244 results
ENISA's SBOM Technical Advisory, explained
ENISA's October 2026 Technical Advisory for Software Bill of Materials: its lifecycle model, the STRIDE threat model it applies to the SBOM ecosystem, its CI/CD integration guidance, and why it is advisory rather than a legal reading of the Cyber Resilience Act.
5 min read Updated
ENISA Threat Landscape 2025, explained
ENISA Threat Landscape 2025 (published October 2025) — methodology behind the 4,875 analysed incidents, the intrusion-vector and sectoral breakdowns, key cybercrime/state-nexus/hacktivism figures, and the top exploited-vulnerability weaknesses.
7 min read Updated
EtherCAT security: no native authentication in the wire protocol, and what fills the gap
EtherCAT's base protocol (ETG.1000, IEC 61158 Type 12) carries no authentication or encryption of its own — security depends on hardware frame processing, a closed topology, and now an IEC 62443-3-3 Security Level 2 certification layered on top. What academic MITM research and the one confirmed CISA advisory touching EtherCAT actually found.
9 min read Updated
EtherNet/IP and CIP Security: why Rockwell's most-deployed protocol still ships unauthenticated by default
EtherNet/IP and the Common Industrial Protocol (CIP) it carries run a large share of North American discrete manufacturing, and CIP has no authentication unless a site explicitly deploys ODVA's CIP Security extension. What CIP Security's four profiles actually add, what a 2021-to-2026 run of Rockwell Automation CISA advisories shows about real failures, and the controls that compensate where it isn't deployed.
5 min read Updated
ETSI EN 303 645: the consumer IoT security baseline, explained
ETSI EN 303 645's 13 baseline provisions for consumer IoT devices, its version history, how it relates to UK PSTI, and what it does not formally cover.
5 min read Updated
ETSI TR 103 621 (implementation guide to EN 303 645), explained
What ETSI TR 103 621 V2.1.1 actually provides: worked examples for every EN 303 645 cyber security and data protection provision, how it relates to TS 103 701 conformance testing, and when a recommendation can legitimately be skipped.
6 min read Updated
ETSI TS 103 701 (conformance assessment for consumer IoT), explained
ETSI TS 103 701 V1.1.1 (August 2021) — the companion test methodology for ETSI EN 303 645: the ICS/IXIT pro formas, Device Under Test / Supplier Organization / Test Laboratory roles, conceptual vs. functional test cases, and the PASS/FAIL/INCONCLUSIVE verdict rules.
6 min read Updated
EU AI Act cybersecurity requirements, explained
Article 15's accuracy/robustness/cybersecurity duty for high-risk AI systems, Article 55's cybersecurity rule for systemic-risk GPAI models, the Annex III high-risk categories, the Digital Omnibus's revised 2027/2028 deadlines, and how Article 42 lets Cyber Resilience Act and EUCC compliance carry over.
6 min read Updated
EU Cyber Solidarity Act, explained
The EU Cyber Solidarity Act (Regulation (EU) 2025/38), in force since 4 February 2025: the European Cybersecurity Alert System, the Cybersecurity Emergency Mechanism, the EU Cybersecurity Reserve, and the incident review mechanism.
3 min read Updated
EU MDR (Regulation 2017/745) Annex I cybersecurity requirements, explained
What Regulation (EU) 2017/745's Annex I actually requires for software and connected medical devices: points 17.1-17.4, the state-of-the-art and minimum IT requirements duties, and how this binding text differs from MDCG 2019-16 guidance.
6 min read Updated
EUCC (EU Common Criteria cybersecurity certification scheme), explained
The EUCC, the EU's first scheme under the Cybersecurity Act: Commission Implementing Regulation (EU) 2024/482, applicable since 27 February 2025, its two assurance levels (substantial, high), and how it builds on Common Criteria and SOG-IS.
3 min read Updated
Executive Order 14028: Improving the Nation's Cybersecurity, explained
What EO 14028 actually mandated in 2021 — SBOM, critical software, zero trust, the attestation form — and what's changed by 2026: OMB's M-26-05 rescission of the government-wide attestation mandate.
6 min read Updated
FDA postmarket management of cybersecurity in medical devices, explained
FDA's controlled-vs-uncontrolled risk framework, the 30-day/60-day remediation window that avoids a 21 CFR Part 806 report, ISAO participation criteria, and how this 2016 guidance still sits alongside Section 524B's newer premarket duties.
7 min read Updated
FDA's predetermined change control plan (PCCP) guidance for AI-enabled medical devices, explained
FDA's final guidance (4 December 2024, revised 18 August 2025, docket FDA-2022-D-2628): what a PCCP must contain, which submission pathways it covers, and how it lets an AI-enabled device update without a new marketing submission for every change.
4 min read Updated
FDA premarket cybersecurity for medical devices: Section 524B explained
Section 524B 'cyber device' duties: the SBOM, vulnerability-monitoring plan and patch process a submission needs, and FDA's refuse-to-accept policy.
5 min read Updated
FDA QMSR (21 CFR Part 820): the ISO 13485 harmonization, explained
What the FDA's Quality Management System Regulation (QMSR) actually changed in 21 CFR Part 820: the ISO 13485:2016 incorporation by reference, the February 2, 2026 compliance date, and what FDA says it does and doesn't require.
5 min read Updated
FIPS 140-3: Cryptographic Module Validation (CMVP), explained
NIST's FIPS 140-3 standard, its four security levels, the joint NIST/CCCS CMVP validation program, and the September 2026 move of FIPS 140-2 validations to historical status.
4 min read Updated
NIST FIPS 203, 204, 205: the post-quantum cryptography standards, explained
NIST's three finalized post-quantum cryptography standards — ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) — what each specifies, their parameter sets and key/signature sizes, and the 2030/2035 migration deadlines from NIST IR 8547.
6 min read Updated
Firmware SBOM: how to build one when you only have the binary
How to build an SBOM for embedded firmware from binaries, choose CycloneDX or SPDX, use VEX to cut noise, and meet the Cyber Resilience Act SBOM duty.
5 min read Updated
The FIRST CSIRT Services Framework, explained
What FIRST's Computer Security Incident Response Team (CSIRT) Services Framework actually defines: its five Service Areas, the CSIRT-vs-PSIRT distinction, Enterprise/Coordinating/National team types, and how it pairs with the parallel PSIRT Services Framework.
5 min read Updated
FIRST PSIRT Maturity Document: the three levels explained
FIRST's PSIRT Maturity Document: what its Basic, Intermediate and Advanced levels each require, the service areas it scores, and how it pairs with the PSIRT Services Framework v1.1.
3 min read Updated
The FIRST PSIRT Services Framework, explained
What FIRST's PSIRT Services Framework v1.1 actually defines: its six service areas, the Strategic/Tactical/Operational foundation, and how it differs from ISO/IEC 29147 and 30111.
6 min read Updated
FIRST Traffic Light Protocol (TLP) 2.0, explained
What FIRST's TLP 2.0 standard actually says: the four labels (RED, AMBER, AMBER+STRICT, GREEN, CLEAR) in the source's own words, the rules for using TLP in messages, documents and automated exchanges, and what changed from TLP 1.0.
7 min read Updated
Google's Secure AI Framework (SAIF), explained
Google's SAIF: announced 8 June 2023, its six core elements for securing AI systems, the SAIF Risk Assessment self-assessment tool, and its relationship to the Coalition for Secure AI (CoSAI), the OASIS-hosted multi-vendor group Google helped found in 2024.
6 min read Updated
Questions about this page?