This week at a glance
Start with September 11, because two things landed on it. The Cyber Resilience Act’s Article 14 reporting duties took effect, running well ahead of the regulation’s main provisions in December 2027, and they impose a four-stage cadence: an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, a final report within 14 days, and within one month for serious incidents. Reports go to ENISA’s Single Reporting Platform, the ceiling is EUR 15 million or 2.5% of annual turnover, and the duty falls on manufacturers of products with digital elements rather than only on the operators who run them — which is the detail that catches organisations who assumed they were downstream of this. The same day, the CMMC Reform Task Force report fell due at the end of the Defense Department’s 60-day review, the review that follows a class deviation memo of September 3 instructing contracting officers to strip third-party assessment requirements out of contracts. Note what that is and is not: a deviation issued by DOD’s principal director for defense pricing, contracting and acquisition policy, not a final regulation replacing the rule that took effect in November 2025. The obligations beneath it, including NIST SP 800-171, have not moved, and neither has the False Claims Act exposure that produced a roughly $500,000 settlement from an Alabama contractor in June.
The EU AI Act supplies the clock most security functions have not yet assigned an owner to. Article 73’s serious-incident reporting duty has applied since August 2, on 15 days by default, 10 where a death is involved, and 2 for widespread infringement or disruption of critical infrastructure. It is a serious-incident duty, not a personal-data breach duty, so it does not run on the GDPR’s 72-hour clock and will not be caught by the process that does. The operational problem is sharper than the legal one: an AI system that produces harmful output usually shows no technical compromise at all, so nothing in a SIEM fires and the reporting clock starts running from an event the security function never saw. In the UK, the Cyber Security and Resilience Bill — which updates the NIS Regulations 2018, carries fines of GBP 17 million or 4% of turnover, and mirrors the CRA’s 24-hour and 72-hour cadence — had its personal-liability amendment resisted by the government, with Royal Assent expected later this year. Three regimes, three sets of deadlines, one incident response plan that has to satisfy all of them.
Washington spent the week rebuilding institutions rather than writing rules. CISA has roughly 250 people holding tentative offers against a 600-person goal cited by the DHS secretary in June, and its acting director framed the wave around role-fit rather than headcount, with the CIRCIA final rule expected in September. The FBI released its first comprehensive public cyber strategy covering criminal and national security threats together, directing 56 field offices toward faster disruption and more frequent industry partnership; its cyber chief named under-reporting by breached companies as the central obstacle. CISA, the FBI and international partners also published something unusual — an advisory about how service providers should communicate during an outage rather than how to fix one. And the FTC rescinded a 2021 policy statement on health apps by unanimous vote while leaving the Health Breach Notification Rule itself in force, penalties intact at $43,792 per violation per day. What changed was interpretive guidance, not the obligation. Meanwhile, an Absolute survey of 1,001 CISOs in the US and UK found 50% saying frontier models had made them consider leaving the profession and 60% saying board pressure to adopt AI had outpaced their ability to govern it. Average CISO tenure, per IDC, is 18 months. The regulatory calendar now runs longer than the job does.
On our watch list
- What the CMMC Reform Task Force actually recommends. The report fell due on September 11, at the end of the 60-day review that began on July 13, with the related RFI comment period closed since August 14. A class deviation is easier to issue than to reverse, but it is still not a regulation, and the task force output is the first signal of whether DOD intends to replace the assessment regime, restore it in modified form, or leave contractors in an indefinite interim. Contractors should read it as a scoping document for 2027 budgets, not a reprieve.
- Whether the CIRCIA final rule lands in September as expected. CISA’s acting director put the rule in this month while the agency is still onboarding staff. When it publishes, critical infrastructure entities acquire a federal incident-reporting obligation that has to be reconciled with the CRA, the AI Act and, for UK-exposed groups, the Cyber Security and Resilience Bill. The thing to check first is not the deadline but the trigger definition, because that is what decides how often you are in scope.
