The ITSM Practice: Elevating ITSM and IT Security Knowledge

In this episode, Luigi Ferri compares two pillars of cloud security compliance: BSI C5 (Germany) and NIST SP 800-53 (USA). Discover how global banks can harmonize compliance, cut costs, and focus on real security over bureaucracy. Learn how ITSM and IT security teams can transform audit frameworks into governance tools that truly add value.In this episode, we answer to:How can global banks manage cloud compliance across BSI C5 and NIST SP 800-53 without duplicating effort?What are the key differences and overlaps between BSI C5 and NIST SP 800-53?Does compliance really improve security — or just increase documentation?Resources Mentioned in this Episode: German Federal Office for Information Security website, article "Criteria catalogue C5", link https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/kriterienkatalog-c5_node.html Securance website, article "What is BSI C5?", link https://audit-professionals.de/bsi-c5/ CyberSaint Security website, article "What is NIST SP 800-53?", link https://www.cybersaint.io/blog/what-is-nist-800-53 6 Clicks website, article "Comparison between NIST Cybersecurity Framework (CSF) and NIST SP 800-53", link https://www.6clicks.com/resources/comparisons/nist-cybersecurity-framework-csf-vs-nist-sp-800-53 Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

AI is transforming banking, but so are the rules. In this episode, Luigi Ferri explores how the Artificial Intelligence Control Matrix (AICM) helps financial institutions navigate complex compliance frameworks like ISO 42001, NIST AI RMF, and the EU AI Act, while staying secure and cost-efficient. Discover how to simplify AI governance, reduce audit fatigue, and protect your organization from model poisoning and adversarial risks.In this episode, we answer to:How can banks use AI while managing overlapping regulations and compliance frameworks?What new AI threats (like model poisoning and adversarial inputs) are traditional controls missing?How does the Artificial Intelligence Control Matrix (AICM) simplify compliance and strengthen AI security?Resources Mentioned in this Episode:Alphasec website, article "CSA AI Controls Matrix: A Sneak Preview", link https://alphasec.io/csa-ai-controls-matrix-a-sneak-preview/ Clarendon Partners website, whitepaper "AI Controls in Financial Services", link https://www.clarendonptrs.com/s/05_03_24_AI_Controls_in_Financial_Services_Clarendon_Partners_GRC_Ebook_Compressed.pdf Bank for International Settlements website, whitepaper "Regulating AI in the financial sector: recent developments and main challenges", link https://www.bis.org/fsi/publ/insights63.htm Cloud Security Alliance website, whitepaper "AICM mapping to NIST 600-1", link https://cloudsecurityalliance.org/artifacts/aicm-mapping-to-nist-600-1 Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover how Luigi Ferri explains how Process Mining in ITSM transforms service delivery by revealing real workflows hidden behind your dashboards. Learn how to eliminate bottlenecks, prevent SLA breaches, and align your Service Catalogue with reality. Turn ITSM data into actionable insights for compliance, automation, and continuous improvement.In this episode, we answer to:What’s the real difference between Process Mining and Task Mining in ITSM?How can Process Mining prevent SLA breaches and improve service performance?How does Process Mining enhance Service Catalogue accuracy and ensure compliance with ISO standards?Resources Mentioned in this Episode: Process Science website, article "Process Mining in IT services", link https://www.process-science.com/use-cases/it-servicesMindzie website, article "Top Benefits of Process Mining: Optimize, Analyze, Automate", link https://mindzie.com/process-mining-software/process-mining-benefits/Celonis website, article "5 Benefits of Using Process Mining for IT Service Management", link https://www.celonis.com/blog/5-benefits-of-using-process-mining-for-it-service-management/ Atlassian website, article "Process Mining Analyze and Optimize Jira Workflows and Processes", link https://community.atlassian.com/forums/App-Central-articles/Process-Mining-Analyze-and-Optimize-Jira-Workflows-and-Processes/ba-p/2768242 Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In this episode of The ITSM Practice, Luigi Ferri explores ISO/IEC 27001:2022 Control 5.3 – Segregation of Duties (SoD). Learn how to reduce risk, design accountability, and strengthen your ISMS with actionable SoD strategies, especially in ITIL 4 environments. Master RBAC, role clarity, and audit readiness to build trust into your IT processes by design.In this episode, we answer