Regulation covers the laws and rules that shape data protection, breach reporting, cyber risk management, and accountability for organizations.
Search across headline titles and summaries.
Background for this topic.
Regulation is the set of laws, rules, and formal requirements that govern how organizations collect, use, store, transfer, and secure information. In cybersecurity, its scope may depend on the data involved, the organization’s sector, and the jurisdictions in which it operates. Requirements can address privacy, access control, risk assessment, retention, encryption, audit records, third-party oversight, and notification of certain security incidents.
For practitioners, regulation turns security obligations into evidence-based operational work: identifying regulated data, mapping it to systems and suppliers, testing safeguards, and preserving records that demonstrate compliance. It also affects vulnerability management and incident response, because organizations may need documented remediation priorities, investigation procedures, and legally defined notifications. Meeting a regulatory requirement does not guarantee that systems are secure; controls must still reflect current threats and the organization’s actual attack surface. Noncompliance can create legal, financial, and operational exposure, particularly when weak governance obscures who is responsible for protecting data.
Artificial intelligence that is embedded in newer editions of software and other technology tools but is not explicitly revealed by vendors is a substantial risk on par with shadow AI, said regulatory attorney Elizabeth Hodge with the law firm Akerman LLP.
Blackbaud's Attorneys Jon Olson and Ron Raether on Legal Risk, Trust and RecoveryIn part three of the Anatomy of a Breach series, attorneys Jon W. Olson and Ron Raether examine what happens in the aftermath of a breach crisis. The experts discuss legal exposure, regulatory scrutiny and how early decisions can shape long-term trust, litigation outcomes and recovery.
Trilogue Deal Carves Out Industrial AI, Adds Nudifier BanLawmakers from Europe's political institutions agreed to water down the continent's landmark artificial intelligence regulation at a moment when the 2024 AI Act has barely started to be implemented. The law's requirements for high-risk AI will likely only be enforced starting in December 2027.
Investigators Find Violations of State Cyber RegulationsNew York fined Delta Dental $2.25 million for the company's response to the mass exploit of a zero-day vulnerability in Progress Software' MOVEit file transfer application. Delta Dental is one of thousands of organizations caught up in the blast radius of an automated 2023 Memorial Day hack.