Policy & Compliance Correspondent

Tom Verhoeven

Tom reports on EU and US cyber regulation, from NIS2 enforcement to disclosure rules, and translates legal text into engineering requirements.

23 articlesUpdated 21 Oct 2026

NIS2Regulatory complianceData protectionLinkedIn

Articles by Tom Verhoeven

NewsBanking & Fintech
Singapore PDPC Enforces Enhanced 10% Turnover Penalty Regime Following Marina Bay Sands and SaaS Data Breaches
Singapore's PDPC levies major penalties on Marina Bay Sands and SaaS vendors, rejecting financial hardship defenses under the enhanced 10% turnover statutory fine framework.
Tom Verhoeven21 Oct 202613 min read
InsightsBanking & Fintech
The Multi-Clock Compliance Trap: Navigating Conflicting 6-Hour, 24-Hour, and SEC 8-K Incident Deadlines
Disparate incident reporting windows across the SEC, EU DORA, and India's RBI create a legal hazard for CISOs. Here is how enterprise response playbooks must adapt.
Tom Verhoeven6 Oct 20268 min read
NewsBanking & Fintech
RBI Enforces Stricter Cyber Resilience Governance and Mandatory Six-Hour Incident Reporting via DAKSH
The Reserve Bank of India mandates strict 6-hour incident disclosure via DAKSH and CERT-In, requiring board-level oversight and 180-day forensic log retention.
Tom Verhoeven5 Oct 20268 min read
Cyber AttackGov & Defence
Compromised Partner Integration Exposes 8.8 Million Citizen Records in Denmark National Registry Breach
Danish authorities confirmed an unauthorized entity abused legitimate commercial partner API credentials to exfiltrate 8.8 million CPR citizen identity records.
Tom Verhoeven5 Oct 20268 min read
Cyber AttackGov & Defence
Arizona Court Phishing Breach Exposes 1.3 Million SSNs and Foster Care Reports
A phishing click let hackers copy Arizona court backup files: SSNs of ~1.3M FARE debtors, protective-order records and 150,000+ foster care reports.
Tom Verhoeven4 Oct 20267 min read
Cyber AttackGov & Defence
ANSSI: Infostealer Credentials and Weak MFA Let Attackers Drain French Tax Agency
ANSSI's DGFiP report: infostealer credentials, weak MFA and an unmonitored portal let attackers steal impots.gouv.fr and cadastre data undetected.
Tom Verhoeven3 Oct 20268 min read
InsightsBanking & Fintech
RBI Mandates Baseline Cyber Resilience and 6-Hour Incident Reporting for Digital Payment System Operators
The Reserve Bank of India has operationalized mandatory cyber resilience controls, board-level oversight, and 6-hour breach reporting for digital payment operators.
Tom Verhoeven27 Sep 20269 min read
InsightsBanking & Fintech
Data Protection Board of India Unveils Inquiry Framework and Mandatory Algorithmic Audits
The Data Protection Board of India establishes binding procedural codes for DPDP inquiries, mandating independent algorithmic audits and strict breach notification timelines.
Tom Verhoeven25 Sep 202618 min read
InsightsBanking & Fintech
RBI Enforces 6-Hour Breach Notification and Cloud Outsourcing Audits Across Financial Sector
RBI accelerates enforcement of its IT Governance Master Direction, mandating 6-hour incident reporting and strict third-party cloud outsourcing audits for financial entities.
Tom Verhoeven24 Sep 202618 min read
ThreatsIndustrial & OTCritical
Lantronix EDS5000 Industrial Device Servers Hit by Critical Remote Code Injection Flaw
CISA adds Lantronix EDS5000 industrial serial device server vulnerability CVE-2025-67038 to KEV catalog following active exploitation against OT networks.
Tom Verhoeven18 Sep 202610 min read
ThreatsIndustrial & OTCritical
Mitsubishi Electric CC-Link IE TSN Protocol Flaws Expose Factory Automation Cells
CISA issues ICS-CERT advisory ICSA-26-211-07 warning of critical protocol implementation flaws in Mitsubishi Electric CC-Link IE TSN industrial controllers.