- The December 11, 2027 CRA main-provisions date, and what your suppliers do before it. Reporting started this month; the substantive product requirements follow in December 2027. That is two budget cycles, which sounds generous until you ask a supplier for a conformity plan and get an adjective back. The tell over the next two quarters is which vendors return a dated roadmap and which go quiet.
- Royal Assent for the Cyber Security and Resilience Bill, and whether personal liability returns. Assent is expected later in 2026 with the executive-liability amendment resisted by the cybersecurity minister. Peers including Lord Clement-Jones, Baroness Kidron and Baroness Ludford pressed it, and amendments of this kind rarely disappear permanently — they reappear in secondary legislation or in the next bill. Boards that treated the defeat as the end of the question may be reading one round of a longer argument.
- December 2027 for the EU AI Act’s deferred high-risk obligations. Enforcement of the remaining high-risk requirements was pushed to December 2027 by the Digital Omnibus on AI, which came into force in late July. The deferral applies to the high-risk obligations, not to Article 73, which is live now. Watch whether the deferral holds under pressure, because a reversal compresses a two-year programme into months.
- Whether CISA converts 250 tentative offers into 600 filled roles. Tentative offers are not start dates, and the gap between the two is where hiring waves usually fail. The number that matters to industry is not the headline total but whether the regional and sector-facing roles are filled, since those are the people who answer the phone when you report.
- The presidential memorandum on private-sector offensive operations. A memorandum the previous month directed DOJ and DHS to build procedures letting vetted US companies conduct operations against foreign criminal organizations, with nation-state groups explicitly excluded. If your organisation is approached to participate, that is a board decision with insurance, legal and geopolitical consequences, not a security-team one. Decide the answer before the question arrives.
- Whether the FTC’s rescission changes enforcement behaviour or only the guidance. The Health Breach Notification Rule remains in force, codified through a 2024 regulatory update, with penalties of $43,792 per violation per day. What was withdrawn was the 2021 interpretive policy statement. The signal to watch is the next enforcement action against a health app: whether the narrower reading of the rule that the rescission implies shows up in practice, or whether the rule is applied as before.
- Whether mandatory federal AI rules move, or the states keep setting the terms. OpenAI’s chief global affairs officer published a proposal on September 10 asking Congress for capability-based federal regulation — common testing protocols, independent assessment, incident reporting, misalignment monitoring and pre-deployment evaluation gates. The context is four California AI bills, two signed that week, and a proposed Florida criminal-sanctions framework. Absent federal action, compliance planning has to assume a patchwork.
- The Ban Artificial Superintelligence Act as a proposal, and what it signals. The Sanders and Casar bill is not law and is not scheduled to become law; the penalties described, including corporate dissolution and terms of imprisonment, are proposed. Its value is as a read on how far the political register has moved. Bills like this shift the boundaries of what a later, narrower statute can contain.
This week’s topic map — a European regulatory cluster binding the Cyber Resilience Act, Article 14, the ENISA Single Reporting Platform, the EU AI Act and Article 73 to a shared core of 24- and 72-hour reporting clocks; a UK cluster joining the Cyber Security and Resilience Bill, the NIS Regulations 2018, the House of Lords, Lord Clement-Jones and Baroness Lloyd of Effra to the executive personal-liability question; a defence-industrial cluster around CMMC, the DOD class deviation memo, the CMMC Reform Task Force, NIST SP 800-171 and Kirsten Davies; a federal cluster where CISA, CIRCIA, DHS, the Communicating Under Pressure advisory and Cloudflare meet the FBI, the FBI Cyber Strategy 2026, Brett Leatherman and breach under-reporting; an enforcement pair linking the FTC to the Health Breach Notification Rule and the Commerce Entity List letter to India-based hack-for-hire firms; a role cluster where CISO attrition and liability, the Absolute survey, Mythos, CIO-CISO alignment and the security talent pipeline converge on the CISO and the board; an AI governance cluster running from OpenAI and mandatory AI safety rules through kill switches and the proposed Ban Superintelligence Act to AI governance in the GRC programme and the cost of adoption; and an institutional pair covering REACTIV under ANSSI in France and Kevin Mandia’s move to the Amazon board.
