https://cybersecuritytracker.ai/?cats=regulatoryCurated cybersecurity news and vulnerability intelligence.Sun, 26 Jul 2026 22:32:50 GMThttps://darkreading.com/cybersecurity-operations/cisos-vs-boards-myth-or-misunderstanding-cst-3196Boards are increasing focus on security due to rising threats, yet communication gaps remain between board members and chief information security officers (CISOs). Both groups report needing additional resources and better dialogue to close the divide.Fri, 24 Jul 2026 21:31:53 GMThttps://cyberscoop.com/cisa-circia-cyber-incident-reporting-rule-feedbackcst-3198Industry groups told CISA during town halls on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) that they want the rule to cover fewer companies, require fewer incident reports, and demand less detailed information when reporting does occur. The rule, which Congress designed to require critical infrastructure owners to report major cyberattacks within 72 hours and ransomware payments within 24 hours, has missed multiple finalization deadlines, with CISA now targeting September for completion. Industry representatives expressed concerns about the scope affecting over 300,000 entities, the burden of reporting minor intrusion attempts, and the sensitivity of sharing security measure details.Fri, 24 Jul 2026 20:58:35 GMThttps://techcrunch.com/2026/07/24/us-accuses-american-of-allegedly-wiping-his-phone-using-a-duress-password-during-border-searchcst-3194A U.S. citizen is challenging a government claim in court that he provided border authorities with a passcode that erased his phone's data. The case raises constitutional questions about privacy protections and what individuals must disclose during border searches.Fri, 24 Jul 2026 17:53:30 GMThttps://silentpush.com/blog/the-soci-act-obligationscst-3176Australia's Security of Critical Infrastructure Act 2018 (SOCI Act) imposes cyber risk management, incident reporting, and asset registration requirements on organizations operating in eleven critical sectors including energy, finance, healthcare, and transport. The framework has evolved significantly over the past two years, with additional changes currently under consultation, and increasingly emphasizes proactive threat visibility and defense rather than reactive incident response.Fri, 24 Jul 2026 12:49:17 GMThttps://bleepingcomputer.com/news/security/fedramp-rev5-is-ending-what-the-20x-transition-really-requirescst-3101FedRAMP 20X replaces the current Rev5 model by shifting from periodic security assessments to continuous, machine-readable evidence that validates control effectiveness. Organizations must transition to this evidence-based assurance approach to maintain compliance with the updated federal security framework.Thu, 23 Jul 2026 14:00:10 GMThttps://bleepingcomputer.com/news/google/eu-fines-google-1-billion-for-digital-markets-act-breaches-in-search-and-play-storecst-3083The European Commission issued a €890 million fine to Google for violating the Digital Markets Act, which regulates fair competition in digital markets. The penalty addresses breaches related to the company's search and app store practices.Thu, 23 Jul 2026 12:33:19 GMThttps://darkreading.com/data-privacy/eu-financial-institutions-cookie-trackerscst-3004European banks inadvertently sent customer data to ad platforms through tracking pixels embedded in their websites, creating unintended data flows to third parties. The incident raises compliance and privacy concerns under European data protection regulations. Security practitioners face potential exposure across multiple financial institutions sharing similar web infrastructure patterns.Wed, 22 Jul 2026 11:30:00 GMThttps://bleepingcomputer.com/news/microsoft/microsoft-exchange-2016-and-2019-esu-program-ends-in-octobercst-2999Microsoft will conclude its Extended Security Update program for Exchange 2016 and 2019 in October, ending security patch availability for those versions. Organizations using these legacy systems will need to plan migrations or accept the operational risk of running unsupported software.Wed, 22 Jul 2026 10:44:52 GMThttps://bleepingcomputer.com/news/security/the-future-of-age-verification-your-face-never-leaves-your-devicecst-2792Age verification laws are driving demand for privacy-preserving alternatives to traditional biometric collection. On-device age estimation processes facial data locally without transmitting or storing images, allowing organizations to meet regulatory mandates while minimizing biometric privacy exposure.Sat, 18 Jul 2026 13:15:24 GMThttps://databreaches.net/2026/07/18/ny-attorney-general-james-secures-18-million-from-23andme-for-failing-to-protect-customers-genetic-data?pk_campaign=feed&pk_kwd=ny-attorney-general-james-secures-18-million-from-23andme-for-failing-to-protect-customers-genetic-datacst-2793New