and CIS Controls v8.1 are often treated as rivals. In practice they answer different questions. A mapping guide for UK financial services firms.

How financial services firms can secure machine learning: data privacy, model attacks, explainability and monitoring controls.