Framework-grounded articles on SOC 2, ISO 27001, HITRUST, and audit readiness.
Supplier & Third-PartyThe UK s Cyber Security and Resilience Bill (CSRB) presents a challenge many compliance teams haven t anticipated: Section 43 empowers ministers to order organizations in critical sectors to stop usin
Supplier & Third-PartyThe LabCorp settlement, involving $2.2 million paid to 42 states plus DC and affecting over 10.2 million patients, wasn t due to a breach at LabCorp itself. It resulted from a hack at AMCA, a debt col
Supplier & Third-PartyThe Question at Hand When LabCorp paid $2.2 million to settle claims from 42 states over a breach at its debt collector AMCA, which exposed data for over 10.2 million patients, the settlement imposed
Supplier & Third-PartyWhen LabCorp paid $2.2 million to settle claims from 42 states and Washington D.C. over a vendor breach at AMCA affecting over 10.2 million patients, it wasn t just about the money. The settlement dem
Get weekly security insights and compliance updates delivered to your inbox.
Supplier & Third-PartyScope This guide covers vendor risk management controls required under SOC 2 and ISO/IEC 27001:2022 , focusing on third-party security oversight, contract requirements, and incident response obligatio
Supplier & Third-PartyThe Challenge The FBI s investigation into a cyberattack linked to a third-party jobs portal highlights a gap many IT governance teams overlook: the attack surface created by vendors you don t directl
Supplier & Third-PartyMicrosoft s Data Protection Requirements v12 refresh on March 30, 2026, isn t just another compliance update. It s a signal that major cloud providers are consolidating their supplier requirements aro
Supplier & Third-PartyWhat Happened In late April and early May 2024, Instructure confirmed a cyberattack on its Canvas Learning Management System . The threat group ShinyHunters claimed responsibility, stating they exfilt
Supplier & Third-PartyThe conventional wisdom says that if you conduct thorough annual vendor assessments, maintain a supplier risk register, and collect SOC 2 reports from your critical providers, you ve done your job man
Supplier & Third-PartyThe Challenge On June 11, 2026, the hacking group Icarus injected malicious code into Klue s integration service using a GitHub Personal Access Token (PAT) that had been inactive since 2022. This toke
Supplier & Third-PartyThe FFIEC issued a statement on the end of Microsoft support for Windows XP. If you re thinking, we retired XP years ago, you re ahead of many organizations. But the principle applies to every end-of-
Supplier & Third-PartyWhat Happened On January 15, 2025, the Trump administration issued an executive order banning the acquisition and installation of foreign-made technology in bulk-power systems. This order targets equi
Supplier & Third-PartyYou ve signed the BAA. You ve reviewed the SOC 2 report. You ve checked the box that says third-party risk assessed. Then someone posts your users National Insurance numbers on a forum for $600. These
