What ISO/IEC 27001 Annex A actually requires for supplier relationships: the five controls in clauses 5.19-5.23, how they map ...

What FedRAMP requires when a cloud service provider is in a federal agency's supply chain: the FedRAMP Authorization Act (44 ...

A hub for the capabilities behind modern third-party risk management - continuous monitoring, attack surface monitoring, ...

What the FTC's GLBA Safeguards Rule (16 CFR Part 314) requires of financial institutions for their service providers: the ...

On 27 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-48356, a file upload flaw in Adobe Commerce and Magento Open Source, to its Known Exploited ...

A BMC is a small, separate computer on the server motherboard. It lets administrators power-cycle the server, open its console and reach its storage over the network, even when the main operating ...

Genesys, the contact-centre and customer-experience software company, says an unauthorized third party got into some of its internal business systems, including a learning management system (LMS) and ...

DreamHost, the US web hosting provider and domain registrar, has expired the passwords of some email, FTP and SFTP user accounts as a precaution during an incident that began on 23 October 2026. The ...

The Emperador ransomware group, first observed in September 2026, has rapidly escalated its operations, targeting high-profile organizations across multiple sectors. The group’s modus operandi ...

Korean Air and Asiana Airlines experienced a data breach involving unauthorized access to customer reservation information through the external Amadeus IT Group reservation and ticketing system. The ...

Rakus Light Cloud, the Rakus subsidiary that runs the Japanese email newsletter service Blastmail (ブラストメール), says an outside third party broke into its systems and took data out. In its notice updated ...