The SEC’s new ‘Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure’ rule (issued on July 26, 2023) has public companies, notably smaller companies, worrying about having enough cybersecurity expertise to run a security program consistent with SEC requirements.

The SEC cybersecurity disclosure rules have put a spotlight on the issue of cybersecurity within organizations. The core of the rules and related guidance can be found in the article “Assess Your Readiness Now for the SEC Cybersecurity Disclosure Rules.“ The SEC cybersecurity disclosure rules should help build momentum around the importance of governance and risk management, relevant expertise, and timely incident disclosure that are fundamental to cybersecurity programs.

The European Union (EU) Artificial Intelligence Act is a key landmark legislation that represents one of the first laws to go into effect regarding the application and use of artificial intelligence (AI) technology. This historic regulatory framework was created to govern the use, development, and deployment of AI systems within the EU and establish an operational cyber framework for businesses.

When we think of “property,” the first thing that comes to our mind might be tangible objects—items we’ve purchased, like cars and homes, or entitlements we’ve procured, like land, titles, or even honorifics. However, there is another type of property that includes intangible ownership, creations of the mind, and various assets of a nonphysical nature.

As the primary financial services regulator of the Cayman Islands, the Cayman Islands Monetary Authority (CIMA) is responsible for managing and protecting the assets of all Cayman Islands banks, which includes its cybersecurity and risk management strategies. CIMA does this mainly through the Rule and Statement of Guidance – Cybersecurity for Regulated Entities, which establishes regulatory laws and guidelines to safeguard the security posture of its regulated entities.

‘EU Dora’ is the answer from the European Commission to the rising tide of cyber risks facing financial institutions with resilient ICTs. It introduces mandatory measures for organisations to strengthen their digital operational resilience.

The online platform industry is growing exponentially as more organizations and individuals turn to digital resources for everyday needs. In 2022, the European Union introduced the Digital Markets Act (DMA), a groundbreaking piece of legislation to curb monopolistic practices of major online platforms while promoting fair competition across the highly saturated European market.

Is your business unknowingly at risk? The stakes are high when it comes to how businesses handle personal data. A staggering 90% of people have made it clear: they won’t support companies who don’t prioritize data privacy and protection. This is no small concern – tech giants like Facebook and Google have fueled a global debate on privacy, often finding themselves in legal trouble after mishandling user data.

‍ ‍No organization, no matter the industry, is exempt from suffering from a cyber attack. The European Union formally recognized this modern-day reality in late 2022 when it published Directive (EU) 2016/1148, more commonly known as the NIS 2 Directive. As an updated version of the original directive enacted in 2016, this newer, sweeping cybersecurity regulation expanded its original scope to encompass even more business sectors.

The Public Governance, Performance and Accountability Act 2013 is a key piece of legislation that establishes a framework of governance, performance, and accountability for Australian government and Commonwealth organizations. The PGPA Act’s main goal is to ensure that all government bodies practice effective management of public resources and are transparent in their activities.

The General Data Protection Regulation (GDPR) is a comprehensive data protection law covering the European Union (EU) and is widely regarded as one of the world’s strictest privacy regulations. The GDPR unifies data regulation within the EU and provides individuals control over their personal data. The GDPR includes information about Data Protection Officers (DPOs).

As organizations and businesses undergo digital transformations, so do criminals and other nefarious actors. In today’s modern era, criminal activity frequently occurs online through digital communication channels, providing avenues for phishing, data loss, and security breaches.

Privacy is the individual’s right to control the use of their personal data, and DSAR is the mechanism by which individuals can enforce this right. This right to their own information, as used by an organization, is guaranteed by privacy laws like Europe’s General Data Protection Regulation (GDPR) and the California Consumer Protection Act (CCPA). If your organization collects and uses personal data, especially for European or Californian customers, you should be prepared to respond to DSARs.

The Digital Operations Resilience Act (DORA) is an EU regulation that comes into force in January 2025, but it also impacts UK companies. DORA’s remit will likely cover any UK financial firm that works with EU customers or does business with EU financial firms.

It’s been almost three years since President Biden issued Executive Order 14028, and while we’ve heard vendors talk about “compliance with EO 14028” for about that long, the reality is that industry hasn’t had anything to comply with—until now. On March 11, CISA published the Secure Software Development Attestation Form as part of its obligations under OMB memo M-22-18 and the successor OMB memo M-23-16.

The EU AI Act (the “AI Act”) is the world’s first comprehensive AI law. The Act lays down a harmonised legal framework for the development, supply, and use of AI products and services in the EU.

The construction of a more cyber resilient European Union (EU) took a remarkable step forward this past week as negotiators from the European Parliament and the European Council reached a provisional agreement on the proposed Cyber Solidarity Act. Proposed last year, the Cyber Solidarity Act is composed of three key pillars that seek to crack the daunting challenge of detecting, preparing for, and responding to cybersecurity threats and incidents that shake up the security sphere.

Earlier this week, we debuted our mini-series on the SEC’s new cybersecurity rules. In case you missed it — and, understandably, don’t have the bandwidth to backtrack — Part I explored how the (seemingly perpetual) explosion in data creation, data value, and IT complexity since the dawn of the digital age has come to shape our society. In particular, we note why these trends are responsible for our current IT predicament, namely, the rise in threats, risks, and regulations.

Navigating the complex and ever-changing compliance landscape is difficult for many companies and organizations. With many regulations, selecting the appropriate security tooling that aligns with the compliance needs of your business becomes a significant challenge.

As the Principal Threat Intelligence Services Engineer and Trainer at ThreatQuotient, my role puts me in front of a diverse range of clients and partners across various industries, offering me a unique perspective on the impact of regulatory frameworks on cybersecurity. Through our European Union (EU) based clients and partners, I have seen the emergence of the need to be compliant with the Digital Operational Resilience Act (DORA).