The ITSM Practice: Elevating ITSM and IT Security Knowledge

Avsnitt

• 
  ISO 28000: Your Resilience, Their Budget 28.07.2026 13min

  In this episode of the ITSM Practice Podcast, Luigi Ferri explores why supply chain resilience has become one of the biggest strategic challenges for Government Managed Service Providers (MSPs). Using practical examples from healthcare and public services, he explains how ISO 28000 shifts the conversation from protecting internal systems to managing the security and resilience of the organizations you depend on. Discover why supplier failures, inherited risk, and third-party dependencies are becoming the greatest threats to service continuity, cybersecurity, and operational resilience in government and regulated industries.In this episode, we answer:Why is ISO 28000 becoming essential for Government Managed Service Providers and supply chain resilience?How can third-party suppliers and subcontractors become the weakest link in your cybersecurity and operational resilience strategy?Why should CISOs focus on inherited risk and supplier dependencies rather than only internal security controls?Resources Mentioned in this Episode: The Standards Institution of Israel website, article "SI ISO 28000 :2022 Specification for security management systems for the supply chain", link https://www.sii.org.il/en/iso-28000ANSI website, article "What Is ISO 28000?", link https://blog.ansi.org/anab/what-is-iso-28000/ Wikipedia website, article "ISO 28000", link https://en.wikipedia.org/wiki/ISO/PAS_28000 NIST website, publication "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations", link https://csrc.nist.rip/Pubs/sp/800/161/r1/2PDSITS website, article "NIS2, DORA & Co: Aren’t we all part of someone’s relevant supply chain?", link https://sits.com/en/blog/nis2-dora-supply-chain/ UK Government website, notice "Research on cyber security in supplier management and procurement", link https://www.gov.uk/government/publications/research-on-cyber-security-in-supplier-management-and-procurement Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  No SBOM, No Trust 21.07.2026 19min

  Discover why the Software Bill of Materials (SBOM) is rapidly becoming a strategic necessity for Managed Service Providers (MSPs) and enterprise IT leaders. In this episode, Luigi Ferri explains how software supply chain attacks such as Log4Shell and SolarWinds transformed SBOMs from technical documentation into essential tools for IT governance, cyber resilience, software supply chain security, and operational trust. Learn the four stages of SBOM maturity and how MSPs can strengthen transparency, improve vulnerability management, and build competitive advantage through continuous software dependency visibility.In this episode, we answer to:Why are Software Bill of Materials (SBOMs) becoming essential for Managed Service Providers (MSPs)?How can MSPs improve software supply chain security and gain complete visibility over software dependencies?What are the four stages of SBOM maturity that help organizations strengthen governance, resilience, and operational trust?Resources Mentioned in this Episode:US NTIA - National Telecommunications and Information Administration website, article "Software Bill of Materials", link https://www.ntia.gov/page/software-bill-materialsUS NTIA - National Telecommunications and Information Administration website, white paper "Software Consumers Playbook: SBOM Acquisition, Management, and Use", link https://www.ntia.gov/sites/default/files/publications/software_consumers_sbom_acquisition_management_and_use_-_final_0.pdfUS NIST website, Executive Order 14028 "Improving the Nation's Cybersecurity: NIST’s Responsibilities Under the May 2021 Executive Order", link https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurityUS NTIA - National Telecommunications and Information Administration website, link Carnegy Mellon University - Software Engineering Institute, article "The SEI SBOM Framework: Informing Third-Party Software Management in Your Supply Chain", link https://www.sei.cmu.edu/blog/the-sei-sbom-framework-informing-third-party-software-management-in-your-supply-chain/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  PSD3: Who Owns Trust? 14.07.2026 6min

