43 articles · 2026 · page 1 of 3
Articles
Week of 26 October 2026
OPM’s staffing-plan rule tucked a systems certification into a personnel regulation
OPM’s October 29 rule made workforce planning a quarterly data feed, moved the employee survey to agencies and had agency heads certify that their systems let HR leaders see the workforce. CIOs will carry much of it, on HR systems awaiting replacement.
Week of 19 October 2026
A lost zone is the failure banks plan for. Google’s London outage tested five layers of that plan
A power failure took down one zone of Google Cloud’s London region on 20 October 2026, the loss multi-zone banking systems are built to absorb. Services stalled anyway. Surviving a lost zone depends on five layers, and each has to be tested.
Week of 12 October 2026
Ivanti’s October zero-day was a directory incident that came in through the VPN
CISA gave agencies three days to patch and triage Ivanti Connect Secure. The attacker left no implant on the gateway and used its directory account to hunt for administrator passwords and BitLocker keys. Permissions set long before decided how far that reached.
Week of 5 October 2026
Rural health transformation money runs on three clocks, and only two of them come with funding
In October 2026 states hurried to commit their first-year Rural Health Transformation money. For rural providers, the deadline that matters most comes later, when the grants end and the technology they bought has to pay its own way.
Week of 28 September 2026
Paused, not repealed: what CMMC’s suspension left defense contractors paying for
Six weeks before CMMC third-party certification was due to start, it sat suspended with no new date. Defense contractors setting budgets had to sort security spending into what was still owed, what could wait and what had changed price.
Week of 21 September 2026
Agency certificates now expire faster than agency budgets turn over
On October 1, 2026, the first day of the federal fiscal year, the first full-term 200-day website certificates ran out. Agencies built to buy, staff and schedule them once a year had to rethink all three.
Week of 14 September 2026
Hospital device data rights arrive one purchase order at a time
From September 12, 2026, the EU Data Act required new connected products to give users their data by design, but only for equipment marketed from then. Hospitals replace scanners slowly, so tenders carry the new right while older equipment runs on requests.
Week of 7 September 2026
Europe’s 24-hour vulnerability clock reports to regulators first and customers second
From September 11, 2026, Europe’s Cyber Resilience Act gave manufacturers 24 hours to warn authorities when attackers exploit a flaw in their products. Customers must be told too, but on no fixed clock, so buyers still need their own way to hear about it.
Week of 31 August 2026
Bank cyber gaps now arrive as observations the board never has to see
Two bank regulators narrowed formal findings to problems that threaten material financial harm, a year after a shared cyber checklist was retired. Many cyber weaknesses will now arrive as informal observations, so banks must decide for themselves what reaches the board.
Week of 24 August 2026
Health systems inherit the patients that IAL2 proofing turns away
Verified digital credentials were starting to unlock patient records across networks. For most people that is a welcome shortcut. Patients who cannot get one still depend on their health system, which needs deliberate routes for checking identity in-house and through people who vouch.
Week of 17 August 2026
The dollar AI deals ended in a meter, and meters need ceilings
For a year, federal agencies got leading AI assistants for about a dollar. Six weeks before those deals expired, nobody knew what came next. Pay-as-you-go pricing was the likely answer, and it turns a procurement question into a budgeting one.
Week of 10 August 2026
Post-quantum signatures are still being chosen, so build PKI to switch twice
Digital signatures had moved up the post-quantum to-do list, yet two years after NIST’s first standards the choice of signature scheme was still open. Sort signatures by how long they must stay trustworthy, and design each group to change twice.
Week of 3 August 2026
Article 50 kept its date, and it lands on the chat window
The EU pushed back its high-risk AI obligations weeks before August 2, 2026, but the transparency duties arrived on time. For banks, insurers, hospitals and agencies serving Europeans, the work now sits in chat windows, content pipelines and publishing sign-off.
Week of 27 July 2026
Why WISeR providers should keep their own record while Congress argues
The Senate’s July vote left Medicare’s AI-assisted prior authorization model running in six states, its future still disputed. Providers bound by it need their own record of decisions, documentation and appeals, a record that serves daily operations and the policy fight alike.
Week of 20 July 2026
Stablecoin rules late, statutory clock on time: the GENIUS Act’s awkward first year
Regulators missed the GENIUS Act’s July 2026 deadline for stablecoin rules, but the law’s January 2027 backstop date stayed put. Banks could not wait for final text to choose their role, and the question of deposits ran through every choice.
Week of 13 July 2026
Fedwire’s ISO 20022 switch gave banks rich payment data their core systems still truncate
A year after Fedwire switched to ISO 20022, the richer payment message reached most US banks intact. The value inside it often did not, lost at the customer’s keyboard, inside banks’ own systems, or in screening and fraud tools never set up to read it.
Week of 6 July 2026
Medicaid’s frailty test asks for a code and proof of impairment, and clinicians hold both
CMS’s June 2026 rule tied Medicaid’s “medically frail” exemption from work requirements to a coded diagnosis from the past year plus evidence the condition limits work. Suddenly, medical coding, doctors’ paperwork and data sharing help decide who keeps their coverage.
Week of 29 June 2026
July 1 in teaching hospitals: thousands of joiners, movers and leavers in one week
Every July, US teaching hospitals welcome a wave of new doctors, promote others and say goodbye to graduates, all in one week. It is the biggest identity and access event of their year, and its four parts each fail in their own way.
Week of 22 June 2026
Why Europe’s accessibility law turns every bank release into evidence
A year after the European Accessibility Act began to apply, banks serving EU consumers have found that accessibility wears away with every release, new template and vendor update. What lasts is a steady, running record of evidence across four parts of the service.
Week of 15 June 2026
The client-certificate deadline that moved, and the certificate authorities that didn’t wait
Chrome pushed back its deadline for using public web certificates to prove a client’s identity, to March 2027. Certificate authorities kept their own, earlier schedules. For any system-to-system link that relies on one, the real deadline belongs to whoever issues the certificate.