Call us now:
PARAVA – NEW WEBSITE – INSIGHTS
Corporate Insights
Insights Into Board Governance, Cybersecurity, Risk Management and Regulatory Compliance
Our research and thought leadership programme examines the strategic, regulatory and governance implications of cybersecurity and cyber risk. We have authored a series of papers and white papers addressing cybersecurity regulation, board governance, cyber risk management, supply-chain risk, cyber insurance, regulatory compliance and international harmonisation, including the Left of Bang and Augusta Plan series.
This work is complemented by webinars, executive briefings, conference presentations and industry engagements designed to translate emerging regulatory and policy developments into practical implications for boards and leadership teams. Our research and perspectives have been reviewed and presented to the White House Office of the National Cyber Director, the Cyberspace Solarium Commission, the U.S. Department of Defense, UK Parliamentary Working Groups, academic institutions and international professional associations.
Is Cyber an Economically Insurable Risk
Is Cyber an Economically Insurance Risk?
Cyber is a complex, dynamic and increasingly strategic risk that challenges traditional approaches to risk management and insurance. The growing frequency and severity of attacks, including ransomware and state-sponsored activity, demonstrate that market forces alone have not delivered effective risk reduction. Governments are therefore responding through increased legislation, regulation and enforcement, making cybersecurity a board-level governance and national security priority. Rising control, remediation, regulatory and reputational costs, combined with constrained cyber-insurance capacity, create significant financial exposure. Organisations will increasingly require demonstrable cybersecurity assurance. A phased model of self-attestation, independent certification and continuous monitoring could strengthen assurance, improve risk visibility and enable more effective insurance pricing and capacity.
The Small Business Paradigm
Small Business Cybersecurity
Small businesses represent 99% of U.S. companies, employing more than 59 million people and generating approximately 44% of GDP, making their cyber resilience a national economic priority. Cyberattacks are no longer exceptional events but an expected business risk, with small firms particularly vulnerable to catastrophic financial and operational impact.
A paradigm shift is required in how government and small businesses approach cybersecurity. Establishing a consistent baseline through recognised frameworks and independent assurance can identify gaps and prioritise remediation. Government support through tax incentives and grants, combined with cloud-based shared responsibility models, can reduce implementation costs while strengthening protection of intellectual property, supply chains and critical economic infrastructure.
Left of Bang 1.0
Left of Bang 1.0
Cybersecurity regulation is moving organisations “Left of Bang”—from responding to incidents toward proactively identifying, governing and mitigating cyber risk. For boards, cybersecurity is no longer an optional technology investment; it is a core enterprise risk and governance responsibility. Regulatory enforcement is increasingly establishing expectations for reasonable cybersecurity practices, with decisions potentially subject to future scrutiny.
This extends beyond regulated organisations to their suppliers, making cybersecurity supply-chain risk a board-level concern. Organisations must develop enterprise-wide situational awareness, align controls with risk exposure, and demonstrate effective governance and assurance. This regulatory shift presents an opportunity to strengthen board oversight, improve investment decisions and embed security through approaches such as continuous assurance and DevSecOps.
Left of Bang 2.0
Left of Bang 2.0
Cyber regulation is fundamentally shifting cybersecurity from a discretionary technology investment to a board-level governance responsibility. Historically, organisations particularly SMEs often relied on cyber insurance to transfer risk, supported by the assumption that a serious incident was unlikely. That position is no longer sustainable.
Cyber is now a material enterprise risk capable of affecting operational resilience, financial performance and shareholder value. Regulation such as the SEC requirements, NIS2 and DORA is moving organisations left of bang, requiring boards to demonstrate effective governance, proportionate controls, assurance and oversight. Cyber insurance remains relevant, but as a complementary risk treatment—not a substitute for effective cybersecurity risk management.
DFARS/ CMMC Compliance Guide
A Simple Corporate Guide to CMMC Compliance
Cybersecurity has been a contractual requirement for the US Defense Industrial Base (DIB) since 2017 under DFARS 252.204-7012, requiring contractors handling Controlled Unclassified Information (CUI) to implement NIST SP 800-171 controls. The introduction of CMMC represents a fundamental shift from self-attestation to independently verified assurance. Under DFARS 252.204-7021, contracts can require CMMC Levels 1–3, with higher levels demanding progressively stronger controls and assessment.
From November 2025, applicable contracts require formal certification rather than self-attestation. The objective is clear: protect sensitive defense information, weapon systems and ultimately national security and the warfighter.
EU NIS 2.0
EU NIS 2
The EU is establishing a harmonised cybersecurity and resilience framework through NIS2, DORA, the Critical Entities Resilience (CER) Directive and the Cyber Resilience Act (CRA). Of these, NIS2 represents a significant expansion of cybersecurity regulation, extending requirements across 18 critical sectors and placing greater responsibility on boards and senior management.
Organisations must implement proportionate cyber-risk controls, strengthen incident response, manage supply-chain risk and demonstrate operational resilience. NIS2 also introduces enhanced reporting obligations, supervisory powers and financial penalties for non-compliance. Collectively, these measures shift cybersecurity from an IT responsibility to a strategic enterprise risk and governance obligation.
The SEC Final Cyber Rule
Materiality, Adequacy and the Role of Corporate Governance
The SEC’s Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure Final Rule became effective on 5 September 2023, strengthening expectations for cybersecurity governance and transparency.
