Author

Francesco Catozzo.

Head of Compliance & Operations · 9 articles

Francesco Catozzo is Head of Compliance & Operations at Zentara and an ISO 27001/27701 Lead Auditor, responsible for compliance, audit and delivery operations. Francesco writes about UU PDP, financial-sector regulation and data protection across Southeast Asia.

Articles by Francesco Catozzo

Cybersecurity Consulting16 Sept 2026

What Is Operational Resilience? A Guide for Singapore Financial Institutions

Learn how Singapore financial institutions can strengthen operational resilience through critical service mapping, dependency mapping, and scenario testing.

Francesco Catozzo

Cybersecurity Consulting14 Aug 2026

AFASA Compliance: How Philippine FIs Can Strengthen MFA

Learn how Philippine banks and e-wallets can strengthen AFASA compliance with phishing-resistant MFA, FIDO2 passkeys, and device-bound authentication.

Francesco Catozzo

Cybercrime Investigation & Data Protection13 Aug 2026

SATUSEHAT Security: Protecting Health Data Under UU PDP

Learn how hospitals, healthtech, and pharmaceutical firms can secure SATUSEHAT integrations, protect patient data, and meet UU PDP requirements.

Francesco Catozzo

Blog31 Jul 2026

OJK Cyber Resilience Rules for Digital Banks in Indonesia 2026

Indonesia now has 17 licensed digital banks, more than any other country in Southeast Asia. Digital banking penetration has grown alongside them, from 31% of the population in 2022 to a projected 39%, roughly 75 million people, by 2026. Operating a digital bank Indonesia service places an institution.

Francesco Catozzo

Blog28 Jul 2026

Cybersecurity Audit Checklist: Free Template and Best Practices

Most security gaps aren’t sophisticated. They’re a dormant admin account, an unpatched server, a backup nobody has tested since it was configured. Each one is boring on its own, and each one is how attackers get in. A cybersecurity audit checklist gives you a repeatable way to find those

Francesco Catozzo

Blog27 Jul 2026

What Is a Cybersecurity Audit? Types, Process, and Checklist

Most breaches don’t announce themselves. They start quietly, in a system nobody checked: an open port left over from a migration, a contractor account that was never disabled, a backup that hasn’t been tested since it was set up. A cybersecurity audit is how you find these before someone

Francesco Catozzo

Blog16 Jul 2026

Data Protection Impact Assessment (DPIA)

Many organisations treat a Data Protection Impact Assessment (DPIA) as a compliance document. Regulators increasingly see it differently. A DPIA is only valuable if the risks it identifies are actually addressed. In January 2026, France’s data protection regulator (CNIL) fined France Travail E

Francesco Catozzo

Blog15 Jul 2026

ISO/IEC 27701 Privacy Information Management System (PIMS)

Most of the guidance you will find on privacy information management systems is out of date. It tells you that a PIMS is an extension of ISO 27001, and that you need an ISO 27001 certificate before you can certify one. Several certification bodies still publish this on their websites today. It stopp

Francesco Catozzo

Data Breach Response: A Guide for Businesses

Blog18 Jun 2026

The 72-Hour Rule in UU PDP: A Guide for Fintech & E-Commerce

A customer opens your app, taps a button, and asks you to delete everything you hold about them. From that moment, the clock starts. Under Indonesia’s data protection law, you have 72 hours to act. For a fintech platform or an online store handling thousands of these requests, doing it by hand

Francesco Catozzo