Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Guide: What Are ODPs in NIST 800-171 Rev 3?

The shift from NIST SP 800-171 revision 2 to revision 3 includes a lot of changes, which we've already covered from a bird's-eye view over in this post. One of the biggest changes in Rev 3 is the introduction of ODPs, or Organization-Defined Parameters. These are very important for compliance with CMMC moving forward, but they're still something of a mystery to some security professionals, and are worth explaining. What are they, how do you define them, and how do you use them for compliance?

The EU Cyber Resilience Act puts product makers on a 24-hour clock

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

CRA 24-Hour Reporting Rule: What Happens If You Miss It?

The EU Cyber Resilience Act's 24-hour reporting deadline is already in force. Is your organisation prepared? Since 11 September 2026, manufacturers of covered software, IoT devices and connected products must report certain cybersecurity vulnerabilities and incidents within strict deadlines. Under the EU Cyber Resilience Act (CRA), manufacturers must submit: **Within 24 hours:** An early warning after becoming aware of an actively exploited vulnerability or severe incident affecting product security.

What is CSF certification | TrustTalks - Ep 38

Organizations across industries are constantly challenged to protect their sensitive information and manage potential risks effectively. CSF certification, short for Cybersecurity Framework certification, has emerged as a significant marker of an organization’s readiness to face cybersecurity challenges while ensuring compliance with industry standards. In this podcast, we explain what CSF certification is, examine its origins and benefits, and offer insights into how organizations can achieve and maintain this critical certification.

HIPAA compliance Exploring the basics of safeguarding healthcare data | TrustTalks - Ep 37

With digital health records and telemedicine becoming the norm, safeguarding patient information is more critical than ever. The Health Insurance Portability and Accountability Act (HIPAA), enacted in 1996, serves as the cornerstone of healthcare data protection in the United States. Designed to ensure the confidentiality, integrity, and availability of Protected Health Information (PHI), HIPAA sets national standards for healthcare providers, insurers, and their partners. Compliance with HIPAA not only mitigates legal and financial risks but also fosters trust between healthcare organizations and patients.

Point-in-time security is ending: what IDC, 451 Research, and our experts said

TrustCloud showed up across the security and analyst landscape in recent months. CEO Sravish Sridhar published three columns in SecurityWeek and SC Media on why point-in-time assurance no longer holds up, and both IDC and 451 Research covered TrustCloud’s continuous, AI-native approach. The pieces come at it from different angles, but they land on a common point: boards and buyers increasingly want proof a control is working now, not a snapshot from last quarter.

Application Security for GDPR Compliance: A Complete Guide

Seven years after the General Data Protection Regulation came into force, organizations are still learning a hard lesson: GDPR compliance is a technical lesson as much as it is a legal one. Application security for GDPR compliance sits at the center of that reality, because the personal data GDPR protects lives in your software: your web applications, your APIs, your cloud-native services, your third-party integrations.

Beyond Compliance: Building an AI Operating Model Using Global Governance Frameworks

By Rob Horne and Parul Dahl, Kroll Cyber Risk EMEA Security Advisory Kroll recently published a series of articles examining governance challenges associated with specific AI implementations, particularly agentic AI and the data, risk and compliance considerations that accompany autonomous decision-making. However, many organizations are now facing a broader challenge.

What is a DSAR? Your 101 guide to data subject access requests

Accelerating security solutions for small businesses‍ Tagore offers strategic services to small businesses. A partnership that can scale‍ Tagore prioritized finding a managed compliance partner with an established product, dedicated support team, and rapid release rate. Standing out from competitors‍ Tagore's partnership with Vanta enhances its strategic focus and deepens client value, creating differentiation in a competitive market.

Automating Third-Party Contractor Risk in Regulated Facilities

Third-party contractors are one of the largest unmonitored compliance gaps inside regulated facilities. While internal employees go through rigorous background checks, recurring safety training, and strict access provisioning, external technicians and vendors often bypass those controls at the front desk. When an HVAC technician, specialized equipment calibrator, or electrical contractor walks onto a regulated floor with an expired certification, the host facility absorbs the regulatory and financial liability.