All news with #grc tag

🔒 A Sophos survey of 300 C-level executives across the DACH region finds that budget shortfalls are the primary barrier to implementing planned cybersecurity measures, with roughly one in ten organisations abandoning initiatives due to cost. Manufacturing and retail report the highest incidence of cancelled projects, while service firms are least affected. The study also notes that technical complexity is rarely cited as a blocker and that some firms, notably in manufacturing, consciously accept cyber risk, with younger executives in Germany and Switzerland tending to be more risk tolerant.

🔍 The DHS Office of Inspector General (OIG) audit found that CISA misused federal funds and undermined its mission by broadly administering the Cyber Incentive program. The review identified 240 recipients in non-cyber support roles, poor record-keeping in OCHCO, and $1.4m in undocumented back pay among more than $138m disbursed since 2020. Payments typically ranged from $21,000 to $25,000 annually per person, more than 40% of staff received incentives, and the OIG issued eight recommendations to tighten eligibility, tracking, governance and recovery procedures; CISA has concurred with all recommendations.

🔒 CISOs face many behavioral and strategic traps that can stall or end careers if not addressed. Leaders, coaches and consultants identify ten common mistakes — from failing to align security with business priorities and treating security as a pure technology function, to reflexively saying no, enforcing rigid rules, misunderstanding AI, lacking transparency, not networking, and mishandling incidents. The article emphasizes becoming an enabler, tying controls to ROI, communicating clearly, and rehearsing response plans to build resilience.

🔐 Security leaders often struggle to show boards how cyber risk affects revenue, governance and growth. The sponsored course Risk Reporting to the Board for Modern CISOs was created to teach practical skills for framing risk in business terms: concise dashboards, high-impact presentations, and building financial and strategic business cases. It also introduces Continuous Threat Exposure Management as a forward-looking reporting model.

🔔 The California Privacy Protection Agency and the attorneys general of California, Colorado and Connecticut announced a coordinated enforcement sweep targeting businesses that fail to detect or honor Global Privacy Control (GPC) opt-out signals. Regulators will contact firms believed not to be processing consumers’ opt-out requests and urge immediate remediation. Legal advisers recommend technical steps — from reliable GPC signal recognition to consent management platform integration, routine testing and monitoring, and clear privacy notice updates — to reduce enforcement risk.

🔒 Security leaders are entering budget season facing skepticism; success now requires translating technical needs into clear business impact. Presentations that tie investments to revenue protection, uptime, regulatory compliance, and quantified loss avoidance resonate with boards. Adopt a risk-focused framework, define measurable KPIs such as time to detect and remediate, and employ continuous validation to expose exploitable weaknesses and track remediation velocity. Use standards like ISO 27001 and NIST as familiar anchors while showing real-world validation to avoid shelfware.

🧭 The article argues that the modern CISO role has become unmanageable for many practitioners and often fails to deliver meaningful, long-term change. It traces causes to short tenures, technologist backgrounds, and siloed corporate governance, and advocates splitting responsibilities by creating a senior CSO focused on business protection while returning the CISO to a technical, execution-oriented remit. The author urges CISOs to rebuild trust through demonstrable delivery rather than constant demands, and suggests this structural change will improve governance, tenure, and recruitment.

🔒 Security leaders must avoid career-limiting behaviors that erode trust and effectiveness. The article outlines 10 common missteps — from failing to align security with business priorities and remaining purely technical to drawing inflexible red lines and mishandling AI — that stall advancement. It stresses practical shifts: become a business partner, balance risk with speed, improve asset visibility, foster relationships, and rehearse incident response to maintain credibility.

🛡️ Cybersecurity leaders say board engagement is essential, but many CISOs—particularly in small and mid‑market organizations—report minimal or no access to full boards, according to a 2025 report from IANS and Artico Search. That lack of access strongly correlates with job dissatisfaction and short tenures. Experts recommend strengthening C‑suite relationships and framing cyber risk in business terms to secure board support.

