Compliance Insights &amp; GRC Guidance

For GRC LeadersRead article

CBOM Readiness: What to Inventory Before Federal Guidance Arrives

You don t need to wait until March 2027 for CISA and NIST to publish a Cryptography Bill of Materials (CBOM) standard. The executive order issued on June 22 sets a timeline for defining what should be

Should We Start FedRAMP 20x or Finish Rev5?

Audit & Certification

Should We Start FedRAMP 20x or Finish Rev5?

Context: Questions from CSPs in Transition I ve been fielding these questions for months in Slack channels, during pre-engagement calls, and from teams halfway through their Rev5 implementations who j

Hacking Drives 88.5% of Healthcare Breaches: Audit Priorities

For Internal AuditorsRead

4 min read

Hacking Drives 88.5% of Healthcare Breaches: Audit Priorities

In May 2026, healthcare data breaches rose 27.1% from the previous month, yet the number of affected individuals dropped by 34.8%. The HHS Office for Civil Rights breach portal recorded 61 large breac

Third-Party Vendor Access: Build a Control Framework That Works

Third-Party Vendor Access: Build a Control Framework That Works

When an external IT service provider breaches your customer database, you re the one facing regulatory penalties and customer backlash. The incident at Lidl, where attackers accessed customer data thr

For GRC LeadersRead

Newsletter

Stay Ahead of Threats

Get weekly security insights and compliance updates delivered to your inbox.

Subscribe Now

KEV Catalog Remediation Script: Automate Your CISA Vulnerability Response

KEV Catalog Remediation Script: Automate Your CISA Vulnerability Response

Your security team just got word that CISA added four new entries to the Known Exploited Vulnerabilities Catalog. You ve got SonicWall SMA1000 appliances and Microsoft infrastructure in your environme

For CISOsRead

SharePoint Patching Isn't Enough: 5 Myths About Server Hardening

For IT Security TeamsRead

4 min read

SharePoint Patching Isn't Enough: 5 Myths About Server Hardening

When CISA adds three CVEs to its Known Exploited Vulnerabilities Catalog in a single quarter, you re facing more than a theoretical risk. CVE-2026-32201, CVE-2026-45659, and CVE-2026-56164 represent a

Phishing to Settlement: A Field Guide to Post-Breach Response

Phishing to Settlement: A Field Guide to Post-Breach Response

A 90-minute email account compromise cost Lucent Health Solutions up to $1.95 million in settlement costs and 15 months of reputational damage. This guide walks you through the regulatory requirements

For Risk ManagersRead

Missing Authentication in ICS: Patch, Segment, or Retire?

Technical Controls

For IT Security TeamsRead

Missing Authentication in ICS: Patch, Segment, or Retire?

You re dealing with CVE-2026-10577, a CVSS 10 vulnerability in your Rockwell Automation 1715-AENTR EtherNet/IP Adapter. An unauthenticated debug port is exposed, allowing remote attackers to access co

Cookie Banner Complaints: What the EDPB VRT Decision Means for Your DPA Strategy

For Data Privacy OfficersRead

Cookie Banner Complaints: What the EDPB VRT Decision Means for Your DPA Strategy

During a recent working group call with privacy officers from Belgium, Austria, and the Netherlands, a pressing issue emerged. The EDPB s 28 May 2026 binding decision under Art.65(1)(a) General Data P

Accelerated Rulemaking: Five Compliance Traps to Avoid

Regulations & Laws

7 min read

Accelerated Rulemaking: Five Compliance Traps to Avoid

The U.K. government is granting the Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) more flexibility to make regulations without full consultations. For compliance officers

Vastaamo Breach: How 33,000 Patient Records Led to Finland's Largest Criminal Case

For Data Privacy OfficersRead

Vastaamo Breach: How 33,000 Patient Records Led to Finland's Largest Criminal Case

What Happened In 2018, an attacker compromised Vastaamo, a Finnish psychotherapy provider, extracting a database containing records for approximately 33,000 patients. The breach remained undetected un

Defense Contractors: Your CMMC Compliance Playbook After the Phase II Suspension

Audit & Certification

Defense Contractors: Your CMMC Compliance Playbook After the Phase II Suspension

The Department of War suspended CMMC Phase II on July 13, 2026, but DFARS 252.204-7012 remains in effect. Your obligation to protect covered defense information is still contractually binding, and you

Scoping Your ESP Boundary: A CMMC Checklist for MSPs

Governance & Controls

Scoping Your ESP Boundary: A CMMC Checklist for MSPs

If your managed services infrastructure interacts with Controlled Unclassified Information (CUI), you re classified as an External Service Provider under the Cybersecurity Maturity Model Certification

NIST's New Triage Model: One Team's Shift from Federal Scores to Risk Ownership

Identity & Access Management

NIST's New Triage Model: One Team's Shift from Federal Scores to Risk Ownership

The Challenge When NIST announced in April that it would no longer enrich every CVE record, your security and risk teams faced a pressing question: how do you prioritize vulnerabilities without the fe

For GRC LeadersRead

Passkey Enrollment Script for Microsoft Entra ID

4 min read

Passkey Enrollment Script for Microsoft Entra ID

Starting September 1, 2026, Microsoft will make passkeys the default authentication method. To avoid a help desk crisis, you ll need a systematic way to transition users from SMS and voice authenticat

For CISOsRead

Coordinated Cyber Sanctions: What Security Engineers Need to Know

For Regulatory Affairs ProfessionalsRead

Coordinated Cyber Sanctions: What Security Engineers Need to Know

Scope This guide explores the operational and strategic implications of coordinated cyber sanctions, focusing on the UK and EU s joint sanctions package targeting Russian state-sponsored cyber operati

Should We Care About CISA's KEV Catalog?

For Internal AuditorsRead

Should We Care About CISA's KEV Catalog?

Why This Matters I ve spent the past month talking to internal audit teams about vulnerability management, and the same questions keep coming up: Why should we follow federal directives if we re not a

Should You Hire External Forensics for Every Breach?

Should You Hire External Forensics for Every Breach?

The Question at Hand When your security team flags suspicious network activity, you face an immediate decision: do you bring in third-party cybersecurity experts to investigate, or handle the incident

For Risk ManagersRead

Router Configs That Get You Breached: 5 Fixes

For IT Security TeamsRead

Router Configs That Get You Breached: 5 Fixes

Your routers might be leaking configuration files to foreign intelligence agencies right now. This isn t due to carelessness, but because the default settings on most enterprise networking gear priori

GDPR Enforcement Gaps: What Regulators Won't Tell You

Data Privacy

GDPR Enforcement Gaps: What Regulators Won't Tell You

Ten years after the General Data Protection Regulation (GDPR) took effect, you re still hearing conflicting advice from your legal teams in different EU markets. This isn t because GDPR is unclear; it