to:How does ISO 27001:2022 Control 5.3 define and implement Segregation of Duties?What are effective ways to apply RBAC and SoD in small or resource-limited teams?How can organizations monitor, log, and prove SoD compliance for audits?Resources Mentioned in this Episode:ISMS-Online, article "ISO 27001:2022 Annex A 5.3 – Segregation of duties", link https://de.isms.online/iso-27001/annex-a/5-3-segregation-of-duties-2022/ Morgan Hill website, template "ISO/IEC 27002:2022 | 5.3 - Segregation of Duties Policy Template", link https://morganhillcg.com/blog/item/iso-iec-27002-2022-5-3-segregation-of-duties-policy-template-2 HighTable, article "The Ultimate Guide to ISO 27001:2022 Clause 5.3: Organisational Roles, Responsibilities and Authorities", link https://hightable.io/iso-27001-clause-5-3-organisational-roles-responsibilities-and-authorities/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

The Value Management Office: Moving from Work to Worth. Is your IT team busy… but not sure if it’s delivering real value? In this episode, we uncover how a Value Management Office (VMO) helps organizations shift from tracking activity to measuring true business outcomes. Learn how ITIL 4, value stream mapping, and outcome-based metrics transform IT into a strategic value partner.Maximize value. Align strategy. Prove impact.In this episode, we answer to:What is a Value Management Office (VMO) and how does it differ from a PMO?How does ITIL 4 enable a modern, outcome-focused VMO?What value-based metrics should you track to align IT with business goals?Resources Mentioned in this Episode:Axelos / PeopleCert, article "The Service Management Office and ITIL 4", link https://www.axelos.com/resource-hub/blog/the-service-management-office-and-itil-4 ITSM Tools, article "ITIL 4 Service Value System (SVS) Explained: Guiding Principles, Practices, and Service Value Chain", link https://itsm.tools/the-itil-4-service-value-system-explained/ Simpliaxis, article "Four Dimensions of ITIL Service Management", link https://www.simpliaxis.com/resources/four-dimensions-of-itil-service-management Pink Elephant, guide "The IT Service Management Office", link https://www.pinkelephant.com/uploadedfiles/Resources/PinkPapers/The-IT-Service-Management-Office.pdf BMC, guide "VMO Vendor Management Office", link https://blogs.bmc.com/vmo-vendor-management-office/?print-posts=pdf ITSM Group, article "Value Stream Mapping", link https://www.itsmgroup.com/en/topics/value-stream-mapping Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover how ISO 31000 transforms risk from a compliance task into a shared decision-making mindset. In just 8 minutes, learn how to embed risk-aware thinking across IT, business continuity, cybersecurity, and operations—boosting confidence, clarity, and adaptability in every decision.In this episode, we answer to:What makes ISO 31000 different from other risk management standards?How can organizations embed risk thinking into daily decisions?How does ISO 31000 integrate with ISO 27005, ISO 22301, and ISO 31010?Resources Mentioned in this Episode:ISO 31000 Standard, link https://www.iso.org/standard/65694.htmlPirani, article "ISO 31000 Simplified: Elevate Your Risk Strategy", link https://www.piranirisk.com/blog/iso-31000 ISO, guide "ISO 31000 Risk Management", link https://thaiindustrialoffice.files.wordpress.com/2016/02/iso_31000_for_smes.pdf Global Suite, article "ISO 31000: The standard that helps you manage risks", link https://www.globalsuitesolutions.com/what-is-iso-31000-standard-and-what-is-its-purpose/ Ideagen, article "Principles of risk management explained", link https://www.ideagen.com/thought-leadership/blog/principles-of-risk-management-explained Advisera, article "What is ISO 31000?", link https://advisera.com/articles/what-is-iso-31000/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover how to align BIAN Service Domains with ITIL 4's Service Value System to transform your static CMDB into a dynamic capability governance model. Learn how to drive business value, enable composable architecture, and build accountability in IT services. A must-listen for anyone in Enterprise Service Management, IT Governance, or Banking IT Architecture.In this episode, we answer to:What is BIAN and how do Service Domains enable composable banking architecture?How can ITIL 4’s Service Value System enhance governance and ownership in IT?Why is capability-based ownership better than traditional CMDB tracking?Resources Mentioned in this Episode: BIAN Official Website, article "Service Landscape", link https://bian.org/deliverables/service-landscape/Fusion5, article "Life of BIAN", link