Topic
Compliance
articles.
Beyond the 8-K: Building the Evidence File Before You Have Four Days to Decide Materiality
The SEC gives you four business days after you determine an incident is material. The hard part is the determination, and the record of how you made it.
Operating Across a Half-Transposed NIS2 Map
Twenty-three member states have transposed. Several have not, and seven have been referred to the Court of Justice. Multinational entities are compliance-planning against a moving target.
Immutable Is Not the Same as Verifiable: A Buyer's Guide to Audit Trail Claims
Immutable storage prevents changes; verifiable proof lets any third party confirm that they never happened. Eight questions to tell the two apart in a vendor proposal.
The FIPS 140-2 Sunset and Why Your Integrity Proofs Need a Crypto Inventory
On 21 September, the remaining FIPS 140-2 certificates move to historical status. The immediate impact is procurement.
DORA and NIS2 Overlap: Building One Evidence Layer for Dual-Regulated Financial Entities
DORA takes precedence over NIS2 for financial entities, but mixed groups and ICT providers still answer to both. How to collect evidence once and report it twice.
You Registered. Now What? Portugal's NIS2 Obligations After the Deadline
Registration closes today. The incident reporting clock, the management accountability provisions, and the supervisory relationship all start tomorrow.
Geofencing and Data Residency: Proving Where Your Data Was Accessed From, Not Just Where It Lives
Residency requirements are usually implemented as a storage decision. Regulators increasingly care about a second question that storage location does not answer.
DORA's First Oversight Cycle: What CTPP Designation Means for the Firms That Depend on Them
The ESAs named their first critical ICT third-party providers. Most of the commentary focused on the providers. The more interesting consequences land on their customers.
CMMC Phase 2 Is Suspended, Not Cancelled: How European Suppliers Should Spend the Pause
The Department of Defense paused Phase 2 in July and guidance is expected in mid-September. The pause is an opportunity, and the work that pays off either way is evidence work.
The EU Network Code on Cybersecurity: The Energy Rulebook Sitting on Top of NIS2
Electricity operators are subject to a second, sector-specific cybersecurity regime that most NIS2 readiness programmes ignore entirely.
Portugal's NIS2 Registration Deadline Is Days Away: What to Submit on MyCiber and What to Keep
The 60-working-day registration window opened by CNCS closes in mid-September. Registering is the easy part - the evidence you keep afterwards is what an audit will actually test.
The Long Life of a Signature: Post-Quantum Integrity for Records You Must Keep for Decades
Today's signature algorithms may not survive quantum computing, but many records must. How to separate the proof of integrity from the signature and plan the transition.
Portugal's NIS2 Supervisor Opens Its First Audits: What CNCS Is Actually Checking
Decreto-Lei 125/2025 gave Portugal its NIS2 framework. The audits now beginning are where it gets tested against real organizations.
DORA's Register of Information: The Third-Party Risk Deadline Most Financial Firms Are Quietly Missing
The Register of Information is the least discussed and most operationally demanding requirement in DORA. Here is why it keeps tripping up firms that consider themselves compliant.
ISO 42001 vs NIST AI RMF: Where the Data Integrity Gap Actually Lives
Both frameworks tell you to govern your AI data. Neither tells you how to prove, independently, that you actually did.
Inside Germany's NIS2 Enforcement Wave: What the BSI's Formal Orders Reveal
Dozens of formal supervisory orders are already active in Germany. Here is what they suggest about how NIS2 will actually be enforced across the EU.
How to Build an AI Decision Audit Trail That Actually Survives Regulatory Scrutiny
Logging that a model made a decision is not the same as proving why, on what data, and whether that data can be trusted.
Saudi Arabia's PDPL and SDAIA: What International Companies Must Verify Before Entering the Kingdom
Saudi Arabia's Personal Data Protection Law reaches beyond its borders. If your organization touches data on Saudi residents, it likely applies to you already.
Model Cards Are Not Data Provenance: Why Documentation Alone Won't Satisfy Regulators
A model card tells you what a team says about a model. It doesn't prove any of it. Regulators are starting to notice the difference.
UAE PDPL and the ADGM Cyber Risk Framework: A Compliance Map for Entering the Gulf Market
Between a national data protection transition, a new financial-sector cyber framework, and a post-quantum mandate, the UAE's regulatory picture in 2026.
