regulatory-update
-
SEC's FY2026 Enforcement Results: One Cyber Case, and What the Rest Says About Controls and Disclosure
The SEC's annual enforcement results name one cybersecurity policies case. The wider pattern, individual accountability, internal controls and credit for self-reporting, matters more to executives.
regulatory-update -
EU Takes Four Countries to Court Over NIS2: What It Means for Multi-Country Compliance Plans
On 8 July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the EU Court of Justice for not transposing NIS2. The case is about governments, not companies, but it changes how boards should plan across the EU.
regulatory-update -
CIRCIA Final Rule Reaches the White House: What Boards Should Settle Before the 72-Hour Clock Starts
CISA sent the final CIRCIA incident reporting rule to OIRA on 1 October 2026. It is not yet in force, but the review stage is the right moment for boards to confirm scope, decision rights and evidence retention.
regulatory-update -
EU Cyber Resilience Act Reporting Is Live: The 24-Hour Clock CISOs Now Need to Run
Since 11 September 2026, manufacturers of connected products must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform. What the deadlines are, who needs to own them, and the questions to put to your product and supplier teams.
regulatory-update -
CISA's BOD 26-04 Replaces CVSS-Driven Patching for Federal Agencies: What It Signals for Your Board
CISA's June directive sets patching deadlines by exposure, exploitability and impact, and asks agencies to check for compromise before they patch. It binds only federal agencies, but it offers boards a ready benchmark.
regulatory-update -
NYDFS Cybersecurity Regulation: The Enforcement Wave CISOs Can No Longer Call a New York Problem
With the Second Amendment to 23 NYCRR Part 500 now fully phased in and more than $144 million in consent-order penalties on the books, NYDFS has become one of the most consequential — and most overlooked — cybersecurity regulators for CISOs outside the financial sector's core.
regulatory-update -
Zero Trust Is No Longer Optional: The Regulatory Mandates Making It a Compliance Requirement
Zero Trust Architecture has moved from best practice to mandatory requirement. OMB M-22-09 federal deadlines are now enforceable, CISA's updated Zero Trust Maturity Model defines the measurement framework, and DORA, CIRCIA, and the UK Cyber Security and Resilience Bill are converging on the same underlying controls. Here's what the board needs to understand about where ZTA compliance now sits.
regulatory-update -
DORA Operational Resilience Testing: What Financial Sector CISOs Must Deliver
DORA's Threat-Led Penetration Testing requirements under Article 26 apply to significant financial entities across the EU and have extraterritorial reach for UK firms with EU operations. Here's what CISOs need to have in place, the testing scope requirements, and how to manage third-party ICT provider involvement.
regulatory-update