https://www.fusion5.com/nz/integration-services/blogs/what-is-bianMamta Sarangal BIAN Chief Architect, article "The Role of Service Domain Specialization in Adopting BIAN - Banking Industry Reference Architecture.", link https://www.linkedin.com/pulse/role-service-domain-specialization-adopting-bian-banking-sarangal-xd35c/Sprintzeal, article "Service Value System in ITIL 4 Explained in Detail", link https://www.sprintzeal.com/blog/service-value-systemBIAN document "BIAN Semantic API Pactitioner Guide V8.1 Final", link https://bian.org/wp-content/uploads/2024/12/BIAN-Semantic-API-Pactitioner-Guide-V8.1-FINAL.pdfConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In Part 2 of this essential discussion, we move from theory to practice. You’ll learn how to integrate security into service management using frameworks like ITIL, practical change controls, and unified incident response plans.Discover the culture shift needed to make ITSM and security teams collaborate effectively. Learn how to embed security into change management workflows and why continuous improvement cycles are key to resilience in a fast-moving threat landscape.In this episode, we answer to:How can ITIL help integrate security into day-to-day operations?What strategies ensure successful collaboration between ITSM and cybersecurity?How do change management and incident response reduce security risks?Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

In Part 1 of this powerful two-part series, we break down the foundational link between IT Security and IT Service Management (ITSM). You'll discover how service management processes such as incident handling, asset visibility, and change control provide the essential structure that cybersecurity needs to succeed.IT Security is not a silo. It depends on the operational strength of ITSM to manage risk, respond to threats, and ensure compliance. Learn why neglecting ITSM weakens your entire security posture and what steps to take first.In this episode, we answer to:What is the fundamental relationship between IT Security and IT Service Management?Why is asset management critical to both cybersecurity and ITSM?What are the risks of managing IT security without service processes?Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Struggling to prove the value of your cybersecurity efforts? In this episode of The ITSM Practice, Luigi Ferri shows how to turn cybersecurity metrics into business assets. Learn why measuring outcomes—not just activities—can elevate security from cost center to competitive advantage.In this episode, we answer to:What should you measure to show cybersecurity effectiveness in business terms?How do ISO 27001 and NIST CSF influence security KPIs and KRIs?How can vendor risk be quantified using security ratings?Resources Mentioned in this Episode:Safe website, article "Aligning IT and Cybersecurity: The Missing Piece in Business Alignment", link https://safe.security/resources/blog/aligning-it-cybersecurity/ Microsoft Security website, article "Overview of critical asset management", link https://learn.microsoft.com/en-us/security-exposure-management/critical-asset-management Bitsight website, article "Third-Party Cyber Risk Assessments", link https://www.bitsight.com/glossary/third-party-cyber-risk-assessment ISMS.online website, article "How to Track ISO 27001 Milestones and Measure Success", link https://www.isms.online/iso-27001/how-to-track-iso-27001-milestones-and-measure-success/ ISACA Germany website, guideline "KPI Guide 2024", link https://www.isaca.de/images/Publikationen/Leitfaden/ISACA_KPI_Guide_2024.pdf HighTable website, article "ISO 27001 Monitoring, Measurement, Analysis, Evaluation: Clause 9.1", link https://hightable.io/iso-27001-clause-9-1-monitoring-measurement-analysis-evaluation-essential-guide/ Rikkeisoft website, article "Data-Driven Security: Transforming Protection Through Analytics", link https://rikkeisoft.com/th/blog-th/data-driven-security-transforming-protection-through-analytics/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Agentic AI is here, learning, deciding, and acting without human approval. But is your organization mature enough to secure it? In this episode, we explore how to align AI autonomy with tailored security controls using NIST maturity tiers and ISO frameworks.In this episode, we answer to:What makes agentic AI different from traditional automation?Why can’t existing controls fully secure autonomous systems?How should your AI security evolve with your maturity level?Resources Mentioned in this Episode:KOVRR website, article "Cybersecurity Maturity Model Implementation: A How-To Get Started Guide", link