Each page answers one question in the first paragraph, then shows the facts, the sources and what a director should ask next. Pages that track a moving rule carry an as-of date. The rest are written to stay true.
Yes, but rarely for the breach itself. Personal exposure comes from what people said and did around it: misleading security statements, concealing an incident, or a board that never built a…Read the answer →
When does the SEC's four-business-day cyber incident disclosure clock start?The clock starts when the company determines the incident is material, not when it is discovered. That determination must be made without unreasonable delay after discovery. The company…As of 1 October 2026 →
Is the UK Cyber Governance Code of Practice mandatory for boards?No. The Code, published by DSIT with the NCSC in April 2025, is voluntary. It sets out what directors of medium and large organisations should own on cyber risk, under five principles. It…Read the answer →
What cyber metrics should a board actually see?Fewer than most boards get, and very few technical ones. A board should see current exposure against the risk appetite it approved, its top risk scenarios with likelihood and a plausible…Read the answer →
Yes, but only the high-risk obligations. The Digital Omnibus on AI, Regulation (EU) 2026/1744, in force since 27 July 2026, moved stand-alone (Annex III) high-risk obligations to 2 December…As of 1 October 2026 →
Does ISO/IEC 42001 certification mean EU AI Act compliance?No. ISO/IEC 42001 is a certifiable management system standard for AI. It does not give a legal presumption of conformity with the EU AI Act, which only comes from harmonised European…Read the answer →
How should a board govern agentic AI?Govern agents like privileged staff, not like software features. Before an agent touches production, a board should require an inventory, a named owner, a distinct identity with least…Read the answer →
Yes, in two ways. It applies to any digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. A GCC processing…Read the answer →
What is the DPDP breach notification timeline? Is it 72 hours?Partly. Under Rule 7 of the DPDP Rules 2025, you must tell the Data Protection Board and every affected person without delay. A detailed report to the Board follows within 72 hours of…Read the answer →
Almost everything except the third-party certificate. Phase 2, which would have required C3PAO Level 2 certification from 10 November 2026, was suspended on 13 July 2026 pending a reform…As of 1 October 2026 →
What are the POA&M rules for CMMC Level 2?Under 32 CFR 170.21, you can get Conditional Level 2 status with open items only if you score at least 88 of 110, every open item is worth one point (with one partial exception for…Read the answer →
Cybersecurity board reporting: a practitioner's framework: what belongs on the page, what to cut, and the cadence that holds.
Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.
me@sarfarazchougule.com →