60
60
60
60
60
60
FBI puts its cyber strategy on paper
FBI publishes its first public cybersecurity strategy, a 17-page document with four pillars prioritizing disruption of cybercrime and nation-state hackers.
The FBI released its first-ever public cybersecurity strategy, a 17-page unclassified document outlining four pillars: imposing costs on adversaries, victim support, industry collaboration, and strengthening the bureau's digital capabilities. Cyber Division assistant director Brett Leatherman said the plan builds on the Trump administration's cybersecurity strategy, a recent executive order on countering digital criminals, and a memo enabling private-industry participation in disruptive operations, and promises a faster tempo of sequenced operations after 50 such actions since the start of 2025, including the Lumma malware takedown with Microsoft. No implementation plan or timeline exists yet; threat teams targeting China, Russia, and criminal gangs will develop classified sub-strategies.
60
G7 Urges Fast-Track on Quantum-Safe Cybersecurity Rules
G7 cybersecurity agencies led by France's ANSSI urged accelerated transition to post-quantum cryptography, prioritizing critical systems and phased, risk-based migration.
Under France's 2026 G7 Presidency, ANSSI, chairing the G7 Cybersecurity Working Group, published a September 3 call to action urging governments and organizations to begin quantum-safe (PQC) transitions now, reframing the quantum threat as near-term. The document, signed by the national cyber agencies of all G7 members and supported by the EU Commission and ENISA, outlines five priorities including national PQC strategies, R&D, public-private partnerships, and integrating PQC into cybersecurity requirements. It recommends cryptographic inventories, dependency mapping, prioritizing the most critical systems, and buying PQC-integrated products during normal renewal cycles. ANSSI will stop vetting non-quantum-safe products in 2027, with PQC mandatory in some security product procurement by 2030.
60
60
60
60
60
60
60
60
60
60
60
60
60
The EU CRA's Real Question: What Shipped, and When Did You Know?
ActiveState argues the EU CRA's 24-hour ENISA exploit-notification duty, effective September 11, 2026, makes current SBOMs and provenance visibility a legal necessity.
An ActiveState essay warns that the EU Cyber Resilience Act's reporting obligations take effect on September 11, 2026, requiring manufacturers of products with digital elements sold into the EU to notify ENISA within 24 hours of learning a vulnerability is actively exploited, with a fuller report within 72 hours. The law's engineering requirements only apply from December 11, 2027, leaving a visibility-first runway, and Article 13 requires the SBOM to stay current unlike one-time artifacts generated under US Executive Order 14028. The author contrasts the 24-hour notification clock with an industry-average 55 days to remediate high or critical vulnerabilities and recommends automated SBOM regeneration or consuming pre-vetted, attested open source components.
68
CMMC Hit Pause, the FAR Council Hit Play
DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.
The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.
62
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60