354 articles · page 3 of 18
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Indiana, Kentucky and Rhode Island brought comprehensive privacy laws into force on January 1, 2026. For banks and health systems, exposure turned on whether each statute exempted the organization or only its regulated data, and that answer keeps changing.
Week of 22 December 2025
Legal to fly, hard to replace: the FCC drone listing and public-safety fleets
The FCC’s December 22 action did not ground a single police or fire drone. It blocked new foreign-made models, which turned agency drone programs into a question of spares, software support and replacement budgets.
Week of 15 December 2025
Crypto trust charters and community banks: the binding decision sits in the core
The OCC’s conditional charters made federally supervised digital-asset custodians a realistic option for smaller banks and credit unions. The harder decision was how any of it would reconcile to the general ledger, statements and reports their core platforms produce.
Week of 8 December 2025
Why the AI preemption order barely reached health care’s own AI rules
The December 2025 executive order aimed federal pressure at broad state AI laws. Most of the AI rules health systems actually follow sit in licensing, insurance and privacy law, where preemption arguments are weakest, so the order’s main risk lay with vendors.
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
When the amended Regulation S-P took effect for larger firms on December 3, 2025, notice became the default. Whether a firm could notify narrowly depended on evidence it had to keep before any incident.
Week of 24 November 2025
SitusAMC turned a mid-tier mortgage vendor into a top-tier bank exposure
The SitusAMC breach reached some of the largest U.S. banks through a real estate finance services provider. Vendor tiering built on spend and operational criticality missed a firm that held sensitive data for many institutions at once.
Week of 17 November 2025
For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s
The Commission’s proposal to delay high-risk AI obligations looked like relief for credit scoring. For consumer lenders, the binding constraints were the GDPR as the EU’s top court had read it and the Consumer Credit Directive’s November 2026 date.
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
When CMMC requirements began appearing in Defense contracts on November 10, 2025, attention went to assessment levels. The senior official’s affirmation mattered more, because it turned security claims into dated representations with legal weight.
Week of 3 November 2025
For SNAP systems, paying less was harder than paying nothing
During the 2025 shutdown, court orders pushed states toward partial and then full November SNAP payments within days. Eligibility logic, EBT issuance and public communication were each built for benefits paid in full or not at all.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s last amended cybersecurity deadline, November 1, 2025, paired universal MFA with a maintained asset inventory. MFA drew the attention. The inventory was harder, and the executive certification made both personal.
Week of 20 October 2025
One region failed, many financial apps stalled: concentration risk sat in the dependencies
The October 2025 us-east-1 outage hit financial apps whose own designs looked resilient. The exposure lay in shared services and recovery backlogs, so the response is dependency mapping and tested degraded modes, not reflexive multi-cloud.
Week of 13 October 2025
Why Windows 10’s end of support split every hospital fleet in three
Hospital endpoints fell into machines IT controls, machines device makers control and machines nobody clearly controls. Reporting them as one migration hid where the residual risk sat, and only the first group had a simple answer.
Week of 6 October 2025
Cl0p’s Oracle campaign: an attack on the systems security teams did not run
The Oracle E-Business Suite extortion wave succeeded because ERP sits with finance, not security. Closing the gap means settling emergency authority, shrinking what faces the internet and cutting what the application retains.
Week of 29 September 2025
How the lapse of a 2015 law put counsel in the threat-sharing loop
When the Cybersecurity Information Sharing Act expired as the October 2025 shutdown began, sharing did not stop. Each outbound indicator acquired a legal question, and teams that had never written down who approves sharing found analysts waiting on lawyers.
Week of 22 September 2025
Persistence below the patch: what ED 25-03 asked agencies to prove about their firewalls
CISA’s Emergency Directive 25-03 described attackers who altered Cisco firewall boot firmware to survive reboots and upgrades. The burden shifted from applying a fix to proving that each device could be trusted, and that the fix was the right one.
Week of 15 September 2025
Approval is easy, monitoring is hard: the Joint Commission’s AI guidance and the work after go-live
The September 2025 Joint Commission and CHAI guidance read like a governance checklist. Most of its weight fell after go-live, on monitoring and event reporting that depend on vendor contract terms few hospitals had negotiated.
Week of 8 September 2025
Why bank change control never saw the npm hijack
Malicious versions of widely used JavaScript packages were live for about two hours in September 2025. Bank change control approves code people write; this attack arrived in code the build pipeline fetched on its own, which nobody approves.
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
When the FFIEC retired its Cybersecurity Assessment Tool on August 31, 2025, attention went to picking a replacement framework. The harder loss was the inherent risk profile, the step that told a bank how much security it needed.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft started in a vendor’s environment, not in any customer’s Salesforce org. Approving an integration hands a vendor a standing credential, and most third-party reviews never asked how that credential was kept.
Week of 18 August 2025
How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for data access, the CFPB’s August 2025 notice shifted open banking terms from regulation into contracts. Large banks could set prices, smaller institutions would inherit them through vendors, and data users would have to redesign around them.