The Rule requires covered organisations to identify, assess, manage and disclose material cybersecurity risks and incidents, with appropriate executive and board oversight. Cybersecurity is therefore an enterprise risk, not solely a technology responsibility. Boards and senior executives should understand material cyber risks, establish effective governance and risk management processes, and receive sufficient information to exercise meaningful oversight. Organisations must demonstrate clear accountability, transparency, risk management and assurance, with inadequate management or disclosure potentially creating significant regulatory, financial, legal and reputational exposure.
FDA Cybersecurity
Medical Device Cybersecurity
Cybersecurity regulation is now a strategic board-level issue for pharmaceutical and medical device organisations. SEC reporting requirements, EU NIS2 and FDA cybersecurity obligations are increasing expectations for transparency, governance, assurance and accountability. Medical device manufacturers must demonstrate processes for identifying and managing vulnerabilities, coordinated disclosure, secure development, post-market monitoring and updates, while maintaining a Software Bill of Materials (SBOM).
These requirements apply irrespective of organisational size where products are marketed in the United States. Parava supports leadership teams with integrated cybersecurity risk management, regulatory compliance, education, assurance and government liaison, helping organisations meet and sustain evolving obligations across jurisdictions.
EU NIS 2.0 – Martime
EU NIS 2.0 and the Maritime Industry
Cybersecurity regulation is rapidly reshaping maritime risk and operational resilience, placing greater accountability on boards, directors and senior executives. EU NIS2 significantly strengthens cybersecurity requirements for maritime organisations and critical infrastructure, including risk management, incident reporting and supply-chain security.
The UK is similarly strengthening its NIS framework and expectations for board-level cyber governance, while US SEC requirements increase transparency around material cyber risks and incidents. For maritime operators, ports, shipowners, ship managers and their supply chains, cybersecurity is increasingly a regulatory and business-critical obligation, not simply an IT issue. Proactive governance, assurance and resilience are essential to maintaining operations, market access and regulatory compliance.
The Augusta Plan 1.0
The Augusta Plan 1.0
Federal agencies must manage cybersecurity risk under FISMA and NIST SP 800-37 (RMF). The DoD’s attempt to operationalise these requirements through mandatory third-party CMMC certification has exposed a foreseeable shortage of qualified assessors, identified in this paper’s original 2021 formulation.
The Augusta Plan offers an alternative using existing CPA and internal audit assurance infrastructure, supported by product-specific CSF profiles and risk-weighted Bills of Materials (BoMs). Prime contractors would remain accountable for their supply chains, applying proportionate assurance through SOC/IIA attestation, self-assessment and independent testing. This provides scalable, internationally applicable oversight without creating a new assessor workforce or disproportionate compliance costs.
The Augusta Plan 2.0
Augusta Plan 2.0
Cyber Supply Chain Risk Management (C-SCRM) has long been a U.S. Government priority, reflecting the increasing scale and impact of cyberattacks across public and private sectors. FISMA, enacted in 2002 and modernised in 2014, established the foundation for federal cybersecurity risk management through the NIST Risk Management Framework (RMF).
NIST SP 800-37 requires organisations to identify, assess and manage supply-chain risks through appropriate policies, responsibilities and controls. The Augusta Plan 2.0 builds on this foundation through a scalable assurance model combining risk-based CSF profiles, Bills of Materials, supplier assessments and independent assurance to deliver proportionate, sustainable and internationally applicable oversight.
The Augusta Plan 3.0
Augusta Plan 3.0
The Augusta Plan 3 proposes using the internationally established Common Criteria methodology to harmonise cybersecurity risk management across governments and the Defence Industrial Base. Rather than creating additional standards, it would establish agreed Cybersecurity Framework (CSF) Protection Profiles based on the sensitivity and potential impact of defined information types.
This approach could align cybersecurity requirements across jurisdictions, reduce regulatory fragmentation, and provide a common basis for contractual expectations, assessment and assurance. Building on the Common Criteria’s established international participation, Augusta Plan 3 provides a practical mechanism for developing internationally recognised cybersecurity baselines, enabling governments, primes and suppliers to apply proportionate, risk-based controls to protect critical information and strengthen collective cyber resilience.
FISMA, RMF and DoDi 5000.90
FISMA, the RMF, and DoDi 5000.90
The Department of War (DoW) is undergoing significant transformation to maintain superiority across all warfighting domains, including cyberspace. Federal risk management, supply chain risk management (SCRM), and cybersecurity practices have evolved since FISMA was enacted in 2002 and updated in 2014, with the DoD subsequently formalizing the Risk Management Framework (RMF) across the Services. DoDI 5000.90 further integrates FISMA, RMF, SCRM, and cybersecurity within defense acquisition, establishing risk-based tolerance levels for oversight and assurance. This enables resources to be prioritised according to risk. Alternative assurance mechanisms, including SOC 2 audits, could also reduce compliance burdens while maintaining appropriate cybersecurity assurance across the DIB.
CSF Profiles
Cybersecurity Framework Profiles
A CSF Profile describes an organization’s current and/or target cybersecurity posture in terms of the Core’s outcomes. CSF Profiles are used to understand, tailor, assess, prioritize, and communicate cybersecurity outcomes by considering an organization’s mission objectives, stakeholder expectations, threat landscape, and requirements.
An organization can then prioritize its actions to achieve specific outcomes and communicate that information to stakeholders.
