Regulation & Policy
-
EU cyber rules can require reports on unsupported industrial devices without forcing fixes
ENISA says Cyber Resilience Act reporting obligations can persist after connected products reach end of support, while manufacturers may not have a corresponding legal duty to repair vulnerabilities in old devices.
-
Economic size shows little relationship with national cyber preparedness, Comparitech says
Comparitech places Finland first in its cybersecurity preparedness ranking of the 50 largest economies and reports little correlation between GDP and its institutional indicators; the study does not measure actual attack resilience.
-
EU Council backs national reporting gateways in digital rules overhaul
The EU Council has agreed its position on simplifying data protection, privacy and cybersecurity reporting rules, proposing national incident reporting gateways instead of the Commission’s central EU model.
-
NCSC sets seven research priorities for AI in cyber defence
The UK NCSC has published seven research questions on AI in cyber security, covering autonomous defence, agent assurance, AI dependencies and national resilience. The new chapter is a research agenda, not a compliance standard.
-
Northern Ireland grants consent for UK cyber resilience reforms
Northern Ireland granted legislative consent on 19 October for relevant provisions of the UK Cyber Security and Resilience Bill. The proposed reforms would extend cyber regulation to more digital suppliers, but the vote introduces no immediate duties.
-
ICO reprimands Welsh organisations after old test account enabled ransomware breach
The ICO reprimanded Ogi Networks and Data Cymru after a long-standing test account with the password “Password1” enabled a 2024 ransomware attack. Information concerning roughly 3,300 people, mainly children, was stolen.
-
France warns over Stormshield firewall vulnerabilities
France’s national cyber incident response service has warned of vulnerabilities in Stormshield Network Security that could undermine security policies and compromise data integrity.
-
Europol assessment identifies gaps in EU digital forensics capacity
A European Commission and Europol assessment says fragmented tools, specialist shortages and emerging data sources are complicating digital evidence collection across EU law enforcement.
-
Romanian public bodies bought banned Kaspersky products, procurement review finds
An investigation identified 131 purchases of prohibited Kaspersky products by 83 Romanian public institutions after a government blacklist, raising questions about procurement enforcement.
-
Scottish NHS independent cyber audit funding ends, according to report
A report says Scottish ministers have stopped centrally funding annual independent cybersecurity audits of NHS health boards, while the government maintains that other oversight arrangements remain.