assurance

The better question is whether the organisation can show how conflicts are identified, declared, challenged, escalated and evidenced before an external inquiry, regulator or media story exposes the gap.

The deeper lesson is that cyber risk maturity must be embedded into normal strategic, operational, supplier and technology assessments.

For boards and management teams, the deeper issue is not the technology headline. It is whether the organisation can clearly evidence how it understands its systems, suppliers, critical processes, data pathways, control environment and escalation triggers.