OpenPolicy

Defend, harden, prevail: America’s cyber defense agency charts its 2030 course On October 26, the Cybersecurity and Infrastructure Security Agency (CISA) released its new roadmap, CISA 2030, tied to the administration’s broader cyber and resilience strategies. It’s built on three pillars: leading national cyber defense, prioritizing critical infrastructure security and mobilizing resilience nationwide. CISA will undertake a core services review starting within 60 days, and aims to deliver an implementation plan within 180. WHY IT MATTERS: The strategy’s impact-driven approach to fortifying high-risk systems like #OperationalTechnology (OT) will likely shape future federal guidance and security baselines. THE RISK: CISA 2030 assumes adversaries will gain footholds. The test for operators: can you prioritize responses by real-world consequence? And if one asset falls, can essential operations keep running? THE MOVE: Before the implementation plan sets metrics, OT vendors should show operators how their features speed triage, maintain safe continuity in degraded conditions and shorten recovery. Each week, OpenPolicy's #FromTheActionBoard series highlights timely policy developments surfaced through the OpenPolicy Action Board and their implications for business strategy, go-to-market, and growth. Explore more: https://lnkd.in/eufMPiAi #CISA2030

This week's #FromTheActionBoard focuses on how Singapore’s new cybersecurity strategy empowers the country to act earlier, at scale and at threat speed. At #SICW2026 this week, the Cyber Security Agency of Singapore (CSA) launched the Cybersecurity Strategy 2026, the country’s third such strategy since 2016. Over the next five years, the government will shift to a more proactive national defense posture by upgrading its National Cybersecurity Command Centre and raising security standards beyond critical infrastructure. AI-enabled defense, next-generation operational technology security, and quantum-safe migration are all key priorities. WHY IT MATTERS Singapore’s ambitious new cyber push will open doors for AI, operational technology and quantum-safe vendors while raising the bar on security across the board. THE RISK The strategy’s five-year horizon is a long time at AI speed. As initiatives roll out, today’s voluntary guidance could become tomorrow’s baseline. Late movers miss the chance to shape it. THE MOVE Map your offerings to the strategy’s four primary pillars, and engage the Cyber Security Agency now: it’s openly inviting industry to partner on implementation. Each week, OpenPolicy's #FromTheActionBoard series highlights timely policy developments surfaced through the OpenPolicy Action Board and their implications for business strategy, go-to-market, and growth. Explore more: https://lnkd.in/eufMPiAi #SingaporeCyber #SingaporeInternationalCyberWeek #SICW

Each week, #FromTheActionBoard highlights timely policy developments surfaced through the OpenPolicy Action Board and their implications for business strategy, go-to-market, and growth. This week's focus is on the UK's Cyber Security and Resilience Bill (CSRB), which is redrawing who counts as critical infrastructure — and how they’ll have to prove resilience. The CSRB has cleared the House of Commons and is moving through the House of Lords, with Royal Assent expected later this year, though it could slip to 2027. It significantly amends the UK's 2018 NIS Regulations — bringing them closer to the EU's stronger NIS2 baseline — while pulling data centers and managed service providers into regulated scope for the first time and giving regulators new power to designate "critical suppliers." WHY IT MATTERS: The bill casts a wider net and imposes stricter mandates, expanding demand for tools, services, and expertise that prove readiness. But Royal Assent isn't the finish line: secondary legislation will define the technical enforcement criteria and rollout schedule. THE RISK: Move too early on specs that don't exist yet and you've built ahead of the market. Wait too long and you miss the window to shape it. THE MOVE: Track the consultations and parliamentary debate now to get a read on where secondary legislation is heading directionally. Build a flexible go-to-market plan that can move as details firm up. Explore more insights from the #OpenPolicy Action Board: https://lnkd.in/eufMPiAi #CybersecurityAwarenessMonth #CyberResilience

Each week, #FromTheActionBoard highlights timely policy developments surfaced through the OpenPolicy Action Board and their implications for business strategy, go-to-market, and growth. This week's focus is on the UK's Cyber Security and Resilience Bill (CSRB), which is redrawing who counts as critical infrastructure — and how they’ll have to prove resilience. The CSRB has cleared the House of Commons and is moving through the House of Lords, with Royal Assent expected later this year, though it could slip to 2027. It significantly amends the UK's 2018 NIS Regulations — bringing them closer to the EU's stronger NIS2 baseline — while pulling data centers and managed service providers into regulated scope for the first time and giving regulators new power to designate "critical suppliers." WHY IT MATTERS: The bill casts a wider net and imposes stricter mandates, expanding demand for tools, services, and expertise that prove readiness. But Royal Assent isn't the finish line: secondary legislation will define the technical enforcement criteria and rollout schedule. THE RISK: Move too early on specs that don't exist yet and you've built ahead of the market. Wait too long and you miss the window to shape it. THE MOVE: Track the consultations and parliamentary debate now to get a read on where secondary legislation is heading directionally. Build a flexible go-to-market plan that can move as details firm up. Explore more insights from the #OpenPolicy Action Board: https://lnkd.in/eufMPiAi

#FromTheActionBoard is a new series highlighting timely policy developments surfaced through the OpenPolicy Action Board and their implications for business strategy, go-to-market, and growth. THIS WEEK'S FOCUS: The EU’s Cyber Resilience Act just moved from paper to practice. Starting mid-September 2026, manufacturers of connected products that are sold in the EU became subject to a 24-hour reporting clock for actively exploited vulnerabilities and severe security incidents. These Article 14 reporting requirements are part of a broader Cyber Resilience Act (CRA) compliance regime that will see a full set of product rules landing in December 2027. WHY IT MATTERS: Article 14 makes reporting a live compliance obligation, and most manufacturers aren’t ready. In-scope entities now have 24 hours to send an early warning, 72 hours for a full notification, and either 14 days or one month for a final report. THE RISK: 24 hours moves fast. Manufacturers who miss the reporting windows risk exposure to fines up to €15 million or 2.5% of global turnover, whichever is higher. THE MOVE: For manufacturers, ensure your SBOM is current and know exactly who will own CRA reporting processes internally. For cyber providers, pitch to the new EU playing field: audit your product’s CRA-readiness messaging and reporting workflows. Explore more insights from the #OpenPolicy Action Board: https://lnkd.in/eufMPiAi

Each week, #FromTheActionBoard highlights timely policy developments surfaced through the OpenPolicy Action Board and their implications for business strategy, go-to-market, and growth. This week's focus is on federal #quantum policy: where it stands, where it's headed and what it means for you. Three months after the Trump Administration launched an ambitious whole-of-government quantum push through Executive Order 14413, its most significant deliverable yet just landed: DOE's $215M Quantum Genesis Q Competition, launched on September 17. A handful of parallel workstreams are still to come out of Commerce, Defense, NSF and NASA over the next several months. Meanwhile, a bipartisan group of senators is keeping the pressure on to pass the pending National Quantum Initiative Reauthorization Act, potentially attached to the FY27 NDAA. WHY IT MATTERS Agencies are turning executive ambitions into active programs that businesses can act on now. Successful NQI reauthorization legislation would push the effort beyond hardware into the broader quantum stack. THE RISK Until there is a new statutory quantum coordination framework in force, companies are left tracking different program windows and may end up building to agency expectations that don't yet line up. THE MOVE Map the agency deadlines you're exposed to. Watch the FY27 NDAA: if it carries NQI reauthorization, today's patchwork becomes a coordinated, durable mandate. Explore more insights from the #OpenPolicy Action Board: https://lnkd.in/eufMPiAi #QWC2026 #QuantumWorldCongress