5 Questions CISOs Should Ask Third-Party Vendors

/ , ,

CISOs must evaluate third-party vendors to mitigate risks, especially as recent data breaches highlight vulnerabilities. Key questions to ask include:

  1. What is the vendor’s overall security program?
  2. What is their security development process?
  3. What are their supply chain practices?
  4. Are their privacy and data protection practices compliant?
  5. Is the vendor insured, and under what terms?

These questions help ensure robust data protection while integrating third-party services. CISOs should be central in vendor selection to prevent potential breaches.

https://www.infosecurity-magazine.com/blogs/5-questions-cisos-should-ask/

What NIS2 Implementation Means for Enterprises [Q&A]

/ ,

NIS2 mandates enhanced cybersecurity for EU businesses and those interacting with them, focusing on risk management and compliance. It expands previous regulations to new sectors and demands stronger defenses against cyber threats. Challenges include varying readiness levels among organizations and the need for compliance to avoid penalties. Key strategies for alignment include auditing partners, consistent domain management, and fostering a security-focused culture. The impact on business partnerships is still emerging, with upcoming penalties likely prompting stricter security evaluations among partners.

https://betanews.com/2025/04/02/what-nis2-implementation-means-for-enterprises-qa/

Why CIOs Fail — and How They Can Avoid It

/

CIOs can fail due to outdated mindsets, a desire to please stakeholders, and poor communication. Success requires prioritizing strategic goals over technical prowess, engaging with C-suite peers for alignment, and effectively communicating project rationale. To avoid failure, CIOs must balance demands, focus on key initiatives, and explain decisions clearly to prevent disappointment and potential rogue IT actions. CIOs can mitigate risks and enhance their tenure by staying strategically focused and aligning IT with business objectives.

https://www.informationweek.com/it-leadership/why-cios-fail-and-how-they-can-avoid-it

When Less Is More: What the EU’s Latest Moves Mean for the Future of Data Governance

/ , , ,

EU’s retreat from AI-specific laws signals a laissez-faire approach to innovation, relying on established regulations like GDPR and DORA for data protection. This strategy, while criticized for potential consumer risks, embraces adaptable, principle-based governance over rigid legislation. Compliance challenges arise for global organizations, especially in contrasting U.S. regulations. Adopting stringent standards like GDPR as a baseline, ensuring data localization, and maintaining flexible compliance frameworks can enhance operational efficiency and consumer trust in the evolving regulatory landscape.

https://www.fastcompany.com/91308356/when-less-is-more-what-the-eus-latest-moves-mean-for-the-future-of-data-governance

PCI DSS In 2025: How New Rules Could Simplify Compliance For Merchants

/

PCI DSS updates in 2025 will enforce requirements 6.4.3 and 11.6.1, targeting online merchants to enhance payment security against script-based skimming attacks like Magecart. New exemptions may simplify compliance for qualifying merchants who fully outsource payment processing and ensure overall site security. While immediate compliance involves implementing extensive monitoring and script management, long-term goals should focus on attaining SAQ A status to reduce future requirements, emphasizing a strategic approach to ongoing PCI DSS obligations.

https://www.forbes.com/councils/forbestechcouncil/2025/04/02/pci-dss-in-2025-how-new-rules-could-simplify-compliance-for-online-merchants/

New Survey to Gather Practices for the AI Literacy Living Repository

/ , ,

EU’s AI Office launched a survey to collect AI literacy practices for a living repository, currently featuring over 20 examples. This initiative, aiming to enhance AI literacy and support the AI Act’s Article 4, invites organizations to share experiences. Contributions will be verified for transparency before inclusion. The repository serves to foster collaboration and learning among AI providers.

https://digital-strategy.ec.europa.eu/en/news/new-survey-gather-practices-ai-literacy-living-repository

Key Part of EU AI Law Under Attack From Hi-tech Industry

/ , ,

EU AI law faces backlash: Industry pressures lead to voluntary systemic risk assessments in the Code of Best Practices. Reporters Sans Frontières exits talks, citing industry influence and lack of protections for information rights. EU Parliament members express concerns over weakened regulations, risking fundamental rights and democracy.

https://www.eunews.it/en/2025/04/02/key-part-of-eu-ai-law-under-attack-from-hi-tech-industry/

Banking, Financial Services and Insurance (BFSI)

/

BFSI: Sector encompassing banking, financial services, insurance; provides financial products, transactions, risk management; crucial for economic stability, growth; evolving via fintech, digitalization, regulatory changes.

How CISOs Can Use Identity to Advance Zero Trust

/

CISOs must prioritize identity security to advance zero trust strategies amid rising identity-based cyberattacks. With breaches increasingly involving valid credentials, a shift from perimeter-based to identity-focused security is critical. Key controls include privilege management (least privilege, secrets management, just-in-time access), access management (adaptive authentication, SSO, MFA), and identity governance (visibility, compliance, automated reviews). Implementing these practices requires a structured roadmap to ensure they work harmoniously, enhancing resilience against evolving threats. The focus is on continuous identity verification for effective risk management.

https://www.csoonline.com/article/3951888/how-cisos-can-use-identity-to-advance-zero-trust.html

Scroll to Top