Ep. 74 - CTEM's Silent E: DORA, NIS2 and the End of Security by Attestation
Regulators stopped asking whether you have security controls. Now they want proof the controls actually work. Host Tova Dvorin sits down with Adrian Culley to argue that CTEM has a silent E—for evidence—and that evidence is now the currency of cyber regulation worldwide. Inside: DORA's Article 26 threat-led penetration testing, NIS2's "assess the effectiveness" clause and personal board liability, the SEC's 8-K materiality clock, NYDFS Part 500's personally signed CISO certification, and the EU AI Act's August logging deadline. Subscribe to The Cyber Resilience Brief for more.
TIMESTAMPS & CHAPTERS
00:00 What is CTEM's silent E?
00:28 Why does evidence matter in cybersecurity?
01:40 How is security shifting from attestation to validation?
02:58 Where does discovery fit in generating evidence?
04:22 How does DORA affect financial entities?
06:01 What does the NIS2 Directive require?
08:26 What do the SEC's cyber disclosure rules demand?
10:03 How does NYDFS make compliance personal?
12:11 How is compliance paperwork different from evidence?
18:54 How do organizations build the evidence habit?
20:33 What is the future of evidence in cyber regulation?
Read Adrian's full blog on this: https://www.safebreach.com/blog/ctem-evidence-regulatory-compliance-validation/
#cybersecurity #CISO #DORA #NIS2 #CTEM #BAS #cyberresilience #GRC