Two NIST drafts that put governance and enterprise risk front and centre, EU movement on the Digital Omnibus, and three incidents that all trace back to a supplier or a third-party tool.
Standards
NIST drafts a new executive security handbook aligned to CSF 2.0
NIST released the initial public draft of SP 800-100 Revision 1, Information Security Handbook: A Guide for Executive Leadership, replacing the 2006 edition. It is restructured around the CSF 2.0 functions and summarises governance, risk management, awareness and training, contingency planning, configuration management and incident response for leaders. Comments are open until 4 December 2026.
What an auditor would ask: Can leadership show where each CSF 2.0 function is owned, reported and resourced, not just that a framework was adopted?
NIST published the initial public draft of SP 800-221 Revision 1 on governing and managing ICT risk within enterprise risk management. It promotes aggregating cyber, privacy, supply chain and OT risk through risk registers into the enterprise risk profile, expressed in financial, mission and reputational terms. Comments are due by 7 December 2026.
What an auditor would ask: How does a risk on the IT register reach the enterprise risk profile, and who decides whether it is within appetite?
EU Council agrees its position on the Digital Omnibus
EU ambassadors agreed the Council's negotiating mandate on the Digital Omnibus, which amends the GDPR, ePrivacy rules and EU data rules. According to techUK's summary, the text includes a longer deadline for data breach notifications and keeps national incident-reporting entry points rather than a single EU-wide one. Talks with the European Parliament can start once it adopts its own position.
What an auditor would ask: If breach-notification timelines change, which playbooks, contracts and templates would you need to update, and who tracks the final text?
Malicious programs found on customer servers of a hosted desktop service
GMO Internet said a third party installed malicious programs in some customer server environments of its Onamae.com Desktop Cloud service, with 26,739 servers potentially affected. It began shutting down all plans of the service on 21 October while it investigates, and said it had not confirmed any leakage of personal information at that point.
What an auditor would ask: If a hosting provider shut your servers down tomorrow, which business processes stop, and when was that scenario last tested?
Cloud provider attack exposes data held for emergency staff-safety systems
A cyberattack on cloud service provider Arcadia may have exposed names and email addresses of about 125,000 officers and staff at 20 prefectural police forces in Japan, according to the Japan Times. The forces had outsourced an emergency safety-check system to the provider, and some also used it for crime alerts to residents and businesses.
What an auditor would ask: For outsourced systems used in emergencies, do you hold a current list of what personal data the supplier stores and an alternative way to contact people?
Vulnerability in a BI tool led to exposure of patient data
Dorsata, Inc. began notifying patients that a security vulnerability in Metabase, the business intelligence software it uses, allowed unauthorised access to a database of patient medical information between 10 and 12 August 2026. It patched the software after receiving notice of the vulnerability and says no misuse has been found.
What an auditor would ask: Are analytics and reporting tools that connect to production data included in your vulnerability management scope and access reviews?