EIAN Management Consulting

06/07/2025

Many times an auditor would ask "show me your audit programme", as if expecting the auditee to show one document that contains all of the requirements.

What is really an audit programme? Read on.

06/07/2025

🚀 Client Win: REVLV Solutions is now ISO/IEC 27001:2022 Certified!

Proud to have served as the ISMS Consultant for REVLV Solutions Inc., guiding them through the successful implementation and certification of their Information Security Management System.

From risk assessment to control implementation, internal audit preparation to final certification — I had the privilege of working with a sharp and forward-thinking team committed to cybersecurity and continual improvement.

This milestone strengthens REVLV’s position as a trusted provider of Starlink satellite internet, enterprise software, and managed IT services for critical sectors — including the AFP, DICT, and the Philippine Coast Guard.

✅ ISO/IEC 27001:2022 Certified
🛡️ Scope: IT infrastructure, software development, network services
🙌 Huge congratulations to the Revlv team!

08/03/2025

Recently concluded 2-day Cybersecurity training covering OWASP Top 10 risks, security controls, and incident management for Philippine Guarantee Corporation.

01/08/2024

We are happy to share this Adaptive SME Guidebook for Small to Medium Enterprises.

EIAN's co-founder and Principal Consultant, Richard Regalado is one of the authors of this guidebook which describes a pragmatic, five-phased approach for Small to Medium-sized Enterprises to manage their information risk and security arrangements.

01/01/2024

Let’s provide guidance, and clarity in a highly complex world. Let us not forget why we chose to be Consultants.

Happy new year from EIAN MANAGEMENT CONSULTING SERVICES.

27/10/2023

I always tell my clients to put premium on internal audits over 3rd-party audits. Sure, 3rd-party audits can give you a piece of paper you can hang on the wall, but the view of the 3rd-party auditors is often times, myopic.

The internal auditors are exposed to the organizational changes and challenges, personalities, attuned to the culture, and concerns such as dissatisfied customers, compliance issues, information security incidents, resource constraints, and other business realities.

As such, the internal auditors can be deployed quickly to aid in root cause analysis, corrective action planning, and the overall improvement of the organization.

The 3rd-party auditors' view is like looking, and observing at a photo, or a 5-second GIF, and generating their findings from what they see during the limited interaction time with the organization.

The internal auditors are watching a 4K video, with excellent sounds, and subtitles.

Now, who can offer a better review?

Richard Regalado
Co-founder and Principal Consultant
EIAN Management Consulting

13/10/2023

I was asked during the conduct of a business continuity management system (BCMS) risk management course why do companies need to perform risk treatment when business continuity plans (BCPs) are already available.

I retorted by asking "Do you have insurance for your car? Do you have healthcare? Yes? Yet you still strap on your seatbelt every time you drive your car."

The insurance policies are your BCPs. It sits there. (You have to pay for the annual premium though. Just like exercising your BCPs).

The seatbelts are your risk treatment plans. It keeps risk, the consequences thereof to be more precise, to a manageable level when the stuff decides to hit the fan.

Richard Regalado
Having coffee in my neck of the woods
Happy Friday

10/10/2023

The Medusa ransomware group has released compressed files in zip format from PhilHealth, the Philippine Health Insurance Corporation. The release comes about two days after PhilHealth refused to pay a ransom of US$300,000. The compressed files are in 160 parts, each being 3,891MB in size. This means the total file size is approximately 622GB, with an additional 3.5GB file. While the files are now available online, John Patrick Lita, CEO and co-founder of SOROS Securities Inc., said it is dangerous to download the files as the initial link from the website of the group on the dark web contains a remote access trojan (RAT) that can compromise the privacy and security of those who will download the files.

23/09/2023

I was asked in a public course some time ago, the difference between an ISO 22301 business continuity management system (BCMS), and the other ISO-based management system standards.

* A quality management system (QMS) is something you use every day to delight your customers.
* An environmental management system (EMS) is something you use all the time e.g., turning off the taps, putting out the lights, using the appropriate bins, etc.
* An information security management system (ISMS) is used every time you want to access or share a resource e.g., use of passwords, secure transmission of data, handle information the right way, etc.

Whereas, the main output of a business continuity management system (BCMS), the business continuity plan (BCP), is something you hope you never get the chance to use.

You want it available and updated and ready for use, and just sitting there.
Just like your trusty spare tire.

Richard Regalado
EIAN Management Consulting
Principal Consultant
Saturday morning, in my neck of the woods

03/09/2023

Strengthening Public Service Resilience

In times of crisis, the government assumes a pivotal role as the proverbial “last man standing”, representing the foundation of stability and resilience within a society. This concept encapsulates the notion that governments must endure, and remain functional even amidst the most challenging circumstances. It is based on this premises that we are inviting you to attend a 1-day awareness of public service continuity management system or PSCMS.

We have face-to-face and remote training sessions. (October 2023)

Seats are still available:
Email: [email protected] for details and invites.

03/09/2023

03/09/2023

4 months ago CIS Bayad Center Inc. (CBCI) contracted us to develop and implement an Enterprise Risk Management (ERM) system and a Business Continuity Management System (BCMS). Both should be aligned to international standards - ISO 31000 and ISO 22301, and should comply with the applicable regulatory requirements of the Bangko Sentral ng Pilipinas.

Signed. Sealed. Delivered.

Earlier, we had an exit meeting with CBCI President Lawrence Ferrer to discuss our recommendations moving forward. The project would not have been that successful without the efforts of Federico B. Pepillo, Jr. MSc, CSSWB, CRA, CSRMS, CAMS, VP for Risk, Jasel Javier, Allen Candelaria, and the members of the Bayad Working Group.

In the photo are EIAN Principal Consultant Richard Regalado and Project Manager Atty. Ana Liza Arciaga, CPA, MBA.