357 articles · page 6 of 18
Articles
Week of 25 November 2024
Blue Yonder put process-running vendors at the top of the risk register
A ransomware attack on Blue Yonder left baristas and warehouse staff waiting on schedules and pay, and exposed a blind spot. Most vendor checks ask who holds your data. The better question is whose failure would stop your work.
Week of 18 November 2024
The CFPB reached for payment apps while the customer’s money sat at partner banks
The CFPB’s rule let federal examiners into the biggest payment apps, and it lasted under six months. With Synapse’s collapse still fresh, the more lasting exposure lay elsewhere: in the law apps already owed and in the banks holding their customers’ money.
Week of 11 November 2024
FinCEN’s deepfake alert was a job-design problem for three groups of staff
FinCEN’s November 2024 deepfake alert read like a checklist for compliance teams. Its harder message was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new authority, incentives and ways to escalate.
Week of 4 November 2024
After the 2024 election, a rule’s legal form predicted its survival better than its topic
Election week changed no rule, but it changed the odds for many. The best guide to which obligations would last was not their topic but their legal form: a statute, a rule still inside the Congressional Review Act window, or guidance and executive orders.
Week of 28 October 2024
Telehealth’s three policy clocks all ran down in December, so virtual care needed an annual cycle
After the 2025 fee schedule, whether a Medicare patient could see a clinician by video still hinged on three separate authorities, CMS, Congress and the DEA, each with a clock running down in December. Virtual care needed to be run as a yearly cycle.
Week of 21 October 2024
Final and already in court: sorting open banking work by how much you would regret it
The CFPB’s open banking rule was final and in court on the same day. Banks could neither wait out the lawsuit nor build blindly, so the smart move was sorting the work by how much each piece would be regretted if the rule fell.
Week of 14 October 2024
NYDFS wrote no AI rule, and made AI risk part of what the CEO certifies
New York’s October 2024 letter on AI and cybersecurity added no new rules. Because the CEO and security chief already sign a yearly compliance certification, though, it turned four AI risks into evidence those executives must be able to show.
Week of 7 October 2024
At American Water, containment was the part customers saw
After a cyberattack, America’s largest water utility kept the water flowing, but customers experienced the incident as a billing portal that went dark. For any utility or agency, what the public sees comes down to four decisions, and most can be made in advance.
Week of 30 September 2024
Saline exposed the risk that hides in a hospital’s cheapest line items
One flooded Baxter plant put IV fluids on ration across the country. Cheap essentials end up made in very few places because low prices reward scale, so hospitals should manage them by how critical they are to care, using four practical levers.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Most continuity plans prepare for losing a building or a computer system. Hurricane Helene took away people, phone and internet service, and the officials who sign off on decisions, across a whole region at once. Each needs its own preparation, years ahead.
Week of 16 September 2024
A hallucination rate is a sales claim, and Texas enforced it like one
Texas settled with Pieces Technologies by treating an AI tool’s advertised error rate like any other sales claim. Hospital leaders can test such a number on three counts: what it counts, where it was measured, and whether it stays true.
Week of 9 September 2024
Why o1’s reasoning summaries added work for clinical AI committees
OpenAI’s o1 explained its reasoning just as federal rules on clinical algorithm transparency were taking hold. A fluent explanation answers the clinician’s question, not the vendor’s or the regulator’s, so health systems still had to supply two other kinds of transparency themselves.
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
Europe’s new AI treaty covers AI used by public authorities and by private companies acting on their behalf. So an agency’s duties follow the service into its contractors, and the fuzzy edge of “on their behalf” is where governance gaps will open.
Week of 26 August 2024
Sea-Tac’s handwritten boarding passes were a staffing plan in disguise
Ransomware knocked out Port of Seattle systems, and the airport kept moving on paper and goodwill. “Revert to manual” turns out to be a promise about people: which work has a paper version, who does it, for how long, and who re-keys it afterward.
Week of 19 August 2024
National Public Data turned the Social Security number into a lookup key
One broker’s leaked files tied names, addresses, birth dates and Social Security numbers together. Those facts could still find a customer’s record but no longer prove who was asking, and sign-up, account recovery and risky changes each needed their own fix.
Week of 12 August 2024
Post-quantum priority starts in the records retention schedule
NIST’s first post-quantum standards settled what to move to. Deciding what to move first is harder, and for banks, health systems and agencies the answer sits in a surprising place: the records retention schedule.
Week of 5 August 2024
How the August 2024 selloff found brokerages’ capacity limit before the first trade
As markets tumbled on August 5, 2024, customers of large retail brokerages struggled to log in and see balances. The strain sat before the first trade, in three layers with different owners: identity checks, account views and shared vendors. No rule set the target.
Week of 29 July 2024
Systems contained, data exposed: why Columbus’s reassurance outran its evidence
Columbus could show early that it had contained the attack on its systems. It could not yet show what the stolen data held or whose it was. Each claim needs its own evidence, and borrowing confidence from one to answer the other costs trust.
Week of 22 July 2024
Why North Korea’s fake remote hires succeed in the gaps between HR, IT and security
KnowBe4 hired a remote engineer who turned out to be a North Korean IT worker. The scheme worked by slipping through four hand-offs owned by different teams. It fails when one verified identity follows the hire from interview to daily work.
Week of 15 July 2024
Channel File 291 measured every recovery plan in hands per device
One faulty CrowdStrike update turned millions of remotely managed Windows computers into a hands-on repair job. How fast each organization recovered came down to three things few plans covered: access to recovery keys, people at keyboards, and the order of repair.