GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

The HIPAA security risk analysis: the requirement most often failed
US & Americas

The HIPAA security risk analysis: the requirement most often failed

It is explicitly mandated, it underpins every other decision in the Security Rule, and enforcement actions repeatedly cite its absence or inadequacy. What a defensible analysis has to contain.
CJIS Security Policy: what contractors handling criminal justice data must do
US & Americas

CJIS Security Policy: what contractors handling criminal justice data must do

Any organisation touching criminal justice information inherits a prescriptive control set, personnel screening obligations and audit exposure - usually through a contract with an agency.
FISMA explained: what it requires, and how contractors get pulled in
US & Americas

FISMA explained: what it requires, and how contractors get pulled in

Federal agencies must secure their information systems under a defined risk management framework. Contractors operating systems on their behalf inherit those obligations, usually through contract clauses rather than direct regulation.
FFIEC cybersecurity assessment: inherent risk against maturity
US & Americas

FFIEC cybersecurity assessment: inherent risk against maturity

US financial institutions are examined on whether their cybersecurity maturity matches their inherent risk profile. How the two-part assessment works, what examiners look for, and why the relationship between the halves is the point.
US state breach notification laws: fifty clocks, one incident
US & Americas

US state breach notification laws: fifty clocks, one incident

Every state has its own breach notification statute, with different definitions, deadlines and regulator duties. How to build one process that satisfies them rather than researching fifty during an incident.
NIST SP 800-171 explained: the 110 requirements, and who they actually bind
US & Americas

NIST SP 800-171 explained: the 110 requirements, and who they actually bind

The control set behind CMMC, and an obligation in its own right for anyone handling controlled unclassified information. What the requirement families cover, what the SSP and POA&M must contain, and how scoping decides the cost.
The GLBA Safeguards Rule: who it covers is broader than you think
US & Americas

The GLBA Safeguards Rule: who it covers is broader than you think

The FTC's Safeguards Rule reaches well beyond banks — into lenders, brokers, advisers, tax preparers and many businesses that never considered themselves financial institutions. What it requires, and the elements with hard specifics.
NYDFS Part 500: the cybersecurity rule with a personal signature attached
US & Americas

NYDFS Part 500: the cybersecurity rule with a personal signature attached

New York's financial services cybersecurity regulation requires named accountability, annual certification and short breach reporting. What it demands, who it covers, and why the certification requirement changes behaviour.
US state privacy laws: how to comply with a patchwork instead of a law
US & Americas

US state privacy laws: how to comply with a patchwork instead of a law

There is no US federal privacy law, so obligations come from a growing set of state statutes with overlapping but non-identical rules. How to build one programme that satisfies them rather than tracking each separately.
SEC cyber disclosure: the four-day clock starts at materiality, not detection
US & Americas

SEC cyber disclosure: the four-day clock starts at materiality, not detection

Public companies must disclose material cybersecurity incidents on a tight timeline and describe their governance annually. The subtlety everyone misses is when the clock starts - and who decides.
CMMC: what defence suppliers actually have to do
US & Americas

CMMC: what defence suppliers actually have to do

Self-attestation is being replaced by assessed certification, and it is a condition of award rather than a nice-to-have. The levels, the NIST 800-171 relationship, and why scoping CUI is the whole game.
NIST SP 800-53 explained: control families, baselines and tailoring
US & Americas

NIST SP 800-53 explained: control families, baselines and tailoring

NIST SP 800-53 is a control catalogue, not a checklist. How the families and baselines work, what tailoring means, and why it is the reference other frameworks map back to.
The HIPAA Security Rule explained: safeguards, scope and evidence
US & Americas

The HIPAA Security Rule explained: safeguards, scope and evidence

What the HIPAA Security Rule actually requires - the three safeguard categories, required versus addressable specifications, who is covered, and the evidence that satisfies an investigation.
FedRAMP authorization: what selling cloud to US federal agencies takes
US & Americas

FedRAMP authorization: what selling cloud to US federal agencies takes

FedRAMP is the standardised authorization process for cloud services used by US federal agencies. The paths to authorization, the impact levels, the documentation burden, and the continuous monitoring that never stops.
HITRUST CSF: the certification US healthcare buyers ask for
US & Americas

HITRUST CSF: the certification US healthcare buyers ask for

HITRUST turns HIPAA and a dozen other frameworks into a certifiable, scored control set. How the assessment levels work, why scoring is maturity-based, and who it is worth it for.
© 2026 GRCOPILOT