What you will find here
- Written for
- Chief executives, boards, general counsel and compliance leadership.
- Subjects
- Governance, cyber risk, regulatory readiness and executive reporting.
- Every article
- Carries its author, its publication date and the date it was last substantively revised.
Articles
-
Regulatory Compliance
What Defense Contractors Must Report Under the 2023 DFARS Cyber Incident Reporting Revisions
The December 2023 interim rule changed DFARS 252.204-7012 cyber incident reporting obligations for DoD contractors. This article explains the new medium and high severity thresholds, cloud incident obligations, and what leadership must clarify with legal counsel before an incident occurs.
-
Regulatory and Framework Readiness
What Federal Contractors Must Implement Under NIST SP 800-53 Rev. 5 for Moderate-Impact Systems
Federal contractors seeking FedRAMP authorization or agency Authority to Operate face NIST SP 800-53 Revision 5 moderate-impact baselines—a substantially more comprehensive framework than CMMC or NIST SP 800-171. This article explains when these controls apply, how they differ from CUI protection requirements, and what leadership must map before pursuing authorization.
-
Regulatory Compliance
What Financial Institutions Must Implement Under the Federal Banking Agencies' March 2024 Interagency Guidance on Third-Party Risk Management
The OCC, Federal Reserve, and FDIC have issued updated expectations for how banks and credit unions govern technology vendors and critical service providers. This article explains the governance structures, due diligence standards, contract requirements, and ongoing oversight practices leadership must implement, who owns each component, and how to establish executive accountability for the outcome.
-
Regulatory Compliance
What Financial Institutions Must Report Under FinCEN's December 2023 Bank Secrecy Act Cyber Event Notification Proposal
FinCEN's December 2023 proposed rule would require banks and other financial institutions to notify regulators within four days of a significant cyber event. Leadership must understand what qualifies as reportable, how the timeline compares to existing SEC disclosure obligations, and who inside the organization is accountable for making the determination and filing the notification. Without clear ownership of the decision-making process, compliance becomes accidental rather than deliberate.
-
AI and Emerging Technology Governance
What Healthcare Organizations Must Do When Implementing AI in Clinical or Administrative Systems
Healthcare executives deploying AI face layered regulatory obligations across HIPAA, FDA oversight, FTC enforcement, and data governance frameworks. This article explains who is accountable, what decisions must be made before deployment, and how to establish executive ownership of AI governance in regulated environments.
-
Regulatory and Framework Readiness
What Healthcare Organizations Must Implement Under the AHA's November 2023 Cybersecurity Threat Landscape Update and Joint Cybersecurity Advisory
Multi-agency cybersecurity advisories and American Hospital Association threat guidance create direct accountability for healthcare executives and boards, but without a clear owner, most organizations struggle to translate these warnings into governed, measurable action. This article explains what the guidance requires, who owns the response, and how executive cybersecurity leadership closes the gap between accountability and capability.
-
Regulatory
What Investment Advisers Must Now Report Under the SEC's Form ADV Cybersecurity Amendments
The SEC's October 2024 amendments to Form ADV Part 2A require registered investment advisers to disclose cybersecurity risks and incidents directly to clients and prospective clients. Leadership is now accountable for statements about risk governance, incident response, and the adequacy of controls—without always having clear ownership, repeatable processes, or evidence to support those disclosures. This article explains what must be disclosed, who owns verification, and how executive cybersecurity leadership closes the gap between regulatory accountability and operational reality.
-
Regulatory and Framework Readiness
What Multi-State Financial Data Privacy Laws Require of Financial Institutions in 2024
Vermont, California and Maine have enacted state-specific financial data privacy requirements that add to federal obligations under the Gramm-Leach-Bliley Act. Leadership at institutions operating across state lines must identify where these laws apply, what additional controls they require, and who owns compliance across fragmented technology and compliance functions.
-
Regulatory Compliance
What Organizations Must Report Under State Security Breach Notification Laws in 2024
State breach notification laws impose conflicting timelines and definitions on organizations operating in multiple jurisdictions. Leadership must decide who owns the regulatory position, what constitutes reportable compromise, and how to meet the shortest statutory deadline before an incident occurs.
-
Regulatory and Framework Readiness
What SaaS Organizations Must Prepare for Under California's Delete Act (SB 362)
California's Delete Act (SB 362) creates a single-request mechanism for consumers to demand deletion of their data from registered data brokers, effective 2026. SaaS organizations that meet the statutory definition of a data broker face registration obligations, technical infrastructure requirements, and operational changes. Many product executives learn about this only when it is too late to integrate thoughtfully.
-
Regulatory and Framework Readiness
What SaaS Organizations Must Prepare for Under the EU's Digital Operational Resilience Act (DORA)
DORA creates binding operational resilience obligations for ICT service providers supporting EU financial entities, effective January 2025. SaaS companies serving European financial customers face specific requirements for incident reporting, third-party risk management and operational continuity, regardless of where they are headquartered. Most leadership teams lack a clear owner for regulatory compliance strategy, risk governance and incident response protocols. This creates accountability gaps that regulatory examinations will expose.
-
Regulatory and Framework Readiness
What SaaS Providers Must Implement for Secure Software Development Under NIST SSDF and EO 14028
Executive Order 14028 and NIST's Secure Software Development Framework establish attestation requirements for software providers serving federal agencies. Leadership must understand what practices the framework defines, who owns implementation, and how to demonstrate compliance without disrupting product delivery.
How these are written
Nothing here is generated filler, and nothing is published without an accountable author.
-
Written by a named author
Every article carries a byline that links to a real profile. There are no house bylines and no invented contributors.
-
Dated honestly
The original publication date and the date of the last substantive revision are both shown, and neither is refreshed to look current.
-
Sourced where it matters
Where an article relies on published guidance or a regulation, the source is cited so you can check it yourself.
-
Aimed at a decision
Each piece is written to help leadership decide something, not to demonstrate technical depth to other practitioners.
Bring clear ownership to your cybersecurity program.
Start with a confidential conversation about your organization, obligations, current security program, and the decisions in front of leadership.
Or reach us directly at (407) 908-7001 or info@heightscg.com.