https://www.kovrr.com/blog-post/cybersecurity-maturity-model-implementation---a-how-to-get-started-guide Lindiwe Matlali, article "The Hidden Risks of Agentic AI: How Autonomous Systems Could Be Exploited and How to Defend Against Them", https://www.linkedin.com/pulse/hidden-risks-agentic-ai-how-autonomous-systems-could-defend-matlali-cekue Forbes, article "Overcoming Cybersecurity Challenges In Agentic AI". link https://www.forbes.com/sites/tonybradley/2025/03/26/overcoming-cybersecurity-challenges-in-agentic-ai/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover how to reduce call center costs without damaging customer trust. In this episode of The ITSM Practice, Luigi Ferri shares strategic insights on balancing automation, training, remote work, and compliance for long-term value. Make savings without losing meaning.In this episode, we answer to:How can organizations reduce call center costs without harming customer relationships?What are the hidden costs in call centers that leaders often overlook?Where should automation begin to improve service and efficiency?Resources Mentioned in this Episode:WOW24-7 website, article "How Much Does It Cost to Outsource Customer Service?", link https://wow24-7.com/blog/how-much-do-different-call-centers-cost-for-outsourcing-call-center-outsourcing-cost-comparison-2 Zoom website, article "What is call center compliance? Guide for 2025", link https://www.zoom.com/en/blog/call-center-compliance/ The Recruitment Co website, article "The Case for Remote Working in Contact Centre Workforces", link https://therecruitmentco.uk/the-case-for-remote-working-in-contact-centre-workforces/ KnowMax website, article "9 Actionable Tips for Call Center Cost Reduction", link https://knowmax.ai/blog/call-center-cost-reduction/ Kommunicate website, article "Putting the ‘Service’ in Self-Service: AI that Solves Problems", link https://www.kommunicate.io/blog/ai-self-service-for-customer-support/ Contact Point 3610 website, article "The Benefits of Speech Analytics in Improving Call Center Performance" link https://contactpoint360.com/blog/speech-analytics-for-contact-centers/ CX Today website, article "The Evolution of Generative AI Regulations: Preparing your Contact Center", link https://www.cxtoday.com/contact-center/the-evolution-of-generative-ai-regulations-preparing-your-contact-center-content-guru/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

A project that met every milestone, but left users unchanged. In this episode, we reveal why real success isn’t measured by delivery but by perception. Discover how top project leaders manage meaning, not just metrics.In this episode, we answer to:How do you define project success beyond KPIs and timelines?Why is stakeholder perception more important than status reports?What practical steps help uncover silent misalignment in projects?Resources Mentioned in this Episode:Project Management Institute, article "Managing Perceptions for Project Success: How Stakeholders Shape Reality", link https://www.pmi.org/blog/managing-perceptions-for-project-success Science Direct - Elsevier, article "Different stakeholder groups and their perceptions of project success", link https://www.sciencedirect.com/science/article/pii/S0263786313000276 IRMBR website, article "Relationship between Stakeholders Perceptions of Project Success and Project Planning", link https://irmbrjournal.com/paper_details.php?id=821 Institute Project Management, article "Strategic Narratives: Enhancing Project Management with Storytelling Techniques", link https://instituteprojectmanagement.com/blog/strategic-narratives-enhancing-project-management-with-storytelling-techniques/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover why shifting from traditional process maps to value stream mapping transforms ITSM. Luigi Ferri explains how VSM breaks silos, aligns IT with business value, and improves service visibility. Learn how to expose waste, measure impact, and build flow-focused culture in modern organizations.In this episode, we answer to:What is the difference between process maps and value stream mapping in ITSM?How does value stream thinking align IT services with business outcomes?What challenges do organizations face when adopting VSM, and how can they overcome them?Resources Mentioned in this Episode:Digicomp website, article "What is Value Stream Mapping?", link https://digicomp.ch/blog/2020/02/25/value-stream-mapping-in-itil-4 Luigi Ferri, article "Embracing the Shift: How Value Stream Mapping Enhances ITIL's Lifecycle Approach", link https://www.linkedin.com/pulse/embracing-shift-how-value-stream-mapping-enhances-itils-luigi-ferri Serview website, article "Breaking down silos: Value Streams in ITIL® 