  PSD3 is more than a compliance requirement, it's a test of organisational maturity, security leadership, accountability, and decision-making. Discover how Enterprise Service Management, IT Service Management, and cybersecurity principles help organisations balance security, customer trust, and clear ownership to build resilience beyond regulatory compliance.In this episode, we answer:How does PSD3 reveal an organisation's maturity and decision-making under pressure?When should security lead, and when should it step back to enable business ownership?Who is truly accountable for trust, fraud prevention, and customer protection under PSD3?Resources Mentioned in this Episode:Stripe website, article "What platforms and marketplaces can expect from PSD3", link https://stripe.com/guides/what-platforms-and-marketplaces-can-expect-from-psd3 Deloitte Luxembourg website, article "Shedding light on PSD3/PSR", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/perspectives/shedding-light-on-psd3-psr.html European Payments Council website, article "What do the PSD3 and PSR mean for the payments sector?", link https://www.europeanpaymentscouncil.eu/news-insights/insight/what-do-psd3-and-psr-mean-payments-sector Advapay website, article "PSD2 vs PSD3/PSR: what’s new in the upcoming EU’s Payment Services Directive and Regulations", link https://advapay.eu/psd2-vs-psd3-whats-new-in-the-upcoming-eus-3rd-payment-services-directive/ PWC Ireland website, article "PSD3: Shaping the future of secure, innovative payments", link https://www.pwc.ie/industries/banking/insights/payment-services-directive-3.html Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  The Hidden Cost of Untrusted Data 07.07.2026 11min

  Why do organizations struggle to trust their operational data despite having plenty of it? In this episode of The ITSM Practice Podcast, Luigi Ferri explains the critical difference between data quality and data integrity, and why CIOs must build operational trust before launching digital transformation initiatives. Learn practical ITSM strategies to improve data governance, CMDB accuracy, operational accountability, and Enterprise Service Management.In this episode, we answer to:What is the difference between data quality and data integrity, and why does it matter for CIOs?Why do multiple departments report different numbers for the same operational metric?How can organizations build trusted operational data before starting digital transformation?Resources Mentioned in this Episode:Precisely website, article "Data Integrity vs. Data Quality: How Are They Different?", link https://www.precisely.com/blog/data-integrity/data-integrity-vs-data-quality-different Atlan website, article "Data Quality vs Data Governance: How Are They Different in 2026?", link https://atlan.com/data-quality-vs-data-governance/ Salesforce website, article "Salesforce Signs Definitive Agreement to Acquire Informatica", link https://www.salesforce.com/news/press-releases/2025/05/27/salesforce-signs-definitive-agreement-to-acquire-informatica/ Qlik Support Portal, article "Validating data", link https://help.qlik.com/talend/en-US/studio-user-guide/8.0-R2024-12/validating-data Informatica website, white paper "Informatice Data Quality and Observability", link https://www.informatica.com/content/dam/informatica-com/en/collateral/data-sheet/cloud-data-quality_data-sheet_3688en.pdf Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  ITIL 5 Foundation: Exam Success 30.06.2026 10min

  Preparing for the ITIL 5 Foundation exam? Discover why successful candidates focus on understanding the ITIL Value System, Value Chain, Governance, AI Capability, Four Dimensions, and Service Lifecycles as one connected system instead of isolated chapters. Learn smarter study strategies to improve your exam performance and master ITIL 5 concepts.In this episode, we answer to:Why is the ITIL Value System the foundation for understanding the entire ITIL 5 framework?How does AI Capability depend on governance, knowledge management, and operating models?How can you study the ITIL 5 Foundation exam more effectively by focusing on system thinking instead of memorizing chapters?Resources Mentioned in this Episode:Mind Mesh Academy website, article "ITIL® Foundation (Version 5) Study Guide", link https://www.mindmeshacademy.com/certifications/itil/itil-5-foundation/study-guide PeopleCert website, article "ITIL Foundation (Version 5)", link https://www.peoplecert.org/browse-certifications/it-governance-and-service-management/ITIL-1/itil-5-foundation-version-50-4154 InProgress website, document name "Training Program - ITIL Foundation (Version 5)", link https://inprogressplus.com/wp-content/uploads/2026/05/Training-programme_ITIL5F_ENG_v2.0.pdf PeopleCert website, ITIL 5 Mock exams, link https://www.peoplecert.org/browse-mock-exams/it-governance-and-service-management/ITIL-1 1 World Training Official Channel YouTube Channel, video "Sample Paper | ITIL® Foundation Bridge (version 5)", link https://www.youtube.com/watch?v=-21MZIbPUDI Value Insights website, article "Are you ready to pass the ITIL® (Version 5) Foundation exam?", link https://www.valueinsights.ch/itil5-foundation-exam-quiz/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  PSD3: Governance Before Technology 23.06.2026 7min

