Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Editorial standards

Last updated: 26 October 2026

These standards explain how CISO Times handles sourcing, labelling, disclosure and corrections across articles, Guidance, packs, tools and the Library.

Sourcing

  • We link to primary sources wherever practical, such as advisories, filings, laws, standards, papers and official guidance.
  • We distinguish confirmed facts from claims and analysis.
  • We say when something material is not known.
  • We do not republish press releases as reporting.

Labels

Different pages do different jobs. Reporting, analysis, opinion, explainers, interviews, Guidance, packs, tools and guest contributions are labelled or presented in their own contexts.

Subject tags describe what a piece is about. They do not turn a news article into a recommendation or a contribution into staff reporting.

Guidance, packs and tools

Guidance pages answer practical questions and explain the reasoning behind the answer. Packs are reusable documents and templates. Tools calculate or organise a result from the answers you give.

These are practical aids, not a substitute for professional judgement inside a specific organisation. You remain responsible for checking whether a recommendation, template or result fits your facts, contracts, regulator and risk appetite.

How packs, Guidance and the Library are kept accurate

  • Pack documents list the laws, standards and frameworks they rely on in a framework references table. Laws and regulations are checked against their official text. ISO standards are cited by clause or control number and title only; we do not reproduce their text.
  • Each Guidance answer is written from the pack documents it cites, and each step names the document and section it rests on. Where a pack sets a default that is stricter than the law, the answer says it is the pack’s default.
  • Library pages quote laws and regulations from their official sources. Where a page shows how requirements in two frameworks relate, confirm it against both texts before relying on it.
  • When a pack document changes, it takes a new version number. Guidance answers are updated in place when the documents they rest on change.

Disclosure

  • If a page touches a commercial interest connected to CISO Times or its publisher, we disclose that on the page.
  • Sponsored or paid placement, if accepted, must be labelled as such and must not be presented as independent editorial work.
  • We do not accept payment for editorial coverage or for a favourable conclusion.
  • Guest contributors are expected to disclose relevant employment, client, investment or product interests.

Use of AI

AI tools may assist with drafting, structuring, summarising, checking or formatting work. CISO Times remains responsible for what is published.

We do not use AI to invent quotes, sources, statistics or events. Any source cited must be checked against the underlying material.

Corrections

We correct material errors in place. Where a correction changes the meaning of a published page, a correction note explains what changed and when. For pack documents, a correction is a new version of the document.

Minor fixes, such as spelling, broken links or formatting errors, may be made without a correction note. Substantive updates to developing stories are dated where timing matters.

We do not remove accurate reporting simply because someone dislikes it. If a published item cannot stand, it is corrected, updated or marked as withdrawn with the reason given.

Reporting an error

Write to info@cisotimes.com with the page address and what you believe is wrong. If you can point to a source, include it.

We aim to acknowledge material error reports within three working days and to correct or explain our position within ten working days. Reporting an error does not require you to identify yourself or your employer.

If you are reporting a security vulnerability in the website rather than an error in published content, use our vulnerability disclosure policy instead.

Right of reply

If we report on your organisation and you believe the piece is materially wrong or omits something that changes it, tell us. Where the point stands, we will correct it. Where it does not, we will explain why. We do not remove accurate reporting on request.