4", link https://en.serview.de/blog/blast-silos-value-troughs-in-itilr-4 Digital AI website, article "SAFe® Value Stream Mapping Software", link https://digital.ai/solutions/safe-scaled-agile-framework/ Lean Enterprise Institute, article "Value Stream Mapping", link https://www.lean.org/lexicon-terms/value-stream-mapping/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover why post-quantum cryptography is urgent for regulated industries. Learn how to protect long-term data, start cryptographic inventory, and align with evolving national strategies. This episode offers a clear, actionable roadmap for future-proofing your digital identity and systems.In this episode, we answer to:How can organizations start preparing for post-quantum cryptography migration?What risks are already present due to “Harvest Now, Decrypt Later” tactics?Why must regulated industries prioritize public key infrastructure upgrades now?Resources Mentioned in this Episode:Quintessence Labs website, article "Global Risk Institute Quantum Threat Timeline Report 2024", link https://info.quintessencelabs.com/hubfs/PDFs/Global-Risk-Institute-Quantum-Threat-Timeline-Report-2024.pdf Appviewx website, article "The UK’s National Cyber Security Centre Presents Timeline and Roadmap for PQC Migration", link https://www.appviewx.com/blogs/the-uks-national-cyber-security-centre-presents-timeline-and-roadmap-for-pqc-migration/ CISA website, article "CISA Insight Post Quantum Cryptography", link https://www.cisa.gov/sites/default/files/publications/cisa_insight_post_quantum_cryptography_508.pdf Pqshield website, article "NCSC guidance on planning your PQC migration", link https://pqshield.com/ncsc-guidance-on-planning-your-pqc-migration/ Crypto Vision Website, article "EVIDEN PQC Migration Guide", link https://www.cryptovision.com/wp-content/uploads/2023/05/EVIDEN-PQC-Migration-Guide.pdf Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Confusing a security strategy with a strategic plan leads to failure. In this episode, Luigi Ferri breaks down the core differences, revealing seven pillars of a winning security strategy, from governance and threat intelligence to resilience. Learn how to shift from vague intentions to real impact.In this episode, we answer to:What is the difference between a security strategy and a strategic plan?What are the seven essential elements of a credible security strategy?How do you move from vision to measurable execution in cybersecurity?Resources Mentioned in this Episode:iSHIFT website, article "Cybersecurity 101: A Plan is Not a Strategy, and a Strategy is Not a Plan", link https://www.ishift.net/cybersecurity-strategy-and-plan/ Diceus website, article "IT security strategy: Essentials you should know to create an effective plan", link https://diceus.com/it-security-strategy-plan/ Atriade website, article "The 7 Elements of an Effective Security Plan", link https://atriade.com/seven-elements-of-physical-security-plan/ QTech website, article "The 7 Key Components of a Robust Cybersecurity Strategy", link https://www.q-tech.org/the-7-key-components-of-a-robust-cybersecurity-strategy/ Pathlock website, article "Continuous Monitoring: What You Need to Know and How to Start in 5 Steps", link https://pathlock.com/learn/continuous-monitoring/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Agentic AI is redefining IT Service Management with autonomous decision-making, intelligent workflow orchestration, and continuous learning. In this episode, we explore how AI transforms service desks into predictive ecosystems, boosts performance, and challenges organizational readiness, ethics, and governance.In this episode, we answer to:What makes Agentic AI different from traditional automation in ITSM?How can organizations govern AI decisions in service management?Are your ITSM processes ready to be trusted by autonomous systems?Resources Mentioned in this Episode:Forrester website, article "Let The Service Management Agentic AI Race Begin", link https://www.forrester.com/blogs/let-the-service-management-agentic-ai-race-begin/ Aisera website, article "Agentic AI in IT Service Management (ITSM)", link https://aisera.com/blog/agentic-ai-itsm/ Rezolve.ai website, article "Why Agentic AI Tools Are the Future of Incident and Service Requests?", link https://www.rezolve.ai/blog/agentic-ai-incident-and-service-requests Sprinklr website, article "The AI-first unified platform for front-office teams", link https://www.sprinklr.com/blog/agentic-ai/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Outsourced development is growing, but ISO 27001 Annex A 8.30 ensures you don’t outsource control. In this episode, we explain how to