  In this episode, Luigi Ferri explores why organisations often take the wrong first step when preparing for PSD3 compliance. Rather than rushing into new tools, fraud platforms, or transformation programmes, PSD3 readiness begins with observation. Learn how incident response, governance, decision authority, and organisational behaviour under uncertainty reveal the real gaps that PSD3 exposes. Discover why governance maturity and clear accountability are critical for building a resilient PSD3 strategy.In this episode, we answer to:Why is the first step towards PSD3 compliance so often the wrong one?How can incident response reveal governance gaps and decision-making weaknesses?What should organisations stabilise before launching PSD3 programmes, fraud initiatives, or policy transformations?Resources Mentioned in this Episode: Deloitte website, article "Shedding light on PSD3/PSR", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/perspectives/shedding-light-on-psd3-psr.html Schoenherr website, article "The EU's new Payments Services Package", link https://www.schoenherr.eu/content/the-eu-s-new-payments-services-package European Payments Council website, article "What do the PSD3 and PSR mean for the payments sector?", link https://www.europeanpaymentscouncil.eu/news-insights/insight/what-do-psd3-and-psr-mean-payments-sector MK Fintech Partners website, article "PSD3 is Here! How is it Different From Previous Directives?", link https://mkfintechpartners.com/2023/07/11/difference-psd1-psd2-and-psd3/ Finexer website, article "PSD3: All you need to know in 2025", link https://blog.finexer.com/psd3-all-you-need-to-know-in-2025/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  AI Security Strategy: Why Midmarket Organizations Get It Wrong 16.06.2026 13min

  Why do most AI security strategies fail in the midmarket? In this episode of The ITSM Practice Podcast, we explore why successful AI security is not about buying more AI tools but about building the right foundation first. Learn how identity management, telemetry quality, governance, and operational maturity determine AI security success. We discuss AI readiness, MSSP evolution, cybersecurity automation, SOC transformation, and practical AI security roadmaps for midmarket organizations. Discover why AI augments security teams rather than replacing them and how organizations can achieve sustainable cyber resilience through proper sequencing.In this Episode, we answer:Why do most AI security initiatives fail in midmarket organizations despite significant investments in AI-powered cybersecurity tools?How do identity management, telemetry quality, and governance impact AI security readiness and operational resilience?What should MSPs and MSSPs prioritize over the next 2–3 years to build effective AI security strategies and support midmarket clients?Resources Mentioned in this Episode:SailPoint website, ebook "Identity as the foundation: The modern zero trust blueprint for 2026", link https://www.sailpoint.com/identity-library/identity-security-essential-to-zero-trust-strategy Xage Security website, article "Zero Trust: A Proven Solution for the New AI Security Challenge", link https://xage.com/blog/zero-trust-proven-solution-for-the-new-ai-security-challenge/Checkpoint website, article "How AI Phishing Attacks Became A Threat in 2025", link https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-phishing/ai-phishing-attacks/ EC-Council website, article "The Rising Threat of AI-Powered Phishing: What it is, How to Detect it, and How to Prevent it", link https://www.eccu.edu/blog/ai-powered-phishing-detection-prevention/ Your Alaska Link TV YouTube Channel, video "Hackers use AI to boost cyber scams and attacks", link https://www.youtube.com/watch?v=hRJqRFj0kRQMicrosoft Mechanics YouTube Channel, video "AI with Zero Trust Security", link https://www.youtube.com/watch?v=OnlN-2Q5QsE Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  What DoDAF Can Teach Leaders About Architecture and Complexity 09.06.2026 11min

  Are modern enterprises losing control of their architecture? In this episode, Luigi Ferri explores why cloud adoption, outsourcing, SaaS expansion, and fragmented governance are creating hidden dependencies and increasing operational risk. Discover how the Department of Defense Architecture Framework (DoDAF) offers valuable lessons for improving architectural visibility, governance, resilience, and enterprise-wide coordination in today's complex digital ecosystems.In this episode, we answer to:Why are modern enterprises losing architectural ownership and visibility across complex digital ecosystems?How can the Department of Defense Architecture Framework (DoDAF) help organizations manage complexity, interoperability, and governance?Why do modern outages and operational failures increasingly result from undocumented dependencies and architectural blind spots rather than individual system failures?Resources Mentioned in this Episode:US DoDAF Official Documentation, Department of Defense Architecture Framework (DoDAF) Version 2.02, link https://dodcio.defense.gov/Library/DoD-Architecture-Framework/TOGAF® Enterprise Architecture Framework, TOGAF® Standard, link https://www.opengroup.org/togafNIST Cybersecurity Framework (CSF) 2.0, link https://www.nist.gov/cyberframeworkConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  Identity Is the New Perimeter 02.06.2026 10min

