Regulatory
Regulations, statutes, and legally-binding requirements — the EU CRA, NIS2, DORA, and similar.
The Executive Guide to the EU Cyber Resilience Act
What the CRA actually requires, who it applies to, and the concrete deadlines security, compliance, and product leaders need on their calendar.
NIS2 Transposition Status: Where EU Member States Actually Stand
The 17 October 2024 transposition deadline came and went with most member states still finalizing their national laws. Here's why that matters for your actual compliance date.
What the Board Actually Needs to Know About NIS2
Management-body liability is the detail that changes NIS2 from an IT compliance project into a governance question every board should already be asking about.
DORA Is Now Applicable: What Actually Changed on January 17, 2025
Unlike NIS2, DORA needed no national transposition — it became binding across the entire EU financial sector on a single day. Here's what that actually triggers.
DORA for Non-Financial-Services Executives: Why Your Vendors Might Already Be In Scope
You don't have to be a bank for DORA to matter to your business. If your customers are EU financial entities, their DORA obligations are quietly becoming your contract terms.
PCI DSS 4.0's Future-Dated Requirements Are Now Mandatory
The subset of PCI DSS v4.0 requirements that were 'best practice until' 31 March 2025 are now simply requirements. Expanded MFA is the one most organizations still have work on.
Incident Reporting Deadlines Are Converging — And Getting Shorter
NIS2's 24-hour early warning, DORA's incident classification timelines, and SEC cyber-disclosure rules are all part of the same regulatory trend: less time to figure out what happened before you have to say something.
CMMC 2.0's Program Rule Is Now in Effect — What Contractors Need to Know
32 CFR Part 170 is live. The DFARS acquisition rule that actually puts CMMC into contracts is rolling out separately, and on its own timeline.
Why Compliance and Security Teams Keep Reporting to Different Executives
The org-chart split between security (often reporting to the CTO/CIO) and compliance (often reporting to legal or the CFO) reflects a real historical divide that regulation is now quietly forcing organizations to bridge.
HHS Proposes Mandatory MFA and Encryption Under an Updated HIPAA Security Rule
The January 2025 NPRM would convert several 'addressable' safeguards into flatly required ones. It is proposed, not final — but the direction is clear.
The Quiet Standardization Around 24-Hour Breach Notification
24 hours keeps showing up as the first-notice window across unrelated regulatory regimes. That's not coincidence — it's converging on what's actually operationally achievable.
NIST SP 800-171 vs. CMMC Level 2: They're the Same Controls, Different Verification
CMMC Level 2 doesn't invent new security requirements — it verifies that contractors actually implemented the 110 controls NIST SP 800-171 already required them to self-attest to.
ISO/IEC 27001:2022 Transition Deadline: What Happens If You Miss It
Organizations certified under the 2013 version had a hard deadline, set by the International Accreditation Forum, to move to the 2022 controls. Here's what a missed transition actually means.