A critical system goes down, and the operations team needs an administrator inside it immediately. Privileged access, however, requires approval, and the designated approver is unavailable. A change may restore the system, but normal procedure requires testing before anything reaches production. Meanwhile, the recovery clock is running.
The Commodity Futures Trading Commission has approved a rule that could make the outcome of smaller whistleblower claims considerably easier to anticipate, establishing a presumption that qualifying awards of $5 million or less will be paid at the statutory maximum of 30%.
KPMG asked 725 chief ethics and compliance officers where they expect to put additional money. The answer was not subtle. Among respondents anticipating budget increases, 77% pointed to data analytics and 75% to cybersecurity and data privacy. AI or large language models came next at 50%, followed by process automation at 49%. Upskilling talent, at 34%, trailed considerably further behind.
Chemours, DuPont and Corteva have agreed to pay $455 million over 15 years to settle a collection of North Carolina lawsuits over PFAS contamination, resolving claims that reach back through years of discharges from Chemours’ Fayetteville Works facility and extend to contamination the state says originated elsewhere.
For manufacturers selling connected products and software in the European Union, one of the Cyber Resilience Act’s first deadlines has arrived. Beginning September 11, manufacturers must report actively exploited vulnerabilities and severe incidents that affect the security of their products. The requirement reaches across the enormous category the EU calls “products with digital elements,” covering hardware and software from baby monitors and smartwatches to applications and computer programs.
The Federal Reserve Board, Federal Deposit Insurance Corporation, National Credit Union Administration, and Office of the Comptroller of the Currency on Friday requested comment on proposed guidance for managing risks associated with third-party relationships. The proposal draws on the agencies’ supervisory experience and what they have learned examining financial institutions’ third-party risk management practices.
Italy’s Data Protection Authority has fined Banco Bilbao Vizcaya Argentaria Italia (BBVA) more than €5.5 million after finding that the bank continued sending promotional messages to a customer who had objected to receiving them, an enforcement action that exposed wider problems in how the bank managed privacy requests across its systems.