GRC Case Studies

A 3-part series on the Digital Operational Resilience Act. Articles 1 and 2 are live — what DORA is, why it matters more than most institutions realise, and what the first year of enforcement is already revealing.

MediaTech acquires YourNews, whose IT is fully outsourced to an MSP. Three-phase GRC integration covering due diligence, Day 1 readiness, and full integration.

A risk that passed through every review gate and was never escalated — structural gaps in risk identification, assessment, and ownership on a peak-season platform.

Governance challenges when deploying large language models at enterprise scale — accountability, transparency, and risk oversight.

Managing software supply chain risk in a hospital environment — SBOM implementation, vendor risk, and regulatory compliance.

Data isolation failures in a shared cloud environment — tenant separation, token scoping, and governance in IaaS architecture.

One urgent message. One fake domain. One new employee under pressure. The breach started with trust and escalated through weak identity governance.

Credentials stayed valid. Privilege stayed high. Monitoring stayed blind. A logic bomb WORM planted by a departing admin — the organisation logged everything but never connected the dots.

Cross-border data transfer: EU collection, non-EU storage and processing, and the compliance guardrails that apply under GDPR.

One of the largest data breaches in history — governance failures, patch management breakdown, and systemic risk management gaps. 147 million records. 78 days undetected.

A third-party invoice platform was compromised, vendor bank details were changed, and approved payments were redirected. Segregation of duties was never enforced.

An internal server with no internet access, compromised via a departed employee's account still active five months post-exit. The identity was gone. The system still trusted it.

Third-party risk and compliance in pharmaceutical supply chains — vendor governance, regulatory exposure, and continuity planning.

20 years of PII, bulk API exposure, UI-only masking, GDPR remanence, and dark web listing. A data governance failure explored across multiple solution approaches.