View interactive topic map →
Article index
The compliance clocks start: EU and UK regulatory deadlines
Three regimes acquired live reporting deadlines within six weeks of each other: the Cyber Resilience Act’s 24-hour early warning from September 11, the EU AI Act’s serious-incident duty from August 2, and the UK bill’s matching cadence heading for Royal Assent. The practitioner question is no longer whether to comply but which single process can satisfy all three.
Washington repositions: US federal cyber policy and enforcement
A week of institutional movement rather than rulemaking. CISA rebuilding headcount ahead of a CIRCIA final rule, the FBI publishing its first comprehensive unclassified cyber strategy, CMMC assessment pulled from contracts by a class deviation memo, an FTC guidance rescission that leaves the underlying rule standing, and a congressional letter on hack-for-hire firms.
Who governs AI, and how hard
The governance argument ran on three levels at once this week: a national cyber director describing the present posture as buying time, a frontier lab asking Congress for mandatory federal rules, and a bill proposing to outlaw superintelligence outright. Underneath them, the practitioner question of where AI governance actually sits in a GRC programme.
The CISO role, the board, and the bench
Half of surveyed CISOs now treat frontier AI as a reason to consider leaving, against an average tenure of eighteen months. Set against that, a working model of CIO-CISO alignment and an argument that the senior security leaders of 2031 are in this year’s entry-level applicant pool.
What AI actually costs to run
The unglamorous half of the AI conversation: adoption rather than implementation as the binding constraint, and the arithmetic of token pricing that decides whether a deployed system is affordable at production volume.
Institutional moves
Two changes worth noting for what they signal rather than what they immediately do: a new French incident response unit under ANSSI, and a founder of the incident response industry taking a seat on one of its largest customers’ boards.
Detailed write-ups
1. The Cyber Resilience Act’s 24-hour clock is live, and it runs against manufacturers
The Register · Infosecurity Magazine · September 11, 2026
The Cyber Resilience Act’s Article 14 reporting duties became effective on September 11, ahead of the rest of the regulation, and they are the part of the CRA that changes behaviour first. The cadence is four-stage: an early warning within 24 hours of becoming aware of an actively exploited vulnerability, a detailed notification within 72 hours, a final report within 14 days, and a final report within one month for serious incidents. Filings go to ENISA’s Single Reporting Platform. Maximum penalties run to EUR 15 million or 2.5% of annual turnover, whichever is higher — Infosecurity puts the euro figure at roughly $17.4 million. Most of the remaining CRA provisions do not apply until December 11, 2027, which means the sequencing is deliberately awkward: you are obliged to report against a standard whose substantive product requirements you are still two years away from having to meet.
The distributional point is the one to take to a product or engineering leadership meeting. These duties fall on manufacturers of products with digital elements, not only on the operators who deploy them. Any organisation that ships software, firmware or a connected device into the EU market — including organisations that think of themselves as end users but sell an ancillary product, or embed one in something they sell — is inside the scope. Darren Anstee, CTO for security at Netscout, put the operational weight of the first deadline plainly: “The 24-hour window in which an initial warning must be reported creates a level of urgency, with subsequent deadlines ensuring that the gathering and release of additional information is prompt.” Twenty-four hours is not a reporting deadline in the ordinary sense. It is a detection-to-decision deadline, and it will be missed by organisations whose triage process is competent but whose escalation path to a named filer is not.
