compliance

Security Obligations Under GDPR Still Apply, Even if Data Is Anonymous in the Hands of an Attacker

By / Blog / , , , ,

UK Court of Appeal ruled in DSG Retail v. Information Commissioner that GDPR security obligations remain for controllers even if data is anonymous to attackers. The decision emphasizes the broad nature of “personal data” and the need for controllers to protect against unauthorized access, regardless of how data may appear to a third party. This ruling challenges prior interpretations that could diminish data protection responsibilities. It suggests that GDPR accountability may extend beyond the direct data handling by the controller.

https://iapp.org/news/a/security-obligations-under-gdpr-still-apply-even-if-data-is-anonymous-in-the-hands-of-an-attacker

Secure or Just Certified? Why the Audit Report Is Not the End of Your Security Story

By / Blog / , ,

Compliance is just the starting point for true cybersecurity; it establishes a baseline, not an ultimate protection. Effective security requires a deeper understanding of vulnerabilities beyond compliance checklists. Organizations must rigorously manage supplier risks, as breaches can occur through third-party access. Additionally, navigating overlapping regulations like PCI DSS and GDPR requires adaptability. Security relies on culture and awareness, not just technology. Organizations should focus on resilience, viewing compliance as one layer in a broader, proactive strategy. True protection goes beyond audits to preventing breaches.

https://www.intelligentciso.com/2026/02/20/secure-or-just-certified-why-the-audit-report-is-not-the-end-of-your-security-story/

When AI Agents Pay: Who Owns the Compliance Liability?

By / Blog / , , , , , ,

AI agents in commerce raise complex compliance issues regarding transactional liability. With their adoption accelerating, traditional regulatory frameworks (such as PCI DSS, AML, and DORA) may struggle to keep pace, as compliance is hard to assign when AIs initiate payments. Financial institutions must proactively assess their compliance strategies for AI interactions to avoid future liability risks, particularly around transaction monitoring, script security, and operational resilience. Immediate steps include mapping integrations and recalibrating AML systems. Delayed action may lead to regulatory crises as compliance standards evolve.

https://www.finextra.com/blogposting/30917/when-ai-agents-pay-who-owns-the-compliance-liability

From Innovation to Regulation: How Internal Audit Must Respond to the EU AI Act

By / Blog / , , , , ,

The EU AI Act, a global standard for AI regulation, requires organizations worldwide to address AI risks through governance, controls, and accountability. Internal auditors must adapt to this shift, auditing AI governance, risk classification, data quality, human oversight, and third-party AI risk to ensure compliance.

https://www.wolterskluwer.com/en/expert-insights/innovation-regulation-how-internal-audit-must-respond-eu-ai-act

With CISOs Stretched Thin, Re-envisioning Enterprise Risk May Be the Only Fix

By / Blog / , ,

CISOs face unmanageable workloads as their responsibilities expand without corresponding resources, leading to burnout and ineffective leadership. Experts suggest reassessing the role by redistributing responsibilities and granting appropriate authority. This structural change aims to alleviate pressure and enable CISOs to focus on cyber risk management effectively, rather than being overwhelmed by a multitude of unrelated tasks.

https://www.csoonline.com/article/4128992/with-cisos-stretched-thin-re-envisioning-enterprise-risk-may-be-the-only-fix.html

Breaking Down NIS2: the Five Main Requirements of the Updated NIS Directive

By / Blog / , , ,

NIS2, an update of the EU's cyber security framework, aims to enhance resilience against evolving threats across more sectors, covering essential and important entities. It introduces five key compliance requirements: risk management, incident reporting, cyber security practices, third-party risk management, and workforce security training. NIS2 is an ongoing process, not a one-time compliance task. The directive sets a baseline for accountability and resilience in cyber security across the EU.

https://www.financierworldwide.com/breaking-down-nis2-the-five-main-requirements-of-the-updated-nis-directive

TPRM Governance: How Companies Strategically Manage Third-party Risks

By / Blog / , ,

KPMG discusses third-party risk management (TPRM) governance as essential for navigating challenges like geopolitical tensions, cyber threats, and regulatory pressures. Effective TPRM evolves from mere compliance into a strategic tool for resilience and business value. Companies struggle with outdated structures and fragmented approaches, necessitating clear governance to define roles, responsibilities, and risk categories. Successful TPRM requires centralized oversight for transparency, with roles well-defined to ensure consistent risk management. Future insights will address technological advancements in TPRM.

https://kpmg.com/de/en/services/audit/regulatory-advisory/tprm-governance-how-companies-strategically-manage-third-party-risks.html

The CTEM Divide: Why 84% of Security Programs Are Falling Behind

By / Blog / ,

2026 study shows 84% of security programs lag due to lack of Continuous Threat Exposure Management (CTEM). Only 16% adopted CTEM, which enhances visibility and threat awareness. Despite 87% awareness, implementation struggles arise from organizational inertia and budget issues. Security complexity increases risk, making CTEM essential for managing high-stakes challenges. Without it, traditional security approaches fail to scale, urging leaders to reconsider their strategies.

https://thehackernews.com/2026/02/the-ctem-divide-why-84-of-security.html

The Data Visibility Crisis IT Teams Aren’t Talking About

By / Blog / , ,

IT teams face a data visibility crisis, struggling to track data across multi-cloud environments. A Veeam survey shows nearly 60% report reduced visibility due to expanding SaaS and cloud usage. This gap can lead to compliance issues, as seen with TikTok's €530 million fine. Data escapes view through various channels, complicating management. Existing tools in platforms like Microsoft 365 and Google Workspace can aid in data discovery, but more advanced tools may be needed for regulated industries. Building visibility processes into onboarding and offboarding is essential for maintaining oversight, ultimately improving incident response and compliance readiness.

https://www.spiceworks.com/security/the-data-visibility-crisis-it-teams-arent-talking-about/

Never Settle: How CISOs Can Go Beyond Compliance Standards to Better Protect Their Organizations

By / Blog / , ,

CISOs should prioritize resilience over merely meeting compliance standards to combat emerging cybersecurity threats effectively. While compliance sets basic security protocols, it may not address new risks adequately. CISOs are encouraged to enhance their strategies by extending their risk assessment timeframes, adopting scenario-based methodologies, and quantifying potential losses. Engaging with organizational leadership on these matters year-round can shift perceptions of cybersecurity from a cost to an essential investment in business sustainability.

https://www.csoonline.com/article/4128920/never-settle-how-cisos-can-go-beyond-compliance-standards-to-better-protect-their-organizations.html

Scroll to Top