https://garzoncybersolutions.com/insights.html Compliance briefings from Garzon Cyber Solutions. Threat briefings and market analysis from Garzon Cyber Solutions. Cyber security incidents, regulatory change and what both mean commercially for organisations operating in the UK, the EU and the Americas. en-gb Garzon Cyber Solutions jonathan@garzoncybersolutions.com (Jonathan Garzon) jonathan@garzoncybersolutions.com (Jonathan Garzon) Fri, 09 Oct 2026 05:27:01 +0000 Wed, 23 Sep 2026 09:00:00 +0100 GCS RSS generator https://garzoncybersolutions.com/gcs_regulatory_briefing_stillunderinvestigation/ https://garzoncybersolutions.com/gcs_regulatory_briefing_stillunderinvestigation/ Sweden's data protection authority fined Miljodata 1.8 million kronor on 22 September over the August 2025 breach, under Article 32(1). The more useful part of the decision sits beside it. Reviews of two municipalities and one region have been open since November 2025, and IMY says they focus particularly on what those bodies themselves put into the supplier's system: which categories of data, and about which people. Protected identities, long-departed employees and children. Wed, 23 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_regulatory_briefing_nobodyattacked/ https://garzoncybersolutions.com/gcs_regulatory_briefing_nobodyattacked/ Ireland's Data Protection Commission fined Google Ireland Limited 403 million euros on 21 September, the fourth largest penalty it has issued. There was no breach, no intruder and no stolen record. The findings fall under four headings: lawfulness and fairness, accountability, transparency and retention. One turned purely on evidence, because Google could not demonstrate compliance. The regulator took about six years and seven months to establish the case and has allowed six months to fix it. It is understood Google may appeal elements of the decision. Tue, 22 Sep 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_csr_bill_24_hour_clock/ https://garzoncybersolutions.com/gcs_csr_bill_24_hour_clock/ The Bill cleared its Lords second reading on 14 July, bringing 24-hour incident reporting, data centres and managed service providers into scope, and penalties of up to £17 million or 4% of worldwide turnover. Eight days later a report warned the UK lacks the workforce to run it. The fines are not the problem. The clock is. Fri, 31 Jul 2026 09:00:00 +0100 GCS Regulatory Briefing Jonathan Garzon https://garzoncybersolutions.com/gcs_cyber_growth_enabler_part3/ https://garzoncybersolutions.com/gcs_cyber_growth_enabler_part3/ 72% of boards call cyber risk a top priority. Only 29% feel informed. Average CISO tenure: 18 to 24 months. The four metrics that shift board conversations, the board paper framework that gets investment approved, and the governance model that makes it sustainable. Mon, 13 Jul 2026 09:00:00 +0100 Cybersecurity as a Growth Enabler Jonathan Garzon https://garzoncybersolutions.com/nis2-frontline-workforce/ https://garzoncybersolutions.com/nis2-frontline-workforce/ 84% of in-scope organisations are not ready. 68% of breaches involve a human element. The 24-hour reporting clock starts when anyone becomes aware. NIS2 enforcement reaches every desk. Part 4 of the NIS2 Compliance Series. Thu, 07 May 2026 09:00:00 +0100 Compliance Jonathan Garzon https://garzoncybersolutions.com/nis2-cto-infrastructure/ https://garzoncybersolutions.com/nis2-cto-infrastructure/ 194 days to identify a breach. 99% of cloud security failures are the customer’s fault. 31% of breaches trace to stolen credentials. The regulator now prices your technical debt in euros. Part 3 of the NIS2 Compliance Series. Mon, 04 May 2026 09:00:00 +0100 Compliance Jonathan Garzon https://garzoncybersolutions.com/nis2-ciso-burden/ https://garzoncybersolutions.com/nis2-ciso-burden/ Article 21 mandates ten cybersecurity risk management measures. Article 23 gives you twenty-four hours to report a significant incident. 89% of CISOs say their teams are understaffed. 299,000 cybersecurity professionals are missing across the EU. Part 2 of the NIS2 Compliance Series. Thu, 30 Apr 2026 09:00:00 +0100 Compliance Jonathan Garzon https://garzoncybersolutions.com/nis2-readiness-gap-2026/ https://garzoncybersolutions.com/nis2-readiness-gap-2026/ The first penalties were issued in Q1 2026. Twenty two of 27 member states have transposed the directive. Regulators in Germany, France, and the Netherlands are actively auditing. 84% of in scope organisations admit they are not prepared. Personal liability for board members is now operational. Wed, 29 Apr 2026 09:00:00 +0100 Compliance Jonathan Garzon https://garzoncybersolutions.com/dora-financial-services/ https://garzoncybersolutions.com/dora-financial-services/ The Digital Operational Resilience Act came into force in January 2025. For banks, insurers, investment firms, and their ICT providers, the compliance deadline has passed. Sun, 01 Mar 2026 09:00:00 +0100 Compliance Jonathan Garzon https://garzoncybersolutions.com/nis2-compliance-gap/ https://garzoncybersolutions.com/nis2-compliance-gap/ NIS2 expanded the scope of EU cybersecurity obligations to thousands of organisations. But transposition has been inconsistent. Sun, 15 Feb 2026 09:00:00 +0100 Compliance Jonathan Garzon