Heidi Waem of DLA Piper flagged the burden that follows from having several EU regimes arrive concurrently, and the companion piece from Infosecurity is where the practitioner answer sits. Sarah Pearce of K&L Gates, Brian Honan of BH Consulting, James Blake of Cohesity, Michael Woolslayer of HackerOne and Iain Davidson of Wireless Logic all converge on preparation rather than interpretation: know which of your products are in scope, know who files, and rehearse the 24-hour path before you need it. Daryl Flack of Avella Security, writing on the UK-EU squeeze, supplies the framing worth borrowing even though he is an interested party — treat this as one resilience programme rather than three compliance exercises, because the alternative is three parallel evidence sets that disagree with each other under examination. The single most useful thing to do this month is to write down the name of the person who files the 24-hour early warning, and the name of the person who files it when the first person is unreachable.
Sources: The Register (CRA 24-hour clock) · Infosecurity Magazine (CRA reporting rules take effect) · Infosecurity Magazine (UK-EU compliance squeeze)
2. The AI Act clock nobody has assigned an owner to
CIO · September 8, 2026
The EU AI Act’s Article 73 serious-incident reporting duty took effect on August 2, and most incident response plans do not mention it. The timelines are 15 days by default, 10 days where a death is involved, and 2 days for widespread infringement or disruption of critical infrastructure. Allan Dabre, a technology compliance leader writing for CIO, makes the distinction that decides whether your existing process catches this: Article 73 is a serious-incident duty, not a personal-data breach duty. It does not run on the GDPR’s 72-hour clock, it is not triggered by the same facts, and the workflow your privacy function built for GDPR will not fire on it. Enforcement of the AI Act’s remaining high-risk obligations has been deferred to December 2027 following the EU Digital Omnibus on AI, which came into force in late July — but the deferral does not cover Article 73, which is live now.
The harder problem is detection, not classification. Per European Commission guidance as Dabre describes it, an indirect causal link between an AI system and a downstream harm is enough to trigger the duty. That is a materially wider aperture than a security function is used to, and it interacts badly with how these failures actually present. An AI system producing harmful output typically shows no technical compromise whatsoever: no anomalous authentication, no lateral movement, no exfiltration, nothing a detection rule was written against. As Dabre puts it, “The AI system that produced the flawed output may show no signs of compromise. Nothing gets flagged by a SIEM.” The reporting clock starts from awareness of the incident, and awareness in these cases is far more likely to arrive through a customer complaint, a regulator’s letter or a line of business than through the security operations centre.
Two decisions follow, and both are cheap. First, name the Article 73 reporting owner explicitly in the incident response plan now, in advance, rather than discovering during an incident that the duty sits between the CISO, the data protection officer and whoever sponsored the model. Second, add a non-technical intake path: a defined route by which a complaint from a customer or a business unit about an AI system’s output reaches the same triage process as a security alert, with the same clock started. Fifteen days sounds generous, and two days does not; the difference between them is a classification judgement that has to be made by someone who knows the duty exists. If the answer to “who files this” is currently a job family rather than a person, that is the gap.
Sources: CIO (EU AI Act breach notification clock)
3. The Lords lost the personal liability argument, for now
The Register · September 7, 2026
The Cyber Security and Resilience Bill updates the UK’s NIS Regulations 2018, carries maximum fines of GBP 17 million or 4% of annual turnover, and imposes a 24-hour initial notification followed by a 72-hour fuller report — deliberately mirroring the CRA cadence, which is the one piece of good news in it for groups operating on both sides of the Channel. What peers spent the session arguing about was not the fines but who pays them personally. An amendment to attach personal liability to named executives was pressed by Baroness Kidron, Baroness Ludford and Lord Clement-Jones, with Baroness Neville-Jones, a former security minister, and Baroness Harding, the former TalkTalk chief executive, also taking part. Baroness Lloyd of Effra, the cybersecurity minister, defended the staged notification approach and resisted the amendment. Royal Assent is expected later in 2026.
