Regulatory Updates
What changed, what did not and what it means in practice for DORA, SWIFT CSP, FedRAMP and the other regimes our clients answer to.
FedRAMP 20x: what changes for cloud providers, and what stays hard
FedRAMP is replacing document-heavy authorization with machine-readable evidence and Key Security Indicators, and has said the legacy Rev5 process is expected to wind down. The paperwork gets lighter. The engineering does not.
Read
The DORA register of information is a dependency map, not a spreadsheet
Supervisors now use the register to see concentration risk across the EU financial sector. Firms that treat it as an annual procurement export are missing what it is for, and what it can tell them about their own resilience.
Read
Choosing your SWIFT CSCF architecture type: the decision that sets your scope
Your architecture type determines which Customer Security Controls Framework controls apply and how much of your estate the independent assessor examines. The 2026 framework made that decision harder to get right, particularly for users with customer connectors.
ReadWhere this thinking is applied.
Talk to the people who wrote it.
Tell us what you are preparing for. A senior practitioner who has done this work will reply within one business day.