regulatory-update
-
DORA ICT Third-Party Risk: What Financial Services CISOs Must Have in Place Before the First Supervisory Reviews
The Digital Operational Resilience Act's ICT third-party risk management requirements impose specific contractual, oversight, and incident reporting obligations on financial entities and their critical ICT providers. With DORA fully in effect and supervisors beginning substantive reviews, here's what CISOs need to have in place — and where the most common gaps are.
regulatory-update -
UK Cyber Security and Resilience Bill: What CISOs Need to Know Before It Becomes Law
The UK Cyber Security and Resilience Bill will extend mandatory incident reporting to a wider set of organisations, expand the regulated sector scope beyond NIS, and introduce new board accountability obligations. With parliamentary progress accelerating in 2026, this briefing covers what the legislation requires, how it differs from NIS2, and what UK security leaders should be doing now.
regulatory-update -
NIS2 Personal Liability: What Boards and CISOs Must Understand Before October 2026
NIS2 creates direct personal liability for management body members when cybersecurity failures occur at covered organisations. With enforcement ramping up in October 2026, here is what boards and CISOs need to know about their individual exposure, obligations, and how to document their oversight.
regulatory-update -
NIS2 Enforcement Is Underway: What Early EU Penalties Mean for Your Organisation
EU member states have begun issuing formal NIS2 enforcement actions. Germany has issued 47 formal notices, France has ordered remediation across energy and transport, and personal liability for senior executives is now active. What CISOs need to bring to the board.
regulatory-update -
CIRCIA's 72-Hour Reporting Rule: What CISOs Should Prepare Before It Takes Effect
CISA's CIRCIA final rule has not yet taken effect: it went to the White House OMB for review on 1 October 2026, per reporting. The proposed rule would require 72-hour incident reports and 24-hour ransomware payment reports from covered entities. Here is what CISOs can prepare now.
regulatory-update -
NIS2 Directive: The CISO's Compliance Roadmap by Sector
What CISOs must implement under the EU's NIS2 Directive -- sector-specific obligations, board accountability requirements, and the cost of non-compliance.
regulatory-update -
DORA: ICT Risk Management Requirements for Financial Entities
A CISO's guide to the Digital Operational Resilience Act -- what financial institutions must implement, how DORA interacts with NIS2, and the oversight regime for critical third-party providers.
regulatory-update -
SEC Cybersecurity Disclosure Rules: What CISOs Must Know in 2026
Material incident reporting timelines, annual cybersecurity disclosures, and the CISO's role in SEC compliance -- including personal liability considerations for public company security leaders.
regulatory-update