Lord Clement-Jones made the argument in the register a board will recognise: “If an individual is fit to draw a multimillion-pound executive salary running a critical national provider, they must be prepared to carry personal responsibility.” That is not a cybersecurity argument, it is a corporate governance one, and it is the same argument that produced senior managers regimes in financial services and directors’ duties in health and safety. The relevant precedent for a security leader is that arguments of this shape do not lose permanently. They reappear in secondary legislation, in regulator guidance about what constitutes adequate board oversight, and in the next bill after a sufficiently visible incident. Treating this week’s outcome as the settlement of the question is a misreading of how the UK has historically arrived at personal accountability in regulated sectors.
The practical consequence for a CISO is about evidence rather than exposure. Whether or not liability attaches to a named executive, the bill’s 24-hour and 72-hour deadlines will be examined after the fact against what the board knew and when. The artefact that answers that examination is a dated record of what was escalated to whom, and it has to be produced contemporaneously because it cannot be reconstructed credibly afterwards. If your board reporting on cyber is a quarterly slide with a traffic light on it, it will not survive that examination in either direction — it will not demonstrate that the board was informed, and it will not demonstrate that you informed them. The cheapest improvement available before Royal Assent is a short, dated escalation log that records material decisions and who made them.
Sources: The Register (UK cyber bill personal liability)
4. CMMC assessment came out of contracts by memo, not by rule
Washington Technology · September 9, 2026
Read the instrument, not the headline. A memo dated September 3 from John Tenaglia, the Defense Department’s principal director for defense pricing, contracting and acquisition policy, issued a class deviation directing contracting officers to strip CMMC third-party assessment requirements out of contracts. A class deviation is an acquisition instruction, not a final regulation. The CMMC final rule was placed into effect in November 2025 and has not been withdrawn; what has changed is that contracting officers are now instructed not to apply the assessment requirement while the review runs. DOD announced the suspension in July, a 60-day review began on July 13 with a deadline of September 11, the comment period on the related RFI closed on August 14, and a CMMC Reform Task Force report was due on that September 11 deadline. Reversing a class deviation is a more involved process than issuing one, which is a reason to expect the pause to persist — but persistence is not the same as permanence, and a deviation is not a rule.
Kirsten Davies, the department’s chief information officer, addressed the change at the Billington Cybersecurity Summit and was careful about what it does not mean: “This isn’t about whether cybersecurity is important or not. It is. It’s critical. It’s vital.” The underlying obligations bear her out. NIST SP 800-171 requirements remain in play, and the representations a contractor makes about meeting them remain actionable. An Alabama contractor, Logzone, settled for roughly $500,000 in June 2026 over cybersecurity representations — enforcement through the false claims route continues regardless of whether a third party is currently assessing you. The assessment requirement was the mechanism; the obligation was never the mechanism.
For a security leader in the defence industrial base the decision this week is about what to do with a programme that was budgeted against an assessment date that has now moved. Cancelling it is the expensive option, because the work has to be redone under a deadline when the pause ends, and because the intervening period is exactly when a representation made in a proposal becomes a liability. The defensible position is to keep the assessment readiness work running at reduced velocity, keep the System Security Plan and Plan of Action and Milestones current, and stop treating the third-party assessment as the deliverable. The deliverable is the evidence that what you told the government about your controls was true. That is what a False Claims Act action tests, and it is what remains testable with or without a C3PAO in the room.
Sources: Washington Technology (CMMC Phase 2 suspension)
5. CISA is hiring back, with CIRCIA arriving on top of it
Cybersecurity Dive · September 10, 2026
Roughly 250 new employees hold tentative job offers from CISA awaiting official start dates, against a 600-person hiring goal that DHS Secretary Markwayne Mullin cited in June. Nick Andersen, the agency’s acting director, described the position on September 9 at the Billington Cybersecurity Summit: “We’re looking forward to welcoming hundreds of new CISA employees in the very near future.” This is a partial rebuild of an agency that was downsized over the preceding two years, and Andersen framed it around role-fit rather than raw headcount — which is the right framing for an organisation whose value to industry depends on specific people in specific sector-facing and regional roles rather than on a total.