York Attorney General Letitia James and a coalition of 42 state attorneys general secured an $18 million settlement from genetic testing company 23andMe for failing to protect customers' genetic data. The enforcement action stems from inadequate security practices that exposed sensitive information. California's Attorney General has also initiated separate litigation against the company under state privacy laws.Sat, 18 Jul 2026 12:13:13 GMThttps://securityweek.com/industry-reactions-to-pentagon-suspending-cmmc-phase-2-feedback-fridaycst-2759The Department of Defense suspended the Cybersecurity Maturity Model Certification (CMMC) Phase 2 program, which paused third-party audits of defense contractors. Industry stakeholders acknowledged that while the audit moratorium is in effect, the legal requirement to protect controlled unclassified information (CUI) remains in force.Fri, 17 Jul 2026 11:08:04 GMThttps://bleepingcomputer.com/news/microsoft/windows-server-2022-reach-end-of-mainstream-support-in-90-dayscst-2743Windows Server 2022 enters the final 90 days of mainstream support and will transition to extended support in October 2026, continuing to receive security updates through 2031. Microsoft's support model ensures organizations have a multi-year window to plan upgrades or transitions to newer server versions.Fri, 17 Jul 2026 09:10:15 GMThttps://therecord.media/ofcom-investigation-tiktok-age-verificationcst-2697Ofcom, the UK's communications regulator, is investigating TikTok for potentially inadequate age-verification measures that may have exposed children to harmful content. The regulator emphasized that age checks are fundamental to compliance with UK online safety requirements and indicated that many services lack sufficient verification systems.Thu, 16 Jul 2026 16:15:00 GMThttps://bleepingcomputer.com/news/microsoft/windows-11-24h2-home-and-pro-reach-end-of-support-in-90-dayscst-2668Microsoft announced that Windows 10 Enterprise LTSB 2016 and Windows 11 24H2 Home and Pro editions will reach end of support on May 13, 2025, concluding the 18-month support window for the 24H2 version. Organizations and individuals using these editions must plan upgrades or transitions to supported versions before updates cease.Thu, 16 Jul 2026 11:59:24 GMThttps://helpnetsecurity.com/2026/07/16/cyber-insurance-coverage-gapcst-2646The global cyber insurance market reached approximately $16 billion in premiums in 2024, with coverage now widespread across regulated industries, though payouts have become less predictable. The Global Federation of Insurance Associations identified a significant protection gap of roughly $900 billion, indicating a substantial mismatch between actual cyber exposures and available coverage.Thu, 16 Jul 2026 06:00:55 GMThttps://therecord.media/genetic-testing-settlement-data-breachcst-2620Forty-two state attorneys general negotiated an $18 million settlement with 23andMe following a data breach caused by inadequate cybersecurity measures. The settlement addresses regulatory enforcement action against the genetic testing company for its security practices.Wed, 15 Jul 2026 17:45:00 GMThttps://darkreading.com/cyber-risk/nigeria-cybersecurity-efforts-cybercriminals-profitscst-2556Nigeria enacted new cybersecurity regulations requiring organizations to disclose cyberattacks, aligning with global trends toward mandatory breach notification. The policy aims to increase transparency and awareness of security incidents across the country's business and government sectors.Wed, 15 Jul 2026 08:00:00 GMThttps://darkreading.com/cyber-risk/manage-vendor-risk-in-a-few-practical-stepscst-2520A brief piece outlines that managing vendor risk requires understanding risk tolerance, gaining visibility into exposures, and obtaining board-level oversight through disciplined governance approaches.Tue, 14 Jul 2026 17:44:55 GMThttps://securityweek.com/pentagon-suspends-cmmc-phase-2-as-it-rethinks-contractor-cybersecurity-rulescst-2456The Pentagon has suspended the second phase of the Cybersecurity Maturity Model Certification (CMMC) program and established a task force to conduct a comprehensive review of contractor cybersecurity requirements. The decision indicates the defense department is reconsidering its approach to the certification framework.Tue, 14 Jul 2026 06:37:50 GMThttps://therecord.media/eu-proposed-social-media-ban-kids-under-13cst-2446European Commission President Ursula von der Leyen indicates that EU leaders are moving toward establishing a minimum age requirement for social media access, potentially around 13 years old, though final decisions remain with parents and member states. The statement reflects growing consensus among European policymakers that age-based restrictions on social media use warrant coordinated