regulation

NIS2: Supply Chains as a Risk Factor

/ , , ,

NIS2 increases supply chain security requirements, emphasizing external IT risks. Companies must integrate these risks into their security strategies, transforming dependencies into management responsibilities. Effective control of supply chains involves identifying critical partners, setting security standards, and continuous risk monitoring. CISOs' roles expand to include risk communication and holistic management. Compliance under NIS2 goes beyond paperwork, demanding real security measures and transparent assessments, ultimately enhancing operational stability and turning supply chains into strategic assets.

https://www.csoonline.com/article/4128381/nis2-supply-chains-as-a-risk-factor.html

The Expanding Role of Security, Governance and Risk

/ , ,

2026 mandates stronger security, governance, and risk (SGR) measures as regulators enforce compliance, particularly in AI and data privacy across global frameworks. Organizations must transition from mere compliance to building robust, audit-ready systems that demonstrate resilience. Key priorities include unifying SGR initiatives, integrating incident reporting, preparing for AI governance, and maintaining cross-border data integrity. Effective SGR strategies will enhance market access and organizational credibility, establishing SGR as a crucial driver of business success.

https://www.ibm.com/think/insights/expanding-role-security-governance-risk

The Case for a Ransom Payment Ban and When It Might Happen

/ , ,

Jen Ellis, co-chair of the Ransomware Task Force, predicts a partial ransom payment ban in Britain. While not a perfect solution, it addresses the ethical concerns of funding cybercrime. The ban will likely follow the implementation of the revamped Cyber Action Plan and the Cyber Security and Resilience Bill.

https://www.bankinfosecurity.com/interviews/case-for-ransom-payment-ban-when-might-happen-i-5520

Why Data Privacy Impact Assessments Must Be a Backbone of Any Effective Privacy Program

/ , , , ,

Data Privacy Impact Assessments (DPIAs) are essential for identifying and mitigating privacy risks before new data processing activities begin. While initially a European concept, DPIAs are now mandated by several U.S. states, with California leading the way through its risk-based model. This model requires assessments for high-risk processing activities, such as selling personal information or using automated decision-making, and emphasizes transparency and accountability.

https://www.jdsupra.com/legalnews/why-data-privacy-impact-assessments-9691846/

European Commission Proposes Revised Cybersecurity Act to Boost EU Cyber Resilience, Secure ICT Supply Chains

/ , ,

EU proposes revised Cybersecurity Act to enhance resilience, secure ICT supply chains. Act introduces simpler certification, supports compliance, fortifies ENISA, and targets risks from third-country suppliers. Key amendments to NIS2 Directive facilitate legal clarity and compliance for businesses. New horizontal framework for ICT supply chain security addresses strategic risks and vulnerabilities. ENISA strengthens cybersecurity response and supports workforce development. Overall, the initiative aims to improve security and trust in EU's critical infrastructure.

https://industrialcyber.co/regulation-standards-and-compliance/european-commission-proposes-revised-cybersecurity-act-to-boost-eu-cyber-resilience-secure-ict-supply-chains/

European States Spin Wheels on Cybersecurity Directive

/ , , ,

The Network and Information Security 2 Directive (NIS2), intended to enhance cybersecurity across the EU, faces delays in implementation. While some countries have fully transposed the directive, others, including France and Ireland, have yet to do so. This inconsistency creates uncertainty for businesses operating across borders and raises concerns about Europe’s cybersecurity posture.

https://www.bankinfosecurity.com/european-states-spin-wheels-on-cybersecurity-directive-a-30542

EU Plans Cybersecurity Overhaul to Block Foreign High-risk Suppliers

/ , ,

EU proposes cybersecurity legislation to remove high-risk suppliers from telecom networks to enhance security against cyber threats. The plan aims to improve risk assessments and streamline ICT supply chain certification, allowing for better protection against cyber attacks and enhancing Europe's technological sovereignty.

https://www.bleepingcomputer.com/news/security/eu-plans-cybersecurity-overhaul-to-block-foreign-high-risk-suppliers/

Cybersecurity, the First Institutional Failure of a Hyperconnected Era

/ , ,

Cybersecurity has become a critical institutional failure in the hyperconnected era, as organizations struggle to manage complex cyber risks. The assumption that cybersecurity can be delegated has led to systemic failures and significant financial consequences, with the global cost of cybercrime projected to reach $12.2 trillion annually by 2031. Institutions must transition towards understanding cybersecurity not just as risk mitigation but as essential for preserving digital civilization, emphasizing transparency, accountability, and resilience.

https://www.diplomaticourier.com/posts/cybersecurity-first-institutional-failure-hyperconnected-era

PCI DSS Compliance Is a Business Essential, Not an IT Task

/ , ,

PCI DSS compliance is essential for businesses, not just IT, to mitigate risks from data breaches, avoid fines, and maintain customer trust. It's vital for any entity handling cardholder data. Compliance should be ongoing, not a yearly task, as failure could halt operations and lead to financial losses. Certification signals commitment to security but must be part of continuous operational discipline to manage threats effectively. PCI DSS standards evolve to address new challenges in payment processing.

https://www.engineeringnews.co.za/article/pci-dss-compliance-is-a-business-essential-not-an-it-task-2026-01-08

Scroll to Top