The timing matters more than the number. The CIRCIA final rule is expected in September, which means the agency is due to acquire a substantial new federal incident-reporting workload at close to the same moment it onboards a hiring wave. Andersen also described a new structure, ANCHOR-CI — the Alliance of National Councils for Homeland Operational Resilience — Critical Infrastructure — sitting alongside existing bodies such as the IT Sector Coordinating Council. For a critical infrastructure operator the practical question is which of these is the channel through which your sector’s guidance and your incident reports will actually flow, because the answer determines who you build a relationship with before you need one.
The instruction for this month is to treat CIRCIA as a live drafting exercise rather than a watch item. When the final rule publishes, the first thing to read is the trigger definition, not the deadline, because that is what decides how often you are in scope and therefore how much of your incident process has to change. The second is how the federal duty reconciles with the CRA’s Article 14 cadence and the AI Act’s Article 73 timelines, since an organisation operating in both markets will need one intake and classification process feeding several filings rather than three processes that each start from scratch. Building that reconciliation before the rule lands is considerably cheaper than retrofitting it afterwards.
Sources: Cybersecurity Dive (CISA hiring and CIRCIA)
6. The FBI’s new strategy asks industry to pick up the phone
Nextgov/FCW · September 9, 2026
The FBI released its 2026 Cyber Strategy on September 9 — its first comprehensive public, unclassified strategy covering criminal and national security cyber threats together, with no classified annex. It directs the bureau’s 56 field offices and its overseas cyber personnel toward four things: coordinated cross-field-office investigations, faster victim assistance and threat warnings, expanded partnerships with government, foreign authorities and industry, and more frequent disruption operations. It commits to AI tooling for malware analysis, infrastructure mapping and prioritising victim notifications. The bureau is aligning with CISA, NSA, Cyber Command and CIA, and a Pentagon cyber strategy was expected imminently.
The part aimed squarely at a board is the under-reporting problem. Brett Leatherman, the bureau’s cyber chief, named it as a central concern: “It worries me when an organization is breached by a nation-state actor and believes that bringing law enforcement in might be more risky than handling it on their own.” That calculation is usually made under legal advice, in the first hours, by people weighing disclosure exposure against investigative benefit — and it is made much better in advance than in the moment. The strategy’s commitment to faster victim assistance is an attempt to change the terms of that calculation, but it only works if the decision to engage has already been taken in principle and the relationship already exists.
One further element deserves board attention rather than security-team attention. A presidential memorandum the previous month directed DOJ and DHS to establish procedures allowing vetted US companies to conduct operations against foreign criminal organizations, with nation-state groups explicitly excluded from private-sector involvement. If your organisation is approached about participating in that programme, the decision carries insurance, legal, employee-safety and geopolitical consequences well beyond the security function, and it should be reasoned through with general counsel and the board before an approach arrives rather than after. The practical action for this quarter is narrower and easier: establish the field office relationship and settle the engagement decision now, so that the question in hour one of an incident is who to call rather than whether to call.
Sources: Nextgov/FCW (FBI Cyber Strategy 2026)
7. Half of surveyed CISOs are thinking about leaving, and the bench behind them is thin
CSO Online · SC Media · CIO · September 9–11, 2026
An Absolute survey of 1,001 CISOs in the US and UK found that 50% agreed that Anthropic’s Mythos and similar cyber-capable frontier models had made them consider leaving the profession, against 25% who disagreed. Sixty per cent said board and executive pressure to adopt AI had outpaced their ability to govern it, which is the more actionable of the two numbers because it describes a governance gap rather than a mood. An earlier survey found 78% concerned about personal liability, up from 56% the year before, and 89% saying the pace of technology advancement is a challenge. Chris Kissel of IDC puts average CISO tenure at 18 months. Christine Gadsby, chief security advisor at BlackBerry and a former CISO, gave the blunt version: “As fast as AI evolves, the benefit is with the attacker right now.” Omar Khawaja, who teaches CISOs and CAIOs at Carnegie Mellon and is global field CISO at Databricks, pushed back — his position is that Mythos doesn’t really change what security teams need to do.
