Key Takeaways October 2025 Update New York’s landmark DFS Cybersecurity Regulation (23 NYCRR Part 500) is entering its final compliance stretch. On November 1, 2025, the last phase of...
Key Takeaways Risk is a moving picture. As organizations grow more digital, interconnected, and regulated, risks evolve. A vendor that looked safe yesterday may be compromised today. A control...
Key Takeaways Businesses are managing compliance on multiple fronts: cybersecurity standards, privacy regulations, third-party oversight, and sector-specific rules that change faster than budgets can adapt. Each requirement adds to...
Key Takeaways Artificial intelligence is being adopted at a remarkable pace. Enterprises now use AI in customer service, fraud detection, logistics, healthcare diagnostics, and dozens of other areas. With...
Audits are a cornerstone of security and compliance programs. They validate the strength of your controls and communicate trust to customers, regulators, and partners. At the same time, audits...
Key Takeaways The General Data Protection Regulation (GDPR) has become one of the most referenced and misunderstood privacy laws in the world. More than five years since its enforcement...
Key Takeaways For years, European companies have faced a patchwork of national laws pushing them to take responsibility for human rights and environmental issues tied to their business operations....
Key Takeaways What is an AI-Powered Risk Register? An AI-powered risk register is a centralized record of risks that is created, enriched, and kept current using artificial intelligence. It...
Key Takeaways What is a Compliance Program? A compliance program is the framework that organizations use to ensure they are meeting legal, regulatory, and contractual requirements. As you would...
TransUnion, one of the nation’s three major credit reporting agencies, has confirmed a cyberattack that exposed sensitive personal information for more than 4.4 million U.S. consumers. The incident, discovered...
Why AI governance needs a framework AI systems are embedded into business decisions, public services, and high-risk processes that directly affect people’s rights, opportunities, and safety. What many organizations...
Key Takeaways The Relationship Between CMMC and DFARS The relationship between DFARS and CMMC is often misunderstood. One is a legal mandate; the other is an enforcement model layered...
Key Takeaways Cloud computing has completely changed how organizations store data, run applications, and deliver services. But along with the benefits of scalability and flexibility comes a growing set...
Inotiv, a pharmaceutical research and drug development company based in Indiana, has disclosed a ransomware attack that encrypted parts of its IT environment and disrupted day-to-day operations. The company...
Key Takeaways SAQ eligibility depends on exactly how you accept payments, how you handle cardholder data, and how your payment systems connect to the rest of your environment. The...
A New Corporate Victim in a Broader CRM Exploitation Campaign Workday, one of the world’s leading human capital management (HCM) software providers, has confirmed it was impacted in a...
Eight new comprehensive state privacy laws took effect in 2025: Delaware, Iowa, Nebraska and New Hampshire on January 1, New Jersey on January 15, Tennessee on July 1, Minnesota...
Nvidia and AMD have reportedly reached an unprecedented agreement with the United States government to pay 15 percent of their revenues from certain chip sales in China in exchange...
Updated November 2026: the DFARS CMMC rule took effect November 10, 2025 (Phase 1). On July 13, 2026, the Department of War suspended Phase 2 pending a program review....
Two recent enforcement actions by the U.S. Securities and Exchange Commission (SEC) have drawn renewed attention to the personal liability risks faced by Chief Compliance Officers (CCOs). In both...
India’s capital markets regulator, SEBI (the Securities and Exchange Board of India), has proposed a set of changes to its oversight of related-party transactions (RPTs), the often-sensitive financial dealings...
Key Takeaways The Disconnect Between Cyber Risk and Business Strategy If you’re wondering why risk assessments often feel disconnected from business strategy, you’re not alone. ISACA and PwC have...
U.S. Data Breach Costs Just Hit $10 Million. What Does That Mean for You? New data from IBM’s 2025 Cost of a Data Breach Report reveals a significant shift:...
Key Takeaways Wherever your business takes you, risk will follow you closely. Whether you’re expanding into new markets, adopting cutting-edge technologies, or partnering with third-party vendors, risks are about...
Key Takeaways Technology touches just about everything we do at work. As tech tools get smarter and more connected, understanding digital and technology risk has become part of doing...
DORA’s regulatory technical standards (RTS) and implementing technical standards (ITS) are no longer drafts. The European Commission has adopted all of them as Commission Delegated and Implementing Regulations, published...
Key Takeaways Let’s start with a simple truth: PCI DSS doesn’t assign compliance levels. Surprised? Most people you talk to lump “Level 1” and “Level 4” merchants directly under...
Key Takeaways The Corporate Sustainability Reporting Directive (CSRD) aims to drastically improve transparency, accountability, and trust in corporate sustainability practices. The CSRD requires companies to integrate detailed, externally verified...
Key Takeaways ISO/IEC 42001:2023 is the first certifiable standard for Artificial Intelligence Management Systems (AIMS). Developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC),...
Key Takeaways The Cybersecurity Maturity Model Certification (CMMC) was developed to ensure the protection of sensitive data across the Defense Industrial Base (DIB). CMMC aligns with NIST SP 800-171...