Government · Regulation & Compliance
Articles in this selection, newest first. Change the filters, or clear them to see every article.
7 articles · Government · Regulation & Compliance
Articles
Week of 10 November 2025
CMMC’s first phase priced a signature, not a score
On November 10, 2025, Defense contracts began carrying CMMC cybersecurity requirements. Most eyes went to assessment levels, but the bigger change was a senior executive’s signature, which turned security claims into dated statements to the government with real legal weight.
Week of 24 March 2025
Why the Signal group chat was a channel design failure before it was a leak
A journalist added to a chat of senior officials made the headlines. For agencies at every level, the lasting failure was an approved channel that could not set content limits, confirm who was present and keep the record, all at once.
Week of 2 September 2024
Europe’s AI treaty attached its duties to the public function, not the payroll
Europe’s new AI treaty covers AI used by public authorities and by private companies acting on their behalf. So an agency’s duties follow the service into its contractors, and the fuzzy edge of “on their behalf” is where governance gaps will open.
Week of 1 July 2024
Records over deference: after Loper Bright, an agency’s best defense sat in its files
In five days, four Supreme Court decisions ended deference on what statutes mean, kept old rules open to new challengers, faulted an agency’s explanation and moved penalty cases to juries. What agencies could still defend lived in their records, which most managed badly.
Week of 27 June 2022
A rule’s survival odds belong in the compliance plan
West Virginia v. EPA gave courts a named test for striking down ambitious rules. That turned a rule’s survival into something agencies and regulated organizations must estimate: in writing new rules, defending existing programs and deciding when to spend on compliance.
Week of 24 May 2021
Twelve hours to report: the pipeline directive that set the clock for everyone
Less than three weeks after Colonial Pipeline, regulators gave critical pipelines twelve hours to report a cyber incident, a named coordinator on call around the clock and thirty days to grade themselves. All three ideas spread across sectors, and each needs different preparation.
Week of 27 January 2020
A 90-day declaration that ran for three years
The federal public health emergency declared on January 31, 2020, looked like a precaution. Then other powers, new laws and agency systems came to rest on it. Agencies needed to track what depended on it from day one, not when it ended.