Both can be true, and the resolution is the useful part for a CEO or board chair reading this. If the fundamentals have not changed but half your peer group is considering leaving, the driver is not the technology. It is the combination of rising personal liability exposure, a governance mandate that arrives after the adoption decision has already been made, and an eighteen-month tenure that is shorter than most of the regulatory deadlines in this issue. A CRA programme running to December 2027 will outlast the average incumbent by nine months. That is a succession and continuity problem sitting inside what is usually filed as a staffing problem, and it is the board’s to solve, not the CISO’s.
SC Media’s account of CIO-CISO alignment at Cushman & Wakefield describes what a working version looks like, and it is notably undramatic: no gating factor between the CISO and CIO roles, and no technology initiative pushed to production over a security objection in seven years. The second of those is a measurable claim and a good one to test in your own organisation, because the answer is usually known and rarely written down. On the bench, Caitlyn Brazill, president of the nonprofit Per Scholas, argues that the senior security leaders of 2031 are in this year’s entry-level applicant pool — her organisation provides the apprenticeship model the piece advocates, so read the advocacy accordingly, but the underlying third-party figures are worth the board’s attention. Fortinet’s 2026 skills gap work has 13% of organisations needing entry-level skills while 71% say the shortage creates organisational risk; ISSA and Omdia have 83% adopting AI for security and 68% saying the job got harder; ISC2’s 2025 data has 56% of professionals entering via IT and 36% via security duties in an IT role — which is to say, through exactly the junior roles now being automated away.
Sources: CSO Online (Absolute survey of 1,001 CISOs) · SC Media (CIO-CISO alignment) · CIO (the security leaders you’ll need in 2031)
8. CISA tells service providers to stop spinning outages
Dark Reading · September 11, 2026
CISA, the FBI and international partners published an advisory in September titled “Communicating Under Pressure: Best Practices for Service Providers”. It is unusual in that it is not about technical remediation at all. It is about how service providers communicate during outages and incidents, and its central warning is that speculation compounds the damage, disruption and societal panic that an outage already causes. The reference case is the November 18, 2025 Cloudflare outage, roughly six hours of disruption. The escalating factor named in the advisory is supply-chain scope: attackers using AI are propagating downstream access considerably faster than before, which means the number of organisations that have to say something during a single incident is larger, and the window in which they have to say it is shorter.
Chris Novak, partner and co-founder of Quadrum Advisors, states the governing principle in a form that translates directly into a communications plan: “Trust isn’t preserved by pretending the incident isn’t serious. It’s preserved by demonstrating you understand how serious it is.” That is the opposite of the instinct most incident communications default to, which is to minimise until the facts are settled. Grant Bourzikas, Cloudflare’s chief security officer, describes the standard his organisation aims at — a detailed post-mortem published within about 12 hours of an incident. Chris Butera, CISA’s acting executive assistant director, is among those behind the advisory. Twelve hours is an aggressive target, and the reason it is achievable is that it is a pre-existing commitment with a pre-existing template, not a decision made during the event.
Two things follow, and both are worth doing regardless of whether you are a service provider. If you are one, decide your publication commitment now and write the template now, because the advisory is describing a standard your customers will increasingly hold you to and your contracts may eventually encode. If you are a customer of one, the advisory is a procurement instrument: ask at renewal what the provider’s stated communication timeline is during an incident, what they commit to publishing, and on what cadence — and note that this sits alongside the CRA and CIRCIA reporting duties rather than replacing them. A provider that cannot answer that question in a renewal conversation will not answer it well at hour two of an outage.
Sources: Dark Reading (CISA advisory on communicating under pressure)
Calls to action
- Name the person who files the CRA 24-hour early warning, and their deputy. Article 14 has been live since September 11. Twenty-four hours is a detection-to-decision deadline, not a paperwork deadline, and it fails on escalation paths rather than on analysis. Write both names down this week, confirm both know it, and confirm they have credentials for ENISA’s Single Reporting Platform before you need them.