action.Mon, 13 Jul 2026 20:50:00 GMThttps://therecord.media/chat-control-2-csam-scans-european-parliament-passagecst-2351The European Parliament approved Chat Control 2.0, legislation that authorizes major technology companies including Google, Meta, and Microsoft to scan user messages for child sexual abuse material (CSAM). The law enables automated detection systems to identify and report such content to authorities.Fri, 10 Jul 2026 19:30:00 GMThttps://helpnetsecurity.com/2026/07/10/trouble-with-data-broker-deletion-requestscst-2302UC Irvine researchers tested deletion requests with California's data broker registry to understand compliance. The study found that most data brokers fail to provide confirmation or transparency about what happened to consumer deletion and sales-stop requests.Fri, 10 Jul 2026 06:30:46 GMThttps://wired.com/story/a-majority-of-european-lawmakers-voted-against-letting-big-tech-read-our-messages-theyre-going-to-anywaycst-2264European lawmakers rejected a proposal to restrict tech companies' scanning of private messages for child abuse material, but companies intend to proceed with these surveillance practices anyway. The Chat Control bill enables automated scanning of personal communications across text, email, and social media platforms.Thu, 09 Jul 2026 13:55:08 GMThttps://therecord.media/eu-cyber-filing-ireland-spain-france-netherlands-nis2cst-2244The European Union has initiated legal action against Ireland, Spain, France, and the Netherlands for failing to transpose the NIS2 Directive into national law more than 20 months past the deadline. The directive establishes cybersecurity requirements for critical infrastructure operators across EU member states.Thu, 09 Jul 2026 13:10:02 GMThttps://ncsc.gov.uk/blogs/cyber-essentials-pathways-from-proof-of-concept-to-cyber-confidencecst-2234A new pathway to Cyber Essentials Plus certification has been introduced that maintains scheme integrity while offering an alternative route to the standard certification process.Thu, 09 Jul 2026 12:00:00 GMThttps://therecord.media/cash-app-owner-to-pay-45-million-security-allegationscst-2197Block, Inc., owner of Cash App, has agreed to pay $45 million to settle allegations from state attorneys general that it misrepresented the security protections offered to users. The settlement addresses claims that the company falsely promised Cash App users would receive bank-equivalent security safeguards.Wed, 08 Jul 2026 20:14:00 GMThttps://databreaches.net/2026/07/08/why-bangladeshs-new-data-protection-law-may-fail-to-protect-your-data?pk_campaign=feed&pk_kwd=why-bangladeshs-new-data-protection-law-may-fail-to-protect-your-datacst-2180Bangladesh's major retail chain Shwapno suffered a breach in August 2025 exposing personal data of 4 million customers, including names, phone numbers, and purchase histories. The company did not disclose the incident to affected customers for seven months, raising questions about the effectiveness of Bangladesh's data protection law in enforcing notification and transparency requirements.Wed, 08 Jul 2026 15:23:34 GMThttps://therecord.media/former-uk-privacy-chief-preparing-legal-action-against-woman-who-reported-himcst-2175The UK Secretary of State for Science, Innovation and Technology expressed strong disapproval of an independent investigation that found sexual harassment and bullying at the Information Commissioner's Office (ICO). The former privacy chief is reportedly preparing legal action against a woman who reported the allegations.Wed, 08 Jul 2026 14:20:00 GMThttps://risky.biz/risky-bulletin-all-new-cars-to-include-a-camera-aimed-at-the-drivers-facecst-2134The European Union has mandated that all new cars include an infrared camera monitoring the driver's face to detect distracted driving, with the same requirement set to take effect in the US next year. The camera tracks head position and eye movements to alert drivers when their attention drifts from the road. Privacy advocates have raised concerns about the continuous facial surveillance capability.Wed, 08 Jul 2026 05:33:30 GMThttps://securityweek.com/the-shift-toward-business-aligned-risk-managementcst-488Organizations are moving toward risk management practices that connect security controls to business outcomes rather than treating security as an isolated technical function. This approach emphasizes continuous monitoring and assessment of risk throughout its lifecycle, enabling better alignment between security investments and actual organizational impact.Mon, 06 Jul 2026 15:20:42 GMThttps://darkreading.com/cybersecurity-analytics/aussies-face-reduced-cybercrime-risk-pressure-shifts-smbscst-76Australian institutions have strengthened cybersecurity safeguards and regulatory frameworks, shifting the burden of cyber protection and risk mitigation