The German cyber regulatory is transposing EU- NIS 2 ahead of the 2024 deadline. The current draft is looking interesting as are the penalties for non- compliance. All EU national regulators will be doing the same, setting managements accountability to…
Positive to see the UK government updating its advice on the implementation of EU NIS for the health sector. As EU member states are transposing EU NIS 2, DORA and the SEC has finalized its cyber final ruling, one hopes…
The cyber insurance gap is increasing, and will continue to increase as cyber attack frequency complexity and severity of impact increase, cyber maturity remains low, and cyber remains a risk that boards find difficult to understand and manage. As cyber…
It’s the biggest problem we face in cyber, boards do not understand the risk, do not want to understand the risk or simply cannot get access to an appropriate conversation to discuss the risk. The enclosed is a further report…
The U.S Cybersecurity and Infrastructure Security Agency (CISA) has released a Hardware Bill of Materials Framework (HBOM), for Supply Chain Risk Management (SCRM). The framework provides a baseline document for organizations to identify and name assets across their supply chains.…
Thank you for posting Ted Dziekanowski. One has always questioned the inertia of boards to address cybersecurity risk management, and these figures support the view that boards are not ready to address cybersecurity regulation. We have written many times about…
The UK Financial Conduct Authority issued a dear CEO letter to the insurance market last week. A letter that discussed Putting consumers’ needs first and the regulators wish for firms to demonstrate that products meet customers needs and provide value.…
The SEC final rule sets out clear accountabilities and responsibilities for cybersecurity risk management oversight, assurance and attestation by boards, board subcommittees and accountable executives. As the Uber case demonstrated the CISO is an accountable executive. The board will be…
The EU has taken a broad integrated approach to cybersecurity risk management regulation. Be that through the EU Cybersecurity Act, EU NIS 2 Directive, Digital Operational Resilience Act (DORA), the Resilience of Critical entities Directive, the proposed Cyber Resilience Act…
You will spend money to manage cyber. New York state’s attorney general is forcing a college to invest $3.5 million into cybersecurity after a 2021 data breach. The attorney general’s office began its investigation of the situation in August 2022,…