  AI is changing cybersecurity faster than most organizations can govern it. In this episode of The ITSM Practice Podcast, Luigi Ferri explores why identity has become the true enterprise perimeter. As organizations race to deploy Agentic AI, autonomous agents, cloud platforms, and APIs, many are building on identity governance models that were never designed for machine-scale decision-making. From Zero Trust Architecture and Identity & Access Management (IAM) to the lessons behind major breaches at MGM, Snowflake, and Uber, this episode examines a critical question: If enterprises struggled to govern human identities, how will they govern autonomous AI identities? Discover why AI governance without identity governance is impossible, why identity is evolving into the operational control plane of digital business, and what CIOs and CISOs must do before AI adoption outpaces organizational control.In this episode, we answer:Why is identity becoming the new perimeter in the age of AI?What risks emerge when autonomous agents operate without strong identity governance?How can organizations redesign trust before AI scales faster than governance?Resources Mentioned in this Episode: NIST website, Zero Trust Architecture (SP 800-207), link https://csrc.nist.gov/pubs/sp/800/207/final?NIST website, AI Risk Management Framework, link https://www.nist.gov/itl/ai-risk-management-frameworkEuropean Commission website, EU AI Act, link https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-aiDark Reading website, article "Okta Agent Involved in MGM Resorts Breach, Attackers Claim", link https://www.darkreading.com/application-security/okta-flaw-involved-mgm-resorts-breach-attackers-claimCyberark website, article "The MGM Resorts Attack: Initial Analysis", link https://www.cyberark.com/resources/blog/the-mgm-resorts-attack-initial-analysisBlackfog website, article "Showflake Data Breach Explained", link https://www.blackfog.com/snowflake-data-breach-explained-key-lessons/Cloud Security Alliance website, article "Unpacking the 2024 Snowflake Data Breach", link https://cloudsecurityalliance.org/blog/2025/05/07/unpacking-the-2024-snowflake-data-breachUSA CISA website, article "Iranian Government-Sponsored APT Actors Compromise Federal Network, Deploy Crypto Miner, Credential Harvester", link https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-320a?USA CISA website, advisory on MFA fatigue and modern identity attacks, link https://www.cisa.gov/news-events/alerts/2022/10/31/cisa-releases-guidance-phishing-resistant-and-numbers-matching-multifactor-authenticationConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  FINMA and ITIL 4: Building Resilient Swiss Banks 26.05.2026 9min

  FINMA Circular 2023/1 is transforming operational resilience from a compliance exercise into a strategic leadership priority for Swiss banks. In this episode, Luigi Ferri explains why ITIL 4 is far more than ITSM, it is a powerful enterprise operating model that connects governance, cybersecurity, risk management, supplier coordination, and business continuity to build truly resilient financial institutions.In this episode, we answer to:Why is operational resilience becoming the new license to operate for banks?How does ITIL 4 support FINMA resilience and cybersecurity requirements?What organizational silos are preventing true enterprise resilience?Resources Mentioned in this Episode: Finma website, Circular 2023/1 Operational risks and resilience for banks, link https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdfFinma website, article "FINMA publishes Circular “Operational risks and resilience – banks”, link https://www.finma.ch/en/news/2022/12/20221213-mm-anh-rs-op-risks/KPMG website, article "FINMA Circular 2023/1", link https://assets.kpmg.com/content/dam/kpmgsites/ch/pdf/finma-circular-2023.pdf.coredownload.inline.pdf InfoGuard website, article "FINMA Circular 2023/1 Checklist - Ready for a regulatory audit?", link https://www.infoguard.ch/hubfs/images/blog/24/InfoGuard-FINMA-Checkliste_EN.pdf Manage Engine website, article "The ITIL 4 Service Value System", link https://www.manageengine.com/products/service-desk/itsm/itil-4-service-value-system.html Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  Broken Transmission: Why Fintech Strategy Fails 19.05.2026 6min