toward small and medium-sized businesses (SMBs). This consolidation of defenses at larger organizations means SMBs now face proportionally greater exposure to cyber threats without equivalent resources or regulatory support.Thu, 02 Jul 2026 23:01:00 GMThttps://therecord.media/supreme-court-decision-threatens-eu-us-data-sharingcst-128Max Schrems, founder of privacy advocacy group noyb, has informed European officials of his intention to sue to invalidate the EU-U.S. Data Privacy Framework (DPF), which governs the transfer of personal data from the EU to U.S. companies. This legal challenge reflects ongoing concerns about the adequacy of U.S. data protection standards and enforcement mechanisms under the agreement. The outcome could disrupt data flows between the regions if the framework is invalidated.Thu, 02 Jul 2026 16:50:00 GMThttps://bleepingcomputer.com/news/legal/google-loses-final-appeal-to-overturn-41-billion-eu-finecst-9Google's final appeal against a €4.1 billion European Union antitrust fine has been dismissed by the Court of Justice of the European Union. The fine, originally issued in 2018, penalized the company for using Android to promote its Chrome browser and search service. The dismissal marks the end of Google's legal challenge to the penalty.Thu, 02 Jul 2026 15:18:51 GMThttps://techcrunch.com/2026/06/29/in-major-privacy-win-supreme-court-rules-geofence-warrants-are-protected-by-privacy-rightscst-465The Supreme Court has ruled that geofence warrants are subject to privacy protections under the Constitution, limiting their use by law enforcement. The decision represents a significant privacy win against what civil liberties advocates had characterized as an unconstitutional surveillance method.Mon, 29 Jun 2026 16:05:23 GMThttps://huntress.com/blog/how-to-identify-dod-cui-clientscst-663The article provides guidance for managed service providers and managed security service providers to identify whether their clients are Department of Defense contractors that handle Controlled Unclassified Information (CUI). This helps service providers understand their clients' regulatory obligations and security requirements.Thu, 25 Jun 2026 14:00:00 GMThttps://darkreading.com/cybersecurity-operations/ciso-code-of-ethicscst-113Industry expert Robert Hansen argues that chief information security officers should adopt a formal code of ethics to address conflicts of interest, self-dealing, and other practices that could compromise enterprise and national security. A code of ethics could establish professional standards for CISOs navigating vendor relationships, investment decisions, and other activities where personal interests might diverge from organizational security objectives.Wed, 24 Jun 2026 19:10:17 GMThttps://rapid7.com/blog/post/so-nis2-compliance-turn-readiness-into-resiliencecst-373The NIS2 directive imposes stricter requirements on covered organizations including structured risk management, governance accountability, supply chain oversight, and accelerated incident reporting timelines (24 hours for early warning, 72 hours for notification). Beyond compliance interpretation, organizations must operationalize these requirements across their business through clearer ownership, incident response processes, and supply chain monitoring to achieve true resilience rather than checkbox compliance.Mon, 15 Jun 2026 17:29:15 GMThttps://rapid7.com/blog/post/so-aligning-security-programmes-with-nis2-requirementscst-374The NIS2 Directive significantly expands EU cybersecurity regulation, applying to more sectors and requiring organizations to demonstrate that controls work continuously rather than maintain policies. Key requirements include risk management measures, incident reporting within strict timelines (24 hours for early warning, 72 hours for full notification), and executive accountability, shifting the focus from periodic compliance to continuous operational readiness.Mon, 15 Jun 2026 17:24:20 GMThttps://risky.biz/risky-bulletin-in-the-age-of-ai-cisa-changes-federal-patching-rulescst-174CISA issued a new binding operational directive updating federal civilian agency patching requirements, prioritizing vulnerabilities based on risk factors including active exploitation, ease of automation, and broad system access. The directive cites AI-automated attacks as motivation for the rule change and shortened patching deadlines.Fri, 12 Jun 2026 04:57:27 GMThttps://huntress.com/blog/fedramp-alternative-for-defense-contractorscst-677Huntress has implemented Sensitive Data Mode to provide logical data separation, allowing defense contractors to achieve CMMC (Cybersecurity Maturity Model Certification) compliance without requiring FedRAMP authorization. This approach offers a more cost-effective and faster alternative to using FedRAMP-authorized