PRACTITIONER-LED GOVERNANCE THINKING
Practical governance thinking for when the paperwork stops being enough.
Cyber, privacy, AI, suppliers and resilience rarely stay inside their own boxes. Acceptable Risk is a practitioner-led library about what happens when governance meets operational reality — the evidence, ownership, consequences and decisions that matter.
Because “documented” isn’t a mitigation strategy.
START HERE
Three pieces that explain the worldview.
The Risk Register Nobody Looks At
When a governance artefact exists but no longer shapes decisions.
Your Risk Appetite Doesn’t Matter When You Inherit Theirs
How dependencies turn somebody else’s control choices into your exposure.
Three AI Certifications, Three Governance Problems
Why assurance labels do not remove the need for ownership and judgement.
Explore by subject
Governance Without Theatre
Evidence, ownership, accountability and leadership decisions.
Data Privacy in Practice
Privacy as an operating discipline rather than a paperwork exercise.
AI Governance: Practitioner View
Inventory, oversight, evidence and accountability around real AI use.
Defence, Certification & Supply Chain
Assurance, dependencies, suppliers and demonstrable trust.
Latest thinking
How I Translate Technical Risk Into Leadership Decisions
A technical risk can be described accurately and still arrive at leadership in a form that is difficult to use.
When Every Specialist Answer Is Right, Leadership Can Still Have a Problem
Specialist assessments can each be sound while leadership still lacks a coherent basis for one organisational decision.
You Bought the Data. You Still Own the Decision.
Buying third-party marketing data does not settle how you can use it. The organisation still needs to understand the source, intended purpose, authority, evidence and who owns the decision.
DCC: Five Things I’ve Learnt as an Assessor
Five practical lessons from Defence Cyber Certification assessment preparation: scope, evidence, Cyber Essentials, proactive certification and independent assurance.
About Paul
Paul Maxwell is a cyber and governance practitioner with experience across defence, government and commercial environments. He writes about the gap between what organisations say is controlled and what the evidence shows is actually working.