All Articles
-
CIRCIA Final Rule Reaches the White House: What Boards Should Settle Before the 72-Hour Clock Starts
CISA sent the final CIRCIA incident reporting rule to OIRA on 1 October 2026. It is not yet in force, but the review stage is the right moment for boards to confirm scope, decision rights and evidence retention.
regulatory-update -
EU Cyber Resilience Act Reporting Is Live: The 24-Hour Clock CISOs Now Need to Run
Since 11 September 2026, manufacturers of connected products must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. What the deadlines are, who needs to own them, and the questions to put to your product and supplier teams.
regulatory-update -
CISA's BOD 26-04 Replaces CVSS-Driven Patching for Federal Agencies: What It Signals for Your Board
CISA's June directive sets patching deadlines by exposure, exploitability and impact, and asks agencies to check for compromise before they patch. It binds only federal agencies, but it offers boards a ready benchmark.
regulatory-update -
When an AI Agent Acts Without Instruction: What the New NIST, NSA and CISA Incident Guidance Means for Your Board
A voluntary joint document published on 16 October sets out ten practices for incidents in which an AI agent takes unauthorised action. It is aimed at frontier developers, but it offers boards a useful benchmark.
briefing -
When a VPN Flaw Becomes a Hypervisor Problem: Five Questions for the Board After the PAN-OS Update
Palo Alto's Unit 42 now links Qilin and Inc to attempts on a known VPN flaw, and describes attackers reaching vCenter and backup software. Here is what directors should ask management, in business terms.
briefing -
UK Corporate Governance Code Provision 29: What the Board's Material Controls Declaration Means for Cyber
Provision 29 of the 2024 UK Corporate Governance Code now applies to financial years beginning on or after 1 January 2026. Boards must declare the effectiveness of material controls, and CISOs should be ready to evidence the cyber controls that sit inside that scope.
risk-analysis -
NYDFS Cybersecurity Regulation: The Enforcement Wave CISOs Can No Longer Call a New York Problem
With the Second Amendment to 23 NYCRR Part 500 now fully phased in and more than $144 million in consent-order penalties on the books, NYDFS has become one of the most consequential — and most overlooked — cybersecurity regulators for CISOs outside the financial sector's core.
regulatory-update -
The Board-CISO Trust Gap: What New 2026 Data Reveals About Cyber Risk Reporting
New 2026 survey data from IANS/Artico/CAP Group and a forthcoming board-relationships report show CISOs leaving boardrooms feeling heard while directors leave uneasy. Here is what the gap actually measures and how to close it.
risk-analysis