- Establish whether you are a manufacturer under the CRA, in writing. The duty falls on manufacturers of products with digital elements, not only on operators. Ask product and legal to produce a list of everything your organisation ships, embeds or sells into the EU market that contains software or firmware. Organisations that think of themselves as end users are the ones most likely to be wrong about this.
- Add EU AI Act Article 73 to the incident response plan with a named owner. The duty has run since August 2 on 15 days by default, 10 where a death is involved and 2 for widespread infringement or critical infrastructure disruption. It is a serious-incident duty, not a personal-data breach duty, so your GDPR workflow will not fire on it. Assign it explicitly rather than leaving it between the CISO, the DPO and the model’s business sponsor.
- Build a non-technical intake path for AI incidents. An AI system producing harmful output usually shows no technical compromise, so nothing reaches the SOC. Define the route by which a customer complaint or a business unit’s concern about model output enters the same triage process, with the same clock started, as a security alert. Test it once with a deliberately mundane example.
- Start a dated board escalation log before the UK bill receives Royal Assent. The Cyber Security and Resilience Bill carries a 24-hour and 72-hour cadence and fines of GBP 17 million or 4% of turnover, and personal liability for executives lost this round rather than permanently. A contemporaneous record of what was escalated, to whom and when is the only artefact that answers the after-the-fact question in either direction. It cannot be reconstructed later.
- Keep CMMC assessment readiness running at reduced velocity, not stopped. The September 3 class deviation instructs contracting officers to strip third-party assessment from contracts, but it is an acquisition instruction, not a regulation, and NIST SP 800-171 obligations are unchanged. Keep the System Security Plan and Plan of Action and Milestones current. The tested deliverable is whether your representations to the government were true — a point the roughly $500,000 Logzone settlement in June makes concretely.
- Read the CIRCIA trigger definition first, not the deadline. The final rule is expected this month. What decides how much of your process changes is how often you are in scope, and that is set by the trigger. Plan now for one intake and classification process that feeds CRA, CIRCIA and AI Act filings, rather than three that each start from scratch.
- Settle the law enforcement engagement decision before hour one. The FBI’s cyber chief named under-reporting by breached companies as a central concern, and the bureau’s new strategy commits to faster victim assistance. Agree the engagement position with general counsel now and establish the field office relationship while nothing is happening, so the incident question is who to call rather than whether to call.
- Take the private-sector offensive operations question to the board before you are asked. A presidential memorandum directed DOJ and DHS to build procedures allowing vetted US companies to conduct operations against foreign criminal organizations, with nation-state groups excluded. Participation carries insurance, legal, employee-safety and geopolitical consequences. Decide the answer in advance rather than under an approach.
- Do not relax health-app breach notification. The FTC rescinded its 2021 interpretive policy statement by unanimous vote on September 9, but the Health Breach Notification Rule remains in force, codified through a 2024 regulatory update, with penalties of $43,792 per violation per day. Confirm with counsel that your notification procedures are unchanged, and correct anyone in the business who read the headline as a repeal.
- Ask every service provider at renewal what they commit to publishing during an incident, and when. The CISA advisory sets an expectation about outage communications, and Cloudflare’s stated target is a detailed post-mortem within roughly 12 hours. A provider who cannot answer in a renewal conversation will not answer well at hour two of an outage. Record the answers and treat silence as the answer it is.
- Put the tenure-versus-deadline arithmetic in front of your board. Average CISO tenure is 18 months per IDC; the CRA’s main provisions land in December 2027 and the AI Act’s deferred high-risk obligations with them. Sixty per cent of CISOs in the Absolute survey say board pressure to adopt AI has outpaced their ability to govern it. That is a continuity and succession question for the board, and it is cheaper to answer than to discover.
|