Tom Verhoeven18 Sep 202610 min read
ThreatsIndustrial & OTHigh
KNX Building Automation Protocol Denial-of-Service Flaw Exploited Against Critical Infrastructure
CISA adds KNX industrial building automation protocol vulnerability CVE-2023-4346 to KEV catalog following active exploitation against critical OT facilities.
Tom Verhoeven18 Sep 202610 min read
ThreatsCloud & SaaSHigh
Cisco Unified Communications Manager SSRF Flaw Weaponized in Enterprise Attacks
CISA adds Cisco Unified Communications Manager vulnerability CVE-2026-20230 (CVSS 8.5) to KEV catalog following active in-the-wild enterprise telephony attacks.
Tom Verhoeven17 Sep 202612 min read
ThreatsCloud & SaaSHigh
Red Hat Enterprise Linux libuser Race Condition Flaw Exploited for Local Root Escalation
CISA adds Red Hat libuser vulnerability CVE-2015-3246 (CVSS 8.8) to KEV catalog following active in-the-wild exploitation for root privilege escalation.
Tom Verhoeven17 Sep 202612 min read
IndustryGov & Defence
CISA Finalizes CIRCIA Mandate: 72-Hour Incident and 24-Hour Ransomware Reporting Enforced
CISA issued its landmark final rule under CIRCIA, legally mandating critical infrastructure operators report major cyber incidents within 72 hours and ransom payments within 24 hours.
Tom Verhoeven14 Sep 20268 min read
InsightsCloud & SaaS
EU Cyber Resilience Act 24-Hour Vulnerability Reporting Rules Take Effect for Vendors
The EU CRA’s early reporting mandate is now in effect, requiring manufacturers to report actively exploited vulnerabilities to ENISA and CSIRTs within 24 hours.
Tom Verhoeven14 Sep 20266 min read
InsightsBanking & Fintech
RBI drafts a time-bound debit-hold SOP for suspected money-mule accounts
RBI’s draft KYC amendment proposes a time-bound process for temporary debit holds on suspected money-mule accounts linked to cyber-enabled fraud.
Tom Verhoeven12 Sep 20266 min read
ThreatsCloud & SaaSHigh
PostGREShell: 12-year-old PostgreSQL logical replication flaw CVE-2026-6471 enables remote code execution
Security researchers disclose PostGREShell, a flaw present since PostgreSQL 9.4 that lets users with the REPLICATION attribute execute arbitrary code on database hosts.
Tom Verhoeven12 Sep 20266 min read
GuidesGov & Defence
CERT-In's six-hour clock meets DPDP: one intake process, two notification deadlines
India's six-hour CERT-In reporting clock has run since June 2022. From May 2027 a second DPDP clock starts on the same incident. Build one intake process now.
Tom Verhoeven11 Sep 20266 min read
InsightsEnergy & Utilities
EU AI Act High-Risk Rules Slip to December 2027, but Logging Work Cannot
Regulation (EU) 2026/1744 pushed Annex III high-risk obligations to December 2027, but Article 12 logging, Article 14 oversight and Article 15 hardening are engineering work you cannot start late.
Tom Verhoeven9 Sep 20266 min read
ThreatsCloud & SaaSCritical
FreeIPA LDAP ACI Vulnerability Chain Grants Anonymous Clients Domain Admin Rights
Red Hat patched CVE-2026-76578 (CVSS 9.8) in FreeIPA and 389 Directory Server, where an LDAP Access Control Instruction flaw allowed unauthenticated clients to create permanent domain admins.
Tom Verhoeven8 Sep 20265 min read
InsightsEnergy & Utilities
NIS2 simplification and CSA2: what the January 2026 cybersecurity package actually changes
The European Commission’s cybersecurity package proposes amendments to NIS2 and a revised Cybersecurity Act. Here is what compliance teams need to track.
Tom Verhoeven8 Sep 20267 min read
InsightsBanking & Fintech
The SEC’s four-day disclosure clock in practice: materiality is the hard part
Public companies must disclose material cyber incidents within four business days. The deadline is simple; deciding what counts as material is not.
Tom Verhoeven3 Sep 20266 min read