  Broken Transmission: Why Agile Fintechs Miss Strategy | In this episode of The ITSM Practice Podcast, Luigi Ferri explains why fintech strategy execution fails despite Agile delivery, strong squads, and constant releases. Learn how fragmented ownership, poor prioritization, and disconnected KPIs create operational misalignment, reducing business outcomes and authorization rate performance.In this episode, we answer to:Why do Agile fintech teams fail to execute business strategy effectively?How does fragmented ownership impact authorization rate improvement initiatives?Why do operational priorities override strategic portfolio management in fintech organizations?Resources Mentioned in this Episode:Project Management Institute, whitepaper "The High Cost of Low Performance 2014", link https://www.pmi.org/-/media/pmi/documents/public/pdf/learning/thought-leadership/pulse/pulse-of-the-profession-2014.pdf University of Salford - Manchester, Abdallah M. Salameh, document "A Heterogeneous Approach to Agile Tailoring", link https://salford-repository.worktribe.com/OutputFile/1487893 Institute of Project Management website, article "The Emerging Importance of Benefits Realisation", link https://projectmanagement.ie/blog/the-emerging-importance-of-benefits-realisation/ McKinsey & Company website, article "Don’t cancel or coddle at-risk capital projects—challenge them", link https://www.mckinsey.com/capabilities/operations/our-insights/dont-cancel-or-coddle-at-risk-capital-projects-challenge-them Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  FINOS vs ISO 42001: What to Choose 12.05.2026 8min

  Fintech leaders: stop defaulting to ISO 42001. Discover how FINOS empowers you to design scalable, audit-ready AI governance before regulation forces your hand. Learn to align controls, reduce risk, and build governance by design—not by pressure.In this episode, we answer to:What makes FINOS a powerful alternative to ISO 42001?How can fintechs design governance before audits hit?Why does governance fail without alignment?Resources Mentioned in this Episode:FINOS website, article "AI Strategic initiative series: Building an AI Governance Framework - Key Takeaways from the NYC Workshop", link https://www.finos.org/blog/building-an-ai-governance-framework-key-takeaways-from-the-nyc-workshop FINOS website, article "FINOS AI Governance Framework v1.0 — Turning Drafts into Deployable Guardrails", link https://www.finos.org/blog/finos-ai-governance-framework-v1.0-turning-drafts-into-deployable-guardrails Air Governance website, article "A heuristic approach to identifying GenAI risks", link https://air-governance-framework.finos.org/heuristic-assessment.html Air Governance website, article "FINOS AI Governance Framework", link https://air-governance-framework.finos.org GitHub website, repo "finos/ai-governance-framework - Public", link https://github.com/finos/ai-governance-framework Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  Who Owns Cloud Security? 05.05.2026 9min

  A single question can expose a major cloud risk: who is responsible? This episode breaks down the cloud shared responsibility model, revealing how unclear ownership, misconfigurations, and weak governance lead to data breaches, and how ISO/IEC 27017 helps close the gaps.In this episode, we answer to:Who is really accountable for cloud security failures?Why do misconfigurations cause most cloud data breaches?How does ISO/IEC 27017 strengthen cloud security governance?Resources Mentioned in this Episode:ISO Standards website, standard ISO/IEC 27017:2015, link https://www.iso.org/standard/43757.htmlVanta website, article "The ultimate guide to ISO 27017", link https://www.vanta.com/collection/iso-27001/guide-to-iso-27017Microsoft website, article "ISO/IEC 27017:2015", link https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-iso-27017 Safeshield website, article "Why should SaaS companies comply with the ISO/IEC 27017 security standard for cloud service providers (CSP)", link https://www.safeshield.cloud/why-should-saas-companies-comply-with-the-iso-27017-security-standard-for-cloud-service-providers-csp NordLayer website, article "ISO 27017: cloud protection essentials", link https://nordlayer.com/learn/iso/iso-27017/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  CISO Strategy: Where Product Security Fails at Scale 28.04.2026 7min

  Most organisations manage only build and operate, ignoring growth, where security risk explodes. Luigi Ferri reveals how CISOs miss the most critical phase, where scaling, DevOps, and rapid decisions create hidden security debt. This episode challenges leaders to shift from reactive controls to full product lifecycle governance before risk turns into incidents.In this episode, we answer to:Why is product growth the most dangerous phase for cybersecurity risk?Are CISOs governing product lifecycle or just reacting to failures?How does DevOps accelerate delivery but weaken security accountability?Resources Mentioned in this Episode:Advisera website, article "ISO 27001 control 8.25 Secure development life cycle", link https://advisera.com/iso27001/control-8-25-secure-development-life-cycle/ Ikarus website, article "Security by Design", link https://www.ikarussecurity.com/en/security-news-en/security-by-design-cybersecurity-throughout-the-product-life-cycle/ Netguru website, article "SaaS Development Life Cycle: Key Stages & Best Practices", link https://www.netguru.com/blog/saas-development-life-cycle DevOps by Techstrong Group website, article "DevSecOps: Integrating Security Into the DevOps Lifecycle", link https://devops.com/devsecops-integrating-security-into-the-devops-lifecycle/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  ITIL 5 Exposed: Accountability Without Authority 21.04.2026 8min