secure external software development, from vendor audits to contract clauses and compliance risks. Learn practical steps to protect your business.In this episode, we answer to:How can ISO 27001 Annex A 8.30 secure outsourced development?What security questions should you ask every software vendor?How do you turn contracts into enforceable cybersecurity controls?Resources Mentioned in this Episode: HighTable, article "ISO 27001 Annex A 8.30 Outsourced Development", link https://hightable.io/iso27001-annex-a-8-30-outsourced-development/ ISMS.online website, article "ISO 27001:2022 Annex A 8.30 – Outsourced Development", link https://www.isms.online/iso-27001/annex-a/8-30-outsourced-development-2022/ ISMS.online website, article "ISO 27002:2022 – Control 8.30 – Outsourced Development", link https://www.isms.online/iso-27002/control-8-30-outsourced-development/ GRC Mana website, article "ISO 27001 Annex A 8.30: A Step-by-Step Guide", link https://www.grcmana.io/blog/iso-27001-annex-a-8-30-outsourced-development Advisera website, article "Big guide to ISO 27001 clauses — How is this standard structured?", link https://advisera.com/iso27001/control-8-30-outsourced-development/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover how Enterprise Architecture in healthcare helps government hospitals improve patient safety, system resilience, and operational efficiency. Learn the five EA pillars driving digital transformation, compliance, and innovation—critical for Managed Service Providers too.In this episode, we answer to:How can Enterprise Architecture reduce IT outages in hospitals?What risks do Managed Service Providers face without solid architecture?How does EA help align IT with national healthcare goals?Resources Mentioned in this Episode:Sparx Systems website, article "The Case for Enterprise Architecture in the Government", link https://trerado.sparxsystems.com/resources/eaglobalsummit-2024/the-case-for-enterprise-architecture-in-the-government/ SCW website, article "How Enterprise Architecture plays a vital role in navigating the NHS’s future", link https://scwcsu.nhs.uk/news-and-views/blog/how-enterprise-architecture-plays-a-vital-role-in-navigating-the-nhs-s-future iTrobes website, article "ERP For Hospitals – A Complete Guide", link https://www.itrobes.com/hospital-management-erp-software/ SAP website, article "Enterprise Architecture Maturity Models & Assessment", link https://www.leanix.net/en/wiki/ea/enterprise-architecture-maturity-stages-and-assessment Confiz website, article "Building service excellence: 6 pillars of Managed Services Framework", link https://www.confiz.com/blog/building-service-excellence-6-pillars-of-managed-services-framework/ Ardoq website, article "What Is Enterprise Security Architecture? The Complete Guide to More Holistic Risk Management", link https://www.ardoq.com/knowledge-hub/enterprise-security-architecture ValueBlue website, article "Top 10 Benefits of Enterprise Architecture for Your Business", link https://www.valueblue.com/blog/top-10-benefits-of-enterprise-architecture-for-your-business Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya

Discover how PCI DSS can become more than just a compliance checklist. This episode explores PCI DSS as a strategic tool to build digital trust, prevent fraud, and unify your security approach. Learn why treating it as a living framework, not a box-ticking task—can transform your security posture.In this episode, we answer to:What are the core PCI DSS requirements most organizations fail to meet?Why should PCI DSS be treated as a continuous strategy, not a one-time audit?Who is actually in scope for PCI DSS, and why does size not exempt you?Resources Mentioned in this Episode:TechTarget website, article "What is PCI DSS (Payment Card Industry Data Security Standard)?", link https://www.techtarget.com/searchsecurity/definition/PCI-DSS-Payment-Card-Industry-Data-Security-Standard Stripe website, article "What is PCI DSS compliance?", link https://stripe.com/guides/pci-compliance Bridewell website, article "Who Needs to Be PCI DSS Compliant?" link https://www.bridewell.com/insights/blogs/detail/who-needs-to-be-pci-dss-compliant AuditBoard website, article "The 12 PCI DSS Compliance Requirements: What You Need to Know", link https://www.auditboard.com/blog/pci-dss-requirements/ Exabeam website, article "What Is PCI Compliance? The 12 Requirements", link https://www.exabeam.com/explainers/pci-compliance/pci-compliance-a-quick-guide/ Sprinto website, article "Who Must Comply with PCI DSS? Payment Security Explained", link https://sprinto.com/blog/to-whom-does-pci-dss-apply/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya