Search: “Best Practice Assessment”

3 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 504 Ransomware 258 Data breach 195 Policy & legal 168 Industry 131 Exploit / PoC 82 Malware 78 Threat actor 53 Phishing & fraud 47 Advisory 35 AI safety & security 22 Research 22 AI research 18 AI industry 11

SeverityAll critical 860 high 297 medium 252 low 146 info 94

Cyber Essentials Has Record Year but Takeup Remains Low

UK Cyber Essentials certifications hit a record 61,430 in the year to June 2026, up 20%, but uptake remains low among 5.7 million SMEs.

The UK government awarded a record 61,430 Cyber Essentials certificates between July 2025 and June 2026, a 20% year-over-year increase, including 46,245 basic self-assessed and 15,185 audited CE+ certifications. Roughly three-quarters were recertifications, and uptake remains low against an estimated 5.7 million UK SMEs. An ESET survey found 49% of UK SMEs suffered a cyber incident in the past year, while the Cyber Resilience Pledge and the Cyber Security and Resilience Bill aim to push certification through supply chains.

Infosecurity Magazine12:15 UTC · 1h agoPolicy & legal

FCC proposes public scorecard to rate telecoms on anti-robocall efforts

The FCC proposed a public scorecard rating telecoms' anti-robocall effectiveness and removed 14 providers from US networks for compliance failures.

The Federal Communications Commission issued a public notice proposing a scorecard that would assess how effectively retail voice providers, including wireless, wireline and VoIP, prevent illegal robocalls, drawing on Robocall Mitigation Database filings, consumer complaint and enforcement data. The agency stressed it is not a rulemaking imposing new requirements, and it is seeking comment on scope, such as whether to focus on larger providers. The same day, the FCC removed 14 providers from the Robocall Mitigation Database for non-compliance, effectively requiring other US providers to block their traffic within two days.

CyberScoopSep 2, 17:57 UTC · 14d agoPolicy & legal

Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security

CISA's BOD 26-04 replaces severity-based federal patching with risk-based remediation deadlines of 3, 14, or 60 days.

CISA's Binding Operational Directive 26-04, released June 10, 2026, replaces BOD 19-02 and BOD 22-01 for Federal Civilian Executive Branch agencies and shifts remediation prioritization from CVSS scores to risk context. Agencies assess four factors: public exposure, KEV listing, exploit automatability, and whether exploitation grants partial or total asset control, resulting in 3-, 14-, or 60-day remediation windows or next-upgrade fixes. In CISA's first review at a large civilian agency, only 1% of vulnerabilities required three-day remediation while over 60% could wait for future system upgrades. The directive also requires forensic analysis when exploitation is suspected, and Checkmarx argues the same risk-based logic must extend upstream into software development and SBOM-driven exposure management.

CheckmarxSep 9, 18:07 UTC · 7d agoPolicy & legal