Cyber Regulations

Government regulations impacting cyber security and cyber insurance.

EU Countries Blow Off New Cyber Security Regulations & European Commission Is Not Pleased

by

The European Commission has launched “infringement procedures” against a majority of its member states for failing to meet an October deadline to enact EU cyber security regulations. The regulations come in two packages: the NIS2 Directive, aimed at enhancing cyber security and the Critical Entities Resilience (CER) Directive, focused on safeguarding critical infrastructure. “The Commission … Read more

SEC Hits Firms with Millions in Fines for Inadequate Cyber Disclosures; Sparks Dissent on Commission

by

Four companies have settled charges by the Securities and Exchange Commission (SEC) that they made “materially misleading disclosures” after being breached in 2020 by the SolarWinds’ Orion software hack (US public companies have been required to disclose material cyber events since last year, see this.) But two of five SEC commissioners dissented on the charges, … Read more

Ransomware Response Must Evolve: Deputy National Security Adviser Calls for Ban on Ransomware Payments

by

Anne Neuberger, the U.S. Deputy National Security Adviser for Cyber and Emerging Technology, wrote an opinion piece in the Financial Times on the evolving nature of ransomware attacks and the need for an updated response. This piece revisits the issue of banning ransomware payments, a topic we’ve previously covered as the ransomware crisis continues to … Read more

Bitsight Launches Enhanced Cyber Risk Management Features for EU Regulation Compliance

by

In response to the European Union’s stringent new Network and Information Security Directive cybersecurity regulations (NIS2), Bitsight, a global cyber risk management firm, has announced significant investments to enhance its third-party risk management solutions in Europe. These investments aim to help businesses comply with the NIS2 Directive, which mandates stronger cybersecurity measures and improved risk … Read more

New SEC Rule Requires Companies to Report Cyber Incidents, FBI Offers Guidance on Delaying Disclosure

by

Starting December 18, 2023, publicly traded companies in the US will be required to disclose material cybersecurity incidents to the Securities and Exchange Commission (SEC). If an organization determines a cyber incident is “material,” the event must be disclosed within four business days. The FBI, working with the Department of Justice, has released guidance for … Read more

×