All news with #dora tag

🔒 European policymakers are accelerating a push for greater tech sovereignty in response to shifting geopolitical trust and concerns over dependence on US and other foreign technologies. The debate spans legal, operational and supply-chain dimensions, with proposals under the EU’s Tech Sovereignty Package and revisions to procurement and the Cybersecurity Act. Achieving autonomy will require investment in local R&D, talent, interoperable systems and realistic timelines, while avoiding protectionist measures that stifle competition. The private sector must factor geopolitical risk into procurement to scale credible European alternatives.

🔐 DORA's Article 9 makes credential management a binding financial risk control for EU financial entities, requiring least-privilege access, phishing‑resistant FIDO2/WebAuthn authentication, and cryptographic key protection. The regulation extends to third-party providers and mandates evidenceable controls. Organisations must deploy vaulting, JIT access, and continuous monitoring to reduce dwell time and meet supervisory expectations.

⚠️ Boards and executive teams can no longer treat large vulnerability backlogs as a tolerable nuisance: agentic AI has collapsed attackers’ cost and speed of exploitation. Security leaders must present operational truth — not just compliance metrics — about current High and Critical findings, remediation timelines, and exposure costs. Boards should demand measurable remediation programs and a plan to reduce vulnerability accrual at the source. Regulation such as CRA and DORA raise legal and financial stakes, and 'patch faster' is not a complete answer when emergency fixes risk production outages.

🔎 This Fortinet podcast episode examines the evolving EU-centric cybersecurity regulatory landscape and its implications for global businesses. Host Joe Robertson speaks with Dr. Tommaso De Zan of Access Partnership about layered rules such as NIS2, the Cyber Resilience Act, DORA, and emerging cloud sovereignty initiatives. They contrast horizontal and vertical regulations, highlight differences between regulations and directives, and emphasize that industry accepts rules but resents uncertainty. Practical advice includes early policy monitoring, engagement in consultations, and embedding security into products and operations.

🛡️ Google Cloud outlines an AI-driven approach to operational resilience for financial institutions, using Gemini Enterprise to generate context-aware incident scenarios based on a customer's real production data. The Technical Account Management team ingests logs, architecture, SLAs and support history to craft bespoke timelines that test cross-functional response and communication. The program supports DORA readiness and has driven immediate remediation actions and process changes.

🔍 The John Lewis Partnership’s platform team redefined how it measures the value of its internal developer platform, moving beyond simple tenant counts. They began with lead-time metrics for service creation, onboarding and first-customer deliveries, then adopted DORA metrics and a Technical Health score to capture operational quality and resilience. Combining telemetry with developer-experience feedback helped prioritise paved roads, automate change handling and simplify security assurance to reduce friction and speed delivery.

🔍 John Lewis moved beyond simple adoption counts to measure whether its internal developer platform actually delivered value. Initially the team tracked practical lead-time metrics — Service Creation Lead Time, Onboarding Lead Time, and First Customer Lead Time — to show speed to production and prioritize improvements. Over time they adopted DORA metrics, centralized telemetry in BigQuery and dashboards, automated change handling, and introduced a Technical Health score to guide investments and reduce developer friction.

🔍 John Lewis Partnership outlines a pragmatic approach to selecting monitoring metrics for its developer platform, stressing that impressive numbers alone don't prove platform health. They pair objective DORA benchmarks with recurring qualitative engineer feedback via DX, and track feature adoption and technical hygiene through a custom Backstage plugin. Individual checks run as small jobs, results land in BigQuery, and insights are surfaced as aggregated views, per-team tasks, and leaderboards to drive targeted improvements.

🔍 FINRA partnered with Google Cloud to adopt the DORA metrics and a data-first DevOps approach to shorten lead times and modernize its software lifecycle. A DORA workshop revealed lengthy User Acceptance Testing (UAT) cycles as a primary bottleneck, enabling a multi-million-dollar business case for a dedicated sandbox to accelerate testing and deployment. The initiative standardized DORA across teams and targets full adoption within the year.

🔒 The year 2025 tightened the regulatory landscape—DORA and NIS2 pushed many organizations to elevate cybersecurity and operational resilience. CISOs expect 2026 to remain dominated by compliance complexity, persistent cost pressures, and an acute skills shortage. Attention will shift toward Resilience by Design, software supply-chain security, and operationalizing Zero Trust for identities and machine accounts. Controlling Shadow AI and strengthening third-party risk management will also be high priorities.