CMMC 2.0 Phase 2 Is Coming: What European Suppliers to US Defense Contracts Need to Know
From November 10, 2026, third-party CMMC certification becomes a precondition for contracts involving controlled unclassified information - including for non-US subcontractors.
NIS2 Enforcement Tracker: The First Fines Are In, and Four Member States Are Headed to Court
Belgium, Italy, Hungary, and Lithuania have issued confirmed penalties. Ireland, Spain, France, and the Netherlands now face the Court of Justice of the EU.
ROOTKey August 2026 Update: Automated Retention, Organization-Wide Compliance Reports, and a Redesigned Fleet Dashboard
What shipped in July, and how it changes the daily compliance workflow for ROOTKey customers.
July 2026: What This Month's Regulatory Activity Means for Digital Trust
One month into the EU AI Act high-risk application period. One month after NIS2's first audit deadline. Here is what we learned.
Cryptographic Audit Trails: How They Work and Why Regulators Now Require Them
Standard audit logs can be modified. Cryptographic audit trails cannot. Here is the difference, and why it matters for compliance.
Blockchain for Compliance in 2026: Beyond the Hype, Into the Use Cases
After years of overpromising, blockchain has found its real enterprise use case - and it is not cryptocurrency.
The CISO's Guide to Regulatory Compliance in 2026: NIS2, DORA, and EU AI Act
Three major EU frameworks are now in effect simultaneously. Here is how to manage all three without duplicating your compliance programme.
Building Cyber Resilience for SMEs: A Practical 2026 Guide
SMEs now represent 43% of all cyberattack targets - this guide shows how smaller organizations can build genuine resilience without enterprise budgets.
Healthcare Cybersecurity in 2026: NIS2, GDPR, and the Data Integrity Gap
Healthcare is the most targeted sector for cyberattacks in Europe. NIS2 makes it an essential entity sector. Here is what that means.
How to Use the ROOTKey NIS2 Simulator: A Compliance Team's Guide
Step-by-step: how the ROOTKey NIS2 Simulator maps your obligations, scores your compliance posture, and generates the audit-ready evidence your regulators will ask for.
ISO 27001 vs NIS2: What Compliance Teams Need to Know in 2026
ISO 27001 certification does not mean NIS2 compliance. Here is where they overlap, where they diverge, and what you still need to do.
SEC Cybersecurity Disclosure Rules: What US Companies Must Know in 2026
With the June 2026 compliance deadline now passed, US public companies face active enforcement risk - and board-level cybersecurity accountability is no longer optional.
DORA ICT Third-Party Risk Management: The Technical Implementation Guide for 2026
DORA is in full effect for EU financial entities. The ICT third-party risk management requirements are the hardest to operationalise. Here is how.
NIS2 in Portugal: What Decreto-Lei 125/2025 Means for Portuguese Organisations
Portugal transposed NIS2 into national law in late 2025. Here is what changed, what deadlines apply, and what compliance requires.
eIDAS 2.0 and the EUDI Wallet: What Enterprises Must Know Before December 2026
Europe's mandatory digital identity rollout is months away - here is what regulated organizations must do now to prepare for EUDI Wallet integration.
EU AI Act Data Governance Requirements: The Enterprise Guide for 2026
The EU AI Act is not just about AI model compliance - its data governance obligations are the harder problem for most enterprises.
DORA Compliance in 2026: How Financial Institutions Build Defensible Resilience
With DORA now in full enforcement, financial institutions need more than paper policies - they need verifiable, audit-ready evidence that holds up under supervisory scrutiny.
GDPR Article 5 and AI: What Data Integrity Requirements Actually Mean in 2026
GDPR's accuracy and storage limitation principles have always required data integrity. AI deployments make enforcement a near certainty.
NIS2 First Audit Deadline: What European Organizations Must Do Next
The June 30 deadline has passed - here is how to move from reactive compliance to continuous, machine-verifiable evidence.
No articles found. Try a different term.
Explore other categories to find relevant content
Stay in the loop
Cyber-resilience
insights.
Get cyber-resilience insights in your inbox. Practical, audit-ready guidance on data integrity, compliance and continuity, delivered as we publish.