cloud services for contractors handling sensitive defense data.Fri, 05 Jun 2026 14:00:00 GMThttps://huntress.com/blog/cmmc-msp-readiness-checkcst-681The article advises managed service providers (MSPs) to conduct thorough internal audits of their operations before pursuing Cybersecurity Maturity Model Certification (CMMC) compliance for Department of Defense contracts. CMMC should be approached as a comprehensive operating model rather than a checklist, with particular attention to access controls and data handling practices. MSPs need to ensure their internal processes can withstand the scrutiny required for defense work.Wed, 27 May 2026 14:00:00 GMThttps://huntress.com/blog/cybersecurity-frameworkscst-692This article provides an overview of 13 cybersecurity frameworks and guidance for organizations to select the appropriate framework based on their specific needs and use cases. The piece aims to help security leaders understand different framework options available in 2026.Thu, 14 May 2026 18:00:00 GMThttps://huntress.com/blog/cmmc-final-rule-guide-for-dod-subcontractorscst-694The Department of Defense (DoD) has finalized the Cybersecurity Maturity Model Certification (CMMC) rule, establishing a November 2026 deadline for DoD subcontractors to achieve Level 2 compliance. Security vendors are offering tools and monitoring services to help organizations meet these requirements.Thu, 14 May 2026 04:00:00 GMThttps://halcyon.ai/blog/how-public-sector-organizations-protect-their-communities-without-breaking-the-budgetcst-2003The article discusses cost-effective security strategies that public sector organizations can implement to protect their communities and constituents. It examines budget constraints and practical approaches for maintaining adequate security posture within financial limitations.Thu, 30 Apr 2026 19:57:21 GMThttps://risky.biz/risky-bulletin-uk-ncsc-blasts-soc-metricscst-198The UK National Cyber Security Centre (NCSC) has cautioned organizations against using performance metrics that prioritize speed or volume to evaluate security operations center (SOC) effectiveness. According to NCSC officials, such metrics incentivize careless work and rushing through security alerts rather than thorough threat investigation. The agency argues that SOC value derives from analytical insight and threat detection quality, not operational efficiency measures used for other IT functions.Wed, 29 Apr 2026 02:24:26 GMThttps://risky.biz/risky-bulletin-nist-gives-up-enriching-most-cvescst-204The National Institute of Standards and Technology (NIST) announced a shift in its National Vulnerability Database (NVD) policy to enrich only a subset of vulnerabilities due to capacity constraints. Going forward, NIST will prioritize enrichment for vulnerabilities deemed critical to the safe operation of U.S. government and private sector networks, rather than attempting to enhance all reported flaws.Fri, 17 Apr 2026 04:11:35 GMThttps://risky.biz/srsly-risky-biz-it-is-time-to-ban-sale-of-precise-geolocationcst-205Citizen Lab released a report documenting Webloc, a geolocation data platform sold by Penlink that claims access to records from up to 500 million mobile devices globally, including location coordinates and device identifiers sourced from mobile apps and advertising networks. The analysis raises concerns about national security and privacy risks from the widespread commercial availability of precise geolocation data in the United States. Security researchers argue that stronger regulatory controls are needed to restrict collection and sale of such data.Thu, 16 Apr 2026 05:03:57 GMThttps://wiz.io/blog/fedramp-incident-responsecst-1337This article discusses how Wiz for U.S. Government addresses FedRAMP Revision 5 incident response controls and detection benchmarks through cloud detection and response capabilities. The piece concludes a series on Agile FedRAMP compliance by focusing on reactive risk management within cloud environments.Fri, 06 Mar 2026 12:00:01 GMThttps://wiz.io/blog/wiz-cpstic-certificationcst-1338Wiz has achieved CPSTIC certification in Spain, a credential that signals compliance with cloud security standards for the country's public sector. This certification positions the company to support government and public administration organizations in their cloud modernization efforts.Tue, 03 Mar 2026 20:46:57 GMThttps://halcyon.ai/blog/circias-next-chapter-five-things-ill-be-listening-for-in-cisas-town-hallscst-2025The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) is emerging as a potentially significant regulatory framework for the cybersecurity sector. The article discusses what to expect from upcoming CISA (Cybersecurity and Infrastructure Security Agency) town halls regarding CIRCIA's implementation.Tue, 03 Mar 2026 15:34:49 GMT