news

ISO/IEC 42001 is becoming a practical vendor requirement for AI companies as enterprise buyers, cloud customers and regulated clients ask for third-party proof that AI systems are governed, monitored and documented. The standard remains voluntary, but public certifications from AWS, Anthropic, OpenAI, Snowflake, Salesforce and ServiceNow show how fast it has moved into procurement, trust-center…

Organizations are extending ISO/IEC 27001 security programs to cover AI governance through ISO/IEC 42001, as AI systems create new risks that information security controls alone do not fully address. The move gives security, legal, risk and compliance teams a familiar management-system structure for AI inventories, model oversight, supplier controls, documentation and audit evidence.Why Are Organizations…

The Center for Internet Security’s CIS Controls v8.1 update turned a widely used cybersecurity baseline into a closer fit for NIST’s Cybersecurity Framework 2.0 and modern cloud environments, giving security teams a clearer route from board-level governance to technical safeguards. CIS released the update in June 2024, then followed with a NIST CSF 2.0 mapping…

The ISO 27001:2022 transition deadline has left organizations with old ISO 27001:2013 certificates exposed to certificate withdrawal, lost assurance claims, and customer contract risk after the global transition period closed on October 31, 2025. The latest confirmed post-deadline accreditation development came on January 1, 2026, when Global Accreditation Cooperation Incorporated began operations and took over…

The European Commission’s proposed NIS2 amendments would revise the EU’s flagship cybersecurity directive before many member states have fully settled their national rules, seeking to clarify scope, ransomware reporting, cross-border supervision, and the role of ENISA. The proposal, published on January 20, 2026, remains subject to approval by the European Parliament and the Council of…

SOC 2 audit quality is facing sharper scrutiny as companies rely more heavily on vendor reports to judge cybersecurity risk, while AICPA-linked guidance warns that fast, automated, and poorly scoped examinations can weaken trust in the control reports buyers use for due diligence. The latest confirmed update came in May 2026, when the AICPA Peer…

The U.S. government’s long-delayed CIRCIA rulemaking is still moving toward a final federal cyber incident reporting regime for critical infrastructure operators, after CISA revived public town halls in June 2026 to refine a draft rule criticized as broad, costly, and hard to reconcile with existing sector rules. No final rule had been published as of…

CISA’s Binding Operational Directive 26-04 has reset federal vulnerability management around risk, exposure and exploitation instead of severity scores alone. Issued on June 10, 2026, the directive requires Federal Civilian Executive Branch agencies to prioritize security updates using asset exposure, Known Exploited Vulnerabilities status, exploit automation and post-exploitation technical impact, with the most urgent cases…

CISA’s Secure By Design Pledge has become a current vendor security review signal after the agency listed 367 organizations as signers, giving software buyers a public checkpoint for supplier due diligence. The pledge remains voluntary, but CISA’s progress-report process and 7 product-security goals now give procurement, security and risk teams a sharper way to question…

DORA has made resilience testing a central compliance priority for Europe’s financial sector, requiring banks, insurers, investment firms, payment providers and other covered entities to prove that critical ICT systems can withstand disruption. The rule moved from preparation to active supervision after January 17, 2025, with threat-led penetration testing and incident reporting now shaping board-level…