President Joe Biden signed the Strengthening American Cybersecurity Act into law in March of 2022. The Act consists of various regulations, but it’s the security incident reporting requirements that are creating a stir in the IT community. Currently, the reporting requirements are focused on critical infrastructure, but there is a great deal of potential that entities in various industries could ultimately be subject to these requirements.

When the General Data Protection Regulations (GDPR) and ePrivacy Directive (EPD) updated we saw a proliferation of “cookie consent” banners crop up on websites as a direct result. The key parts of the GDPR relating to this change are from Recital 30: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags.

The Digital Finance Strategy is a European directive that aims to support and develop digital finance in Europe whilst maintaining financial stability and consumer protection. There are three main components to the package: In this blog post, we’ll attempt to summarise the 113-page DORA proposal, highlighting how it will apply to incident management at financial entities.

Any mature industry, at some point, will be regulated by local, state, or federal laws. Restaurants did not always have to have food safety inspections. Gas stations did not always have to have pumps calibrated and certified. Vehicles have not always required seat belts. As a society, we are well served by these regulations that help keep us safe and protect consumer interests.