🛡️ The CISSP is an advanced cybersecurity certification from ISC2 that validates a professional's ability to design, implement, and manage enterprise security programs. Candidates typically need five years of relevant work experience or may apply as an Associate of ISC2 while gaining experience, and must pass a rigorous exam covering eight domains. Exam registration costs US$749 and certified holders pay an annual maintenance fee; official and third-party training options are widely available, and CISSP holders often see improved job prospects and higher salaries.

🔒 An Accenture report finds 88% of security leaders face significant challenges implementing zero trust. Respondents point to varying definitions, broad deployment scope across on-prem, cloud, IoT and legacy systems, poor visibility into data flows and device/user state, and resistance from business units. Experts recommend phased, use-case-driven rollouts and strong executive sponsorship, while noting meaningful programs can take years and may never be fully complete.

🔐 Certifications in cybersecurity validate expertise, increase credibility and can accelerate advancement into CISO roles. This article highlights five widely recognized credentials — CISSP, CCSP, CISM, CISA and the SANS/GIAC Strategic Planning, Policy and Leadership — and summarizes their primary focus areas and prerequisite experience. Experts advise selecting certifications that align with your career path, technical domain and leadership goals. While certifications are valued internationally (including in Germany), they complement rather than replace relevant experience and other leadership qualities.

🔒 This article outlines nine critical errors that can cost CISOs their positions, based on input from several industry leaders. It highlights risks such as overconfidence, unnecessary complexity, weak Governance, Risk & Compliance programs, and poor alignment with business priorities. The piece stresses practical prevention: prioritize access control and identity management, address the human factor, shrink stale data, break down silos, and avoid complacency to reduce breach risk and maintain executive trust.

🔒 Gainesville Regional Utilities (GRU) launched a Vendor Security Risk Assessment (VSRA) program in August 2023 to vet third-party suppliers that access its smart-grid, metering, and fiber-optic systems. The intake, triage, detailed questionnaire, technical review, and centralized recordkeeping ensure vendors meet rigorous security standards before onboarding. Automation and a vendor scoring system reduced manual work by 50% and accelerated decision-making while improving compliance.

🔒 The article highlights a growing succession problem in cybersecurity: although CISO turnover has eased (from 21% in 2022 to 12% in 2023 and an annualized 11% in H1 2024), most organizations still lack formal plans to prepare successors. The gap is less about technical ability and more about developing leaders who can align cybersecurity with business strategy, communicate with executives, and manage risk. Experts recommend early planning, creating a true deputy CISO, rotational assignments, and board exposure to build a resilient internal pipeline.

🔐 CISA and FEMA announced the availability of more than $100 million in grant funding to bolster state, local, and tribal cybersecurity capabilities. The FY2025 Notice of Funding Opportunity includes the State and Local Cybersecurity Grant Program (SLCGP) with $91.7 million and the Tribal Cybersecurity Grant Program (TCGP) with $12.1 million. Awards may support planning, exercises, hiring cybersecurity experts, network hardening, and improvements to services provided to citizens. Applicants should consult CISA application resources to prepare proposals.

⚠️Recent federal budget and workforce reductions, including cuts that affect CISA and related grant programs, risk degrading national and local cyber defenses and the flow of threat intelligence and best-practice guidance. Reduced government contracts will force some vendors to shrink R&D and headcount, slowing innovation and increasing monoculture risk. At the same time, MSPs and MDR providers may see greater demand as organizations shift to private-sector solutions.

📢 CISA, in partnership with SAFECOM and NCSWIC, released an updated Emergency Communications System Lifecycle Planning Guide and companion Lifecycle Planning Tool on July 2, 2025. The suite refreshes the 2011 and 2018 materials and incorporates public safety practitioners' experiences to inform system build, maintenance, operation, decommission, and replacement decisions. The Lifecycle Guide offers recommendations and the Lifecycle Planning Tool provides checklists for each lifecycle phase. Resources and funding guidance are aligned to help jurisdictions plan technology upgrades.