  ITIL 5 exposes a critical ITSM flaw: Service Owners held accountable without authority. Discover how broken governance, security vs delivery conflicts, and unclear decision rights undermine outcomes. Learn why real accountability starts before operations, and how to redesign Enterprise Service Management for true leadership.In this episode, we answer to:Why are Service Owners accountable but not empowered in ITIL 5?How does the security vs delivery tension reveal weak ITSM governance?Resources Mentioned in this Episode:PeopleCert website, article "Understanding the evolution of ITIL", link https://www.peoplecert.org/news-and-announcements/itil-version-5-explained Learning Tree International website, article "ITIL® (Version 5) Has Arrived", link https://www.learningtree.com/blog/itil-5-launch-what-you-need-to-know/ Agile PM Hub website, article "ITIL® 5 Is Here: What’s New and Why It Matters", link https://agilepmhub.com/blog/itil-version-5-whats-new-and-why-it-matters Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  PSD3 Explained: Payments Security & Fraud 14.04.2026 8min

  PSD3 is reshaping payments security, moving beyond PSD2’s access model to address fraud, scams and trust abuse. This episode explains why strong authentication is no longer enough, how APIs become critical to trust, and what banks and fintechs must change to stay secure, compliant and resilient.In this episode, we answer to:What makes PSD3 fundamentally different from PSD2 in payments security?Is strong customer authentication enough to stop modern fraud?How do APIs influence trust, performance and security under PSD3?Resources Mentioned in this Episode: Stripe website, article "What platforms and marketplaces can expect from PSD3", link https://stripe.com/guides/what-platforms-and-marketplaces-can-expect-from-psd3 Trustbuilder website, article "From PSD2 to PSD3: What’s Changing in the Future of Payments in Europe", link https://www.trustbuilder.com/en/psd2-psd3-directive-future-payments-europe/ Deloitte website, article "Shedding light on PSD3/PSR", link https://www.deloitte.com/lu/en/Industries/banking-capital-markets/perspectives/shedding-light-on-psd3-psr.html Schoenherr website, article "The EU's new Payments Services Package", link https://www.schoenherr.eu/content/the-eu-s-new-payments-services-package European Payments Council, article "What do the PSD3 and PSR mean for the payments sector", link https://www.europeanpaymentscouncil.eu/news-insights/insight/what-do-psd3-and-psr-mean-payments-sector Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  AI Governance Illusion: Hidden Risks & Accountability in ITSM 07.04.2026 9min

  AI governance maturity can be misleading. Many organizations rely on frameworks, policies, and dashboards that signal control but fail to reflect true understanding of AI systems. This episode explores the Governance–Understanding Gap, highlighting why unclear decision ownership and limited system insight create hidden risks in AI, ITSM, and Enterprise Service Management environments.In this episode, we answer to:What is the worst decision an AI system could realistically make in practice?Which AI system in the organization is least understood and hardest to explain?If an AI system makes a harmful decision, who is accountable for it?Resources Mentioned in this Episode: NIST website, framework "AI Risk Management Framework", link https://www.nist.gov/itl/ai-risk-management-frameworkEuropean Commission website, policy "Artificial Intelligence", link https://digital-strategy.ec.europa.eu/en/policies/artificial-intelligenceISO Standards website, ISO/IEC 42001 standard, link https://www.iso.org/standard/81230.htmlMIT Sloan Management Review website, article "A framework for assessing AI risk", link https://mitsloan.mit.edu/ideas-made-to-matter/a-framework-assessing-ai-riskStanford Human-Centered AI website, article " AI Index 2025", link https://aiindex.stanford.eduConnect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  DevSecOps: Responsibility Without Authority 31.03.2026 6min

