ISO 28000: Your Resilience, Their Budget
The ITSM Practice: Elevating ITSM and IT Security KnowledgeShow Notes
In this episode of the ITSM Practice Podcast, Luigi Ferri explores why supply chain resilience has become one of the biggest strategic challenges for Government Managed Service Providers (MSPs). Using practical examples from healthcare and public services, he explains how ISO 28000 shifts the conversation from protecting internal systems to managing the security and resilience of the organizations you depend on. Discover why supplier failures, inherited risk, and third-party dependencies are becoming the greatest threats to service continuity, cybersecurity, and operational resilience in government and regulated industries.
In this episode, we answer: Why is ISO 28000 becoming essential for Government Managed Service Providers and supply chain resilience? How can third-party suppliers and subcontractors become the weakest link in your cybersecurity and operational resilience strategy? Why should CISOs focus on inherited risk and supplier dependencies rather than only internal security controls?
Resources Mentioned in this Episode: The Standards Institution of Israel website, article "SI ISO 28000 :2022 Specification for security management systems for the supply chain", link https://www.sii.org.il/en/iso-28000
ANSI website, article "What Is ISO 28000?", link https://blog.ansi.org/anab/what-is-iso-28000/
Wikipedia website, article "ISO 28000", link https://en.wikipedia.org/wiki/ISO/PAS_28000
NIST website, publication "Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations", link https://csrc.nist.rip/Pubs/sp/800/161/r1/2PD
SITS website, article "NIS2, DORA & Co: Aren’t we all part of someone’s relevant supply chain?", link https://sits.com/en/blog/nis2-dora-supply-chain/
UK Government website, notice "Research on cyber security in supplier management and procurement", link https://www.gov.uk/government/publications/research-on-cyber-security-in-supplier-management-and-procurement
Connect with me on: LinkedIn: https://www.linkedin.com/in/theitsmpractice/ Website: http://www.theitsmpractice.com And if you want more tips and guidance, follow me on LinkedIn. I am sharing daily posts regarding Enterprise Service Management, IT Service Management, and IT Security.
Credits: Sound engineering by Alan Southgate - http://alsouthgate.co.uk/
Graphics by Yulia Kolodyazhnaya
More from The ITSM Practice: Elevating ITSM and IT Security Knowledge
How can an MSP grow revenue without growing headcount at the same rate? In this episode of The ITSM Practice Podcast, Luigi Ferri explores how MSPs can protect margins through a scalable Target Operating Model, standardization, automation, AI, knowledge management, self-service, suppliers, and Professional Services.
What happens when a cyber-physical threat crosses Cybersecurity, Physical Security, Facilities and IT Operations? This episode explores how SOC teams can correlate signals, establish incident ownership, define escalation thresholds and build a unified operating model to protect critical infrastructure and business services.
Does your SOC really protect the entire business, or does its visibility stop at the firewall? In this episode of The ITSM Practice Podcast, Luigi Ferri explores drone threats against data centers and what they reveal about gaps between Cybersecurity, Physical Security, Facilities, IT Operations and Business Continuity. Discover why CISOs need to rethink the traditional cyber attack surface and focus on protecting the complete service.
AI that summarizes an incident is one thing. AI that disables accounts, isolates endpoints and blocks connections is another. In this episode of The ITSM Practice Podcast, Luigi Ferri explains the ITIL 5 6C Model for AI and why CIOs, CISOs and MSPs need to stop asking, “Are we using AI?” and start asking, “What are we allowing AI to do?”
A critical vulnerability is not automatically a critical business risk. If your CMDB only tells you which server is affected but not the customer, service, contract, SLA, or revenue behind it, you are missing the information that matters. This episode explains why CISOs need a business-aware CMDB to connect technical risk with real business impact.