🔒 Raphael Reiß, CISO at Vaillant Group, warns that rising geopolitical tensions and increasingly professional cybercriminals — now aided by AI — have lowered the barrier to complex attacks. Vaillant applies a holistic, multilayered security approach that spans IT, global production and customer-facing products, combining preventive and reactive controls. Reiß emphasises people-first awareness training and pragmatic compliance with standards such as NIS2, DORA and the Cyber Resilience Act. His advice is direct: analyse your starting point and start rather than wait.

🔐 Amazon Web Services has been designated a critical third-party provider (CTPP) by the European Supervisory Authorities under the EU’s DORA regulation, which took effect in January 2025. The designation establishes a formal oversight relationship between AWS and the ESAs and signals heightened regulatory engagement for financial services customers operating in the EU. AWS says it will continue investing in compliance, operational resilience, risk management, and transparency, and will support customers with documentation, whitepapers, and a dedicated security and compliance team to help meet DORA obligations.

🔒 Google Cloud EMEA has been designated a critical ICT third-party provider under the EU DORA. The designation acknowledges the systemic importance of financial entities using Google Cloud services and establishes a direct oversight channel with a Lead Overseer from the ESAs. Google Cloud commits to transparency, customer support for compliance, and collaboration to strengthen digital operational resilience across Europe. They provide resources like a Register of Information Guide and an ICT Risk Management Customer Guide to support customers' compliance journeys.

🛡️ Financial institutions face a regulatory shift: cyber‑resilience has moved from best practice to prescriptive requirement under regimes such as DORA, CORIE, MAS TRM, FCA/PRA and others. Filigran’s OpenAEV combines tabletop crisis playbooks with breach-and-attack simulation so teams can rehearse human and technical responses together. The platform synchronizes players via enterprise IAM, translates threat intelligence into timed technical injects and simulated communications, and streamlines logistics, reporting and continual improvement. OpenAEV is free for community use, with a library of scenarios and SIEM/EDR integrations, and Filigran is hosting expert sessions to demonstrate operationalization.

🔒 In this Deputy CISO post, Freddy Dezeure of Microsoft explains how recent EU laws are reshaping cybersecurity for critical infrastructure. He argues that NIS2 and DORA broaden the CISO role across IT, OT, IoT, AI, and supply chains and push for stronger board-level accountability. The piece emphasizes a risk-based, prioritized approach—focusing on a few high-impact controls such as phishing-resistant multifactor authentication, comprehensive asset inventory, timely patching, and resilience testing.

🔐 Fortinet’s CISO Collective outlines priorities and risks CISOs will face in 2026. The briefing warns that AI will accelerate innovation while expanding attack surfaces, increasing LLM breaches, adversarial model attacks, and deepfake-enabled BEC. It highlights geopolitical and space-related threats such as GPS jamming and satellite interception, persistent regulatory pressure including NIS2 and DORA, and a chronic cybersecurity skills gap. Recommendations emphasize governed AI, identity hardening, quantum readiness, and resilience-driven leadership.

🔐 The article argues that the traditional CISO role must evolve into a Chief Risk Architect, shifting focus from purely technical controls to enterprise resilience and business continuity. It emphasizes anticipating disruptions, minimizing operational impact, and demonstrating recovery capabilities to regulators, partners, and shareholders. Required skills now include risk quantification, ERM, threat detection, geopolitical awareness, and fluency with regulations like NIS2, DORA and the AI Act. It also stresses reporting to the board or CEO to gain strategic influence and attract future talent.

🔐 Ransomware intrusions increasingly begin with compromised identities: recent analyses attribute roughly three quarters of incidents to stolen or misused credentials. Defenses must shift from infrastructure-centric controls to identity-first models like Zero Trust, combining RBAC, MFA and context-aware authentication. Adaptive, risk-based access and passwordless methods reduce friction while improving detection and auditability. Regulatory regimes such as NIS2 and DORA further mandate auditable access controls.

🔒 A growing majority of CISOs report being pressured to hide breaches, with a Bitdefender survey finding 69% instructed to keep incidents confidential, up from 42% two years earlier. Security leaders say attackers increasingly prioritize stealthy data theft rather than disruptive encryption, making breaches less visible to the public. Regulatory regimes such as GDPR, NIS2 and DORA complicate disclosure decisions, while experts warn that concealment multiplies legal, financial and reputational risk and recommend robust, transparent incident response plans.

🔒 A new CIISec survey finds 69% of security professionals believe current cybersecurity laws are insufficient. The annual State of the Security Profession report, compiled from CIISec members and the wider community, highlights a regulatory focus driven by recent legislation such as DORA, NIS2 and the EU AI Act. Respondents assign breach responsibility mainly to boards (91%), and indicate increasing support for senior management sanctions. CIISec's CEO urges improved collaboration, regulation literacy and clearer risk communication.