Tom Verhoeven

Policy & Compliance Correspondent

Tom reports on EU and US cyber regulation, from NIS2 enforcement to disclosure rules, and translates legal text into engineering requirements.

NIS2Regulatory complianceData protection

Articles by Tom Verhoeven

9 articles

IndustryGovernment & DefenceHigh
CISA Finalizes CIRCIA Mandate: 72-Hour Incident and 24-Hour Ransomware Reporting Enforced
CISA issued its landmark final rule under CIRCIA, legally mandating critical infrastructure operators report major cyber incidents within 72 hours and ransom payments within 24 hours.
Tom Verhoeven14 Sep 2026, 18:30 IST8 min read
InsightsTechnology, Cloud & SaaSMedium
EU Cyber Resilience Act reporting rules go live: Hardware and software vendors face mandatory 24-hour disclosures
The EU CRA’s early reporting mandate is now in effect, requiring manufacturers to report actively exploited vulnerabilities to ENISA and CSIRTs within 24 hours.
Tom Verhoeven14 Sep 2026, 12:30 IST6 min read
InsightsBanking & FintechBreaking
RBI drafts a time-bound debit-hold SOP for suspected money-mule accounts
RBI’s draft KYC amendment proposes a time-bound process for temporary debit holds on suspected money-mule accounts linked to cyber-enabled fraud.
Tom Verhoeven12 Sep 2026, 19:40 IST6 min read
ThreatsTechnology, Cloud & SaaSHigh
PostGREShell: 12-year-old PostgreSQL logical replication flaw CVE-2026-6471 enables remote code execution
Security researchers disclose PostGREShell, a flaw present since PostgreSQL 9.4 that lets users with the REPLICATION attribute execute arbitrary code on database hosts.
Tom Verhoeven12 Sep 2026, 17:30 IST6 min read
GuidesGovernment & DefenceMedium
CERT-In's six-hour clock meets DPDP: one intake process, two notification deadlines
India's six-hour CERT-In reporting clock has run since June 2022. From May 2027 a second DPDP clock starts on the same incident. Build one intake process now.
Tom Verhoeven11 Sep 2026, 10:30 IST6 min read
InsightsEnergy & UtilitiesLow
The EU AI Act's High-Risk Rules Slipped to December 2027. Your Logging Problem Did Not Move
Regulation (EU) 2026/1744 pushed Annex III high-risk obligations to December 2027, but Article 12 logging, Article 14 oversight and Article 15 hardening are engineering work you cannot start late.
Tom Verhoeven9 Sep 2026, 19:30 IST6 min read
ThreatsTechnology, Cloud & SaaSCritical
FreeIPA LDAP ACI Vulnerability Chain Grants Anonymous Clients Domain Admin Rights
Red Hat patched CVE-2026-76578 (CVSS 9.8) in FreeIPA and 389 Directory Server, where an LDAP Access Control Instruction flaw allowed unauthenticated clients to create permanent domain admins.
Tom Verhoeven8 Sep 2026, 14:45 IST5 min read
InsightsEnergy & Utilities
NIS2 simplification and CSA2: what the January 2026 cybersecurity package actually changes
The European Commission’s cybersecurity package proposes amendments to NIS2 and a revised Cybersecurity Act. Here is what compliance teams need to track.
Tom Verhoeven8 Sep 2026, 14:30 IST7 min read
InsightsBanking & Fintech
The SEC’s four-day disclosure clock in practice: materiality is the hard part
Public companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.
Tom Verhoeven3 Sep 2026, 16:30 IST6 min read