  DevSecOps promises shared security responsibility, but what happens when accountability shifts without decision authority? In this episode of The ITSM Practice Podcast, Luigi Ferri explores governance gaps, risk ownership, Security Champions, burnout, and structural ambiguity in DevSecOps. A sharp reflection for CISOs, AppSec leaders, and ITSM professionals navigating security governance and enterprise risk management.In this episode, we answer to:Who is explicitly allowed to accept risk in a DevSecOps operating model?What happens when developers receive security accountability without authority?Are Security Champions strengthening governance, or masking leadership gaps?Resources Mentioned in this Episode: Blackduck website, article "DevSecOps: The good, the bad, and the ugly", link https://www.blackduck.com/blog/devsecops-challenges-benefits.htmlJit website, article "6 DevSecOps Best Practices that Enable Developers to Deliver Secure Code", link https://www.jit.io/resources/devsecops/a-practical-guide-to-devsecops-making-it-work-for-developersDecipher Bureau website, article "DevSecOps Professionals: Avoiding ‘The Great Burnout’", link https://www.decipherbureau.com/news/articles/devsecops-professionals-avoiding-the-great-burnout/ Security Journey website, article "From Disruption to Integration: Rethinking Just-in-Time Security Training", link https://www.securityjourney.com/post/from-disruption-to-integration-rethinking-just-in-time-security-training Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  ISO 31000 vs MoR: Closing the Risk Management Gap 24.03.2026 7min

  Enterprise Risk Management (ERM) often looks mature—risk registers, ISO 31000 alignment, MoR processes—yet fails to influence real decisions. In fintech and regulated environments, risk governance must shape judgment, not just document compliance. This episode explores why ISO 31000 and MoR lose impact under pressure, and how to align risk appetite, decision-making, and operational execution before risk accumulates.In this episode, we answer to:How can ISO 31000 truly influence enterprise decision-making in fast-moving fintech environments?Why does Management of Risk (MoR) become procedural compliance instead of strategic risk governance?How can Enterprise Risk Management integrate risk appetite, governance, and operational execution without losing agility?Resources Mentioned in this Episode:Axelos website, white paper "Everything You Wanted to Know About MoR in Less Than 1,000 Words", link https://www.axelos.com/resource-hub/white-paper/everything-you-wanted-to-know-about-m-o-r-in-less-than-1000-words Goodelearning website, article "What is Management of Risk (M_o_R)?", link https://goodelearning.com/articles/what-is-management-of-risk/ Best Practice LMS website, article "M_o_R® - Introduction", link http://www.bestpracticelms.com/mLearn/SPM-App/MOR.html ISO official website, ISO 31000:2018 standard, link https://www.iso.org/standard/65694.html Pacific Certifications, article "ISO 31000: Risk Management Framework Explained for Modern Organizations", link https://blog.pacificcert.com/iso-31000-risk-management-framework-explained/ Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya
• 
  ITIL 5: Stop Explaining Failures. Start Owning System Decisions 17.03.2026 6min

  In this episode of the ITSM Practice Podcast, Luigi Ferri explores how ITIL 5 shifts leadership from explaining incidents to owning systemic decisions. In complex service ecosystems, governance must move upstream—before automation, architecture, and risk scale. True IT Service Management leadership is no longer about post-incident justification, but about accountable decision design in Enterprise Service Management.In this episode, we answer to:How does ITIL 5 redefine accountability in modern IT Service Management?Why is governance shifting upstream in complex, automated service environments?Are Heads of Service accountable for decisions they did not design?Resources Mentioned in this Episode: ITIL Training Academy website, article "ITIL® (Version 5): Everything New in ITIL Latest Version", link https://www.itil.org.uk/blog/itil-version-5-a-complete-guidePeopleCert website, article "ITIL, The Language of Growth", link https://www.peoplecert.org/Frameworks-Professionals/ITIL-frameworkPMG Academy website, article "The Definitive Guide to ITIL® Version 5 Foundation", link https://www.pmgacademy.com/en/articles/itil/the-definitive-guide-to-itil-version-5-foundation/ITIL official website, article "ITIL AI Governance White Paper", link https://www.itil.com/Itil-News-and-Announcements/ai-governance-white-paper INOC website, article "5 ITIL Incident Management Best Practices", link https://www.inoc.com/blog/itil-incident-management Connect with me on:LinkedIn: https://www.linkedin.com/in/theitsmpractice/Website: http://www.theitsmpractice.comAnd if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.Credits:Sound engineering by Alan Southgate - http://alsouthgate.co.uk/Graphics by Yulia Kolodyazhnaya