The data sovereignty you bought survives exactly until the vendor is sold.
Hornetsecurity was chosen across the German mid-market for reasons that were entirely rational: German data centres, German law, a clear answer to the question every works council asks.
1/8
Most sovereignty requirements I see have none of those four. They have a vendor headquarters address and a comfortable feeling.
7/8
Worth checking this quarter, for any supplier where residency was a decision criterion: what in your contract still holds if that supplier is acquired next month?
#DataSovereignty #GDPR #VendorRisk #CISO #Procurement
8/8
By the time escalation is on the agenda, four of the five useful moments have passed.
Escalation is written down as a process: level one, level two, steering committee. What it actually is, is a relationship that either exists before it is needed or does not exist at all.
1/11
What separates organisations that catch it in moment one is not a better process.
It is whether the person who noticed believes that raising it early will be treated as diligence rather than as noise.
10/11
That belief is built long before the incident, by how the last five escalations were received.
Which of the five moments does your organisation actually catch?
#ProgrammeManagement #ServiceDelivery #Leadership #COO #RiskManagement
11/11
One thing I will not claim: that this is getting worse. The yearly share moves between 9 and 21 percent without direction. It is a level, not a trend, and anyone selling you a rising curve here is reading noise.
11/12
Pull the feed yourself, it is public and machine readable. What does your own edge patch cadence look like, honestly, compared to your servers?
#CyberSecurity #CISO #NetworkSecurity #RiskManagement #CISA
12/12









