DORA is now law across the EU financial sector. Tom explains the five pillars, who is accountable for what (the board carries it under Article 5), and how an ISO 27001 management system gets you most of the way. He then covers where organisations trip up, which is incident classification and reporting, the register of information, Article 30 contract clauses, exit strategies, resilience testing and the scope of your certificate.

Tom got as far as registering his dog, Noodle, with the ICO to make a point. Registration only means a business has paid the data protection fee and says nothing about whether it complies with data protection law. He explains how companies misuse registration as an excuse for skipping a privacy policy, why the ICO is not at fault, and the five questions a complete privacy policy needs to answer.

In the early 90s you passed a practical assessment before you were promoted to manage people. Now people are pushed into management because it is the only route to a pay rise, with no training and no support. Tom describes what that costs, including a client that lost over 80% of new managers within six months, and suggests job seekers ask about training before accepting a role.

Companies say there is a cybersecurity skills shortage while the talent sits on LinkedIn looking for roles. Using a real Head of Security Operations job posting as a case study, Tom works through the red flags in the advert, the application form, and the interview process, from spammed postings and missing salary ranges to personality tests and hiring by committee, then sets out how employers could fix it.

Digital resilience starts with how we find services, and that means DNS. Tom explains why you might swap your ISP's default resolver, why the big alternatives come from the same Big Tech firms harvesting your data, and what DNS4EU offers. It is an EU-funded, ENISA-supported service that blocks tracking and malware and can also block ads and unsuitable content, with the resolver addresses listed and no geographic limits on who can use it.