Financial Services Archives

DORA Designation Leaves Vendor Accountability Unchanged

Critical Third-Party Oversight Changes Less Than Banks Think

by Danielle Barbour October 11, 2026October 11, 2026 | Third Party Risk

When European regulators began designating certain ICT providers as critical under DORA, some financial institutions read it as good news: a vendor now facing direct supervisory oversight sounded like someone...

Data Governance Gaps Across Financial Channels

Financial Data Governance Breaks Exactly Where Channels Meet

by Tim Freestone October 11, 2026October 11, 2026 | Kiteworks News

Most financial institutions do not have one data governance policy. They have several: one for email, another for file sharing, a different one again for payment messaging, and often no...

NIS2 Evidence Gaps: The Real Reporting Challenge

NIS2 Reporting Windows Wait for No Financial Institution

by Danielle Barbour October 10, 2026October 10, 2026 | Regulatory Compliance

A significant cyber incident at a bank starts a fixed regulatory clock the moment the institution becomes aware of it, not the moment someone gets around to writing the notification....

Who Controls Encryption Keys in Finance?

Transaction Records Need Keys Your Bank Controls, Not Your Vendor

by Tim Freestone October 9, 2026October 9, 2026 | Third Party Risk

Every core banking, payments and file-sharing vendor selling to financial institutions says client data is encrypted. That sentence hides the only detail that actually determines protection: who holds the key....

Jurisdiction Governs Financial Data, Not Location

Trading and Client Data Deserve a Deliberate Home, Not a Vendor Default

by Danielle Barbour October 8, 2026October 8, 2026 | Kiteworks News

A bank’s compliance team can usually say which country its core banking system runs in. Far fewer can say, with confidence, which country’s laws actually govern access to that data...

Closing the AI Agent Approval Gap for CISOs and Compliance

Only 14.4% of Organizations Approve Every AI Agent Before It Goes Live

by Patrick Spencer October 6, 2026October 6, 2026 | Cybersecurity Risk Management

Executives are confident and the telemetry is not. In one survey of more than 900 executives and technical practitioners, 82% of executives said they feel sure their existing policies protect...

Governing AI Agents Like Human Employees

Your Newest Employee Never Passed a Background Check: Why AI Agents Need the Same Governance as Humans

by Tim Freestone September 30, 2026September 30, 2026 | Cybersecurity Risk Management

Introduction A new hire does not get a master key on day one. They get an account scoped to their role, a manager who approves anything unusual, and an activity...

If an Admin Can Edit the Log, It Isn’t Evidence: Building an Audit Trail Regulators Actually Trust

by Danielle Barbour September 30, 2026September 30, 2026 | Regulatory Compliance

Introduction Most organisations can produce an audit log when asked. Far fewer can answer a harder question: could someone with administrative access have quietly edited that log before producing it....

Classification That Follows Data Across Channels

One Policy, Every Channel: Why Fragmented Data Governance Is a Breach Waiting to Be Found

by Tim Freestone September 30, 2026September 30, 2026 | Kiteworks News

Introduction Most organisations do not have one data governance policy. They have several: one for email, another for file sharing, a different one again for APIs, and often no coherent...

Who Holds the Key Holds the Data: Why Encryption Without Customer-Owned Keys Is Not Protection

by Robert Dougherty September 30, 2026October 1, 2026 | Secure File Sharing

Every vendor selling cloud storage says the same thing: your data is encrypted. That sentence hides the only detail that actually matters. Encrypted for whom? If the vendor holds the...

Critical Designation Leaves Your Accountability Unchanged

Your Vendor’s Problem Is Now Yours: What Critical Third-Party Designation Actually Changes

by Marc ten Eikelder September 30, 2026September 30, 2026 | Third Party Risk

Introduction When European regulators started designating certain ICT providers as critical under DORA, some organisations read it as good news: a vendor now facing direct supervisory oversight sounded like someone...

GDPR Article 32: Continuous Security Measures Required

Years Later, Article 32 Still Isn’t Optional: What “Technical Measures” Actually Means in Practice

by Marc ten Eikelder September 30, 2026September 30, 2026 | GDPR Compliance

Introduction GDPR has been enforceable for years, and Article 32 remains the single most commonly cited provision in major fines. Not consent banners, not international transfer mechanisms. Security. Organisations that...

One Architecture for Governance, Risk, and Compliance

Three Teams, Three Tools, One Truth Missing: Why GRC Fails Without a Shared Architecture

by Danielle Barbour September 30, 2026September 30, 2026 | Regulatory Compliance

Introduction Ask a mid-size enterprise how governance, risk, and compliance work together, and the honest answer is usually that they don’t, not really. GRC tends to exist as three separate...

Vendor Sprawl Creates Unseen Data Policy Gaps

Six Vendors, One Policy Gap: Why Securing Every Channel Separately Guarantees You’ve Missed One

by Bob Ertl September 30, 2026September 30, 2026 | Kiteworks News

Introduction A typical enterprise data-exchange stack looks something like this: one vendor for email security, another for managed file transfer, a third for secure file sharing, a fourth for forms,...

DORA Compliance Strategies for French Banks

How French Banks Comply with DORA Requirements

by Marc ten Eikelder September 27, 2026September 27, 2026 | Regulatory Compliance

French banks face unprecedented operational resilience challenges under DORA. The Digital Operational Resilience Act establishes comprehensive requirements for ICT risk management, incident reporting, and third-party risk oversight that fundamentally reshape...

Get started.