52 articles · 2025 · page 1 of 3
Articles
Week of 29 December 2025
The 2026 state privacy laws split institutional exemptions from data exemptions
Many banks and health systems answer state privacy laws with one line: “GLBA or HIPAA exempts us.” Three laws that took effect on January 1, 2026 showed why that line needs a citation, and why exempting an organization differs from exempting its data.
Week of 22 December 2025
Legal to fly, hard to replace: the FCC drone listing and public-safety fleets
The FCC’s December 22 action grounded no police or fire drone. It closed the door on new foreign-made models, turning every agency drone program into a question of spare parts, software support and who pays for the next fleet.
Week of 15 December 2025
Crypto trust charters and community banks: the binding decision sits in the core
The OCC’s conditional approval of five crypto trust banks gave smaller banks and credit unions credible custody partners. The harder problem drew less notice: how any of it would show up in the ledger, statements and reports their core systems produce.
Week of 8 December 2025
Why the AI preemption order barely reached health care’s own AI rules
December 2025’s executive order aimed federal pressure at broad state AI laws. But most AI rules health systems actually follow sit in licensing, insurance and privacy law, where preemption arguments are weakest. The order’s real risk ran through vendors.
Week of 1 December 2025
Under Regulation S-P, the firm that knows least about a breach tells the most customers
The SEC’s amended Regulation S-P took effect for larger firms on December 3, 2025, making notice to customers after a breach the default. Whether a firm could notify narrowly depended on evidence it had to keep long before anything went wrong.
Week of 24 November 2025
SitusAMC turned a mid-tier mortgage vendor into a top-tier bank exposure
A breach at SitusAMC, a real estate finance services firm few people had heard of, reached some of the largest U.S. banks. Vendor rankings built on spend and operational importance had missed a company holding sensitive data for many institutions at once.
Week of 17 November 2025
For EU consumer lenders, the credit-scoring deadline that mattered was never the AI Act’s
Brussels proposed delaying the AI Act’s high-risk rules, and credit scoring seemed to get breathing room. For consumer lenders it was a mirage: the GDPR, as Europe’s top court read it, and the Consumer Credit Directive’s November 2026 date still set the pace.
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
On November 10, 2025, Defense contracts began carrying CMMC cybersecurity requirements. Most eyes went to assessment levels, but the bigger change was a senior executive’s signature, which turned security claims into dated statements to the government with real legal weight.
Week of 3 November 2025
For SNAP systems, paying less was harder than paying nothing
During the 2025 shutdown, court orders pushed states toward partial and then full November SNAP food benefits within days. The systems that calculate, load and explain those benefits were built for paying in full or not at all, and paying less proved hardest.
Week of 27 October 2025
NYDFS’s final Part 500 deadline put the asset inventory underneath every other control
New York’s final cybersecurity deadline, November 1, 2025, paired multi-factor login for everyone with a maintained inventory of every system. The login rule got the attention. The inventory was harder, and the annual sign-off by named executives made both personal.
Week of 20 October 2025
One region failed, many financial apps stalled: concentration risk sat in the dependencies
One Amazon Web Services region in Virginia faltered in October 2025, and financial apps that looked resilient on paper stalled anyway. The weak points were shared services and slow recoveries, so the answer is mapping dependencies and rehearsing degraded service, not reflexive multi-cloud.
Week of 13 October 2025
Why Windows 10’s end of support split every hospital fleet in three
Windows 10 support ended and hospital computers split into three groups: those IT controls, those medical device makers control and those nobody clearly controls. Reporting them as one migration hid where the real risk sat, and only the first group had a simple answer.
Week of 6 October 2025
Cl0p’s Oracle campaign: an attack on the systems security teams did not run
Cl0p’s Oracle E-Business Suite extortion wave worked because the finance system sat with finance, not security. Closing that gap takes three decisions: who can pull the plug in an emergency, what faces the internet, and how much old data the system keeps.
Week of 29 September 2025
How the lapse of a 2015 law put counsel in the threat-sharing loop
The 2015 law protecting cyber threat sharing expired as the October 2025 shutdown began, and sharing did not stop. But every warning sent outside the building picked up a legal question, and teams without written rules found analysts waiting on lawyers.
Week of 22 September 2025
Persistence below the patch: what ED 25-03 asked agencies to prove about their firewalls
CISA’s Emergency Directive 25-03 described attackers who hid inside the startup code of Cisco firewalls, surviving restarts and upgrades. Applying a fix was no longer enough. Agencies had to prove each device could be trusted, and that the fix was the right one.
Week of 15 September 2025
Approval is easy, monitoring is hard: the Joint Commission’s AI guidance and the work after go-live
In September 2025, the Joint Commission and the Coalition for Health AI issued guidance that looked like a governance checklist. Most of its weight fell after go-live, on monitoring and safety reporting that depend on vendor contract terms few hospitals had negotiated.
Week of 8 September 2025
Why bank change control never saw the npm hijack
In September 2025, poisoned versions of widely used open-source code were live for about two hours. Bank change control was built to approve the code people write. This attack came in through code the build process fetched by itself, which nobody approves.
Week of 1 September 2025
The CAT’s retirement freed the framework and orphaned the risk profile
Regulators retired the tool community banks had used for a decade to check their cybersecurity on August 31, 2025. Most banks quickly picked a new framework. Fewer noticed they had also lost the step that told them how much security their business needed.
Week of 25 August 2025
OAuth integrations make their vendors custodians of your credentials
The Salesloft Drift data theft began inside a vendor, not inside any customer’s Salesforce. Approving an integration hands that vendor a standing key to your data, and most vendor reviews never asked how the key was kept.
Week of 18 August 2025
How a fee question pulled open banking off the rulebook and onto the rate card
By asking whether banks may charge for customer data access, the CFPB’s August 2025 notice moved open banking’s rules from regulation into contracts. Big banks could set prices, smaller ones would inherit them through vendors, and fintechs would redesign around them.