Table of Contents
Howdy Friend!
Welcome back to the InfoSec GRC Brief from SaltyCloud, your go-to source for curated insights on governance, risk, and compliance in information security. This edition covers the GRC news worth sharing from the first half of October.
Let’s get into it!
Regulatory & Compliance Updates
CISA 2015 Reauthorization Stalls
Permanent authority for the Cybersecurity Information Sharing Act of 2015 expired at the end of fiscal 2025, and the Senate standoff over a long-term renewal shows little sign of ending this Congress. Commonly called CISA 2015, the law shields companies from liability, including under antitrust law, when they share cyber threat indicators with the federal government or with each other.
Congress had kept the protections running through short-term extensions attached to continuing resolutions. One pending bill would apply the protections retroactively to cover a lapse.
Senate Homeland Security Chairman Rand Paul and ranking member Gary Peters sit at the center of the debate. But the two have yet to agree on what a renewal should contain.
As of October 9, three proposals were pending:
- Peters’ Cybersecurity Information Sharing Extension Act (S. 1337) extends CISA 2015 through fiscal 2035 and changes nothing else.
- Peters’ shutdown-era Extending Expired Cybersecurity Authorities Act (S. 2983, introduced with Mike Rounds) applies the liability protections retroactively to cover the lapse and renames the program the Protecting America from Cyber Threats Act.
- House Homeland Security Chairman Andrew Garbarino’s Widespread Information Management for the Welfare of Infrastructure and Government Act (WIMWIG Act) makes select changes and has awaited a floor vote since the committee advanced it unanimously last year.
The post-midterm calendar leaves little room for a floor fight, so the question may carry into the incoming 120th Congress.
Your next step: List which sharing agreements and threat intelligence memberships rely on CISA 2015 protections, then check the enacted extension for the applicable expiration date.
Senate Passes the Health Care Cybersecurity and Resilience Act
On October 1, the Senate passed the Health Care Cybersecurity and Resilience Act by unanimous consent and sent it to the House. Senators Bill Cassidy, who chairs the Health, Education, Labor, and Pensions (HELP) Committee, Maggie Hassan, John Cornyn, and Mark Warner sponsored the bill, with Cindy Hyde-Smith and Angus King cosponsoring.
As described by its sponsors, the bill would:
- Strengthen coordination among the federal agencies involved in health care cybersecurity.
- Improve security practices at rural providers working with fewer resources.
- Help providers respond faster when an attack hits patient care.
However, Senate passage is not enactment. As of October 1, House action and enactment were still pending.
Your next step: Set an alert on the bill and track House action and any amendments.
ICO Issues Reprimand Over Unapproved Platform
On October 14, the UK’s Information Commissioner’s Office announced a reprimand and an enforcement notice against the Metropolitan Police Service. Officers shared personal information with a third-party retail crime intelligence platform that the force never approved, including names, dates of birth, and a small number of home addresses, according to an ICO enforcement notice.
Officers and staff used the platform between March 2023 and September 2024, creating around 500 accounts, 375 of them in active policing use. Between January and September 2024, they uploaded information on 179 people while trying to identify suspected shoplifters, three of whom were under 18.
MPS suspended the platform in September 2024 and brought it back in January 2026 with stronger governance, additional staff training, formal contractual controls, and a completed assessment. However, because the force had not fixed the wider process for approving third-party technology, regulatory action still followed. The ICO found several failures:
- Unlawful processing without consent, where the sharing was not necessary for law enforcement purposes.
- No technical and organizational measures to protect the information or to hold staff to the force’s own approval process for third-party technology.
- No data protection impact assessment before high-risk processing began.
- A continuing failure to keep unapproved third-party technology out of personal information processing.
The enforcement notice sets the remedy: a stronger process for identifying, assessing, and approving third-party services that process personal information. The force also has to review its controls, improve governance, raise staff awareness, test regularly whether those measures work, and report progress to the ICO.
Your next step: Pull SaaS sign-ins from your identity provider and software charges from expense reports, then compare both lists against your approved inventory. Our TPRM Maturity Checklist scores the distance between approval on paper and the tooling staff reach for.
Swedish Regulator Fines Miljödata SEK 1.8 Million
On October 1, the Swedish Authority for Privacy Protection (IMY) fined IT service provider Miljödata i Karlskrona AB SEK 1.8 million for failing to secure the personal data it processed. The fine comes after an August 2025 cyberattack, when a threat actor took a large volume of that data and later published it on the darknet.
Miljödata puts the number of affected individuals at 2.2 million. The published data included personal identity numbers, contact details, sick leave and rehabilitation records, and records of student-related incidents in schools.
IMY found the company negligent under Article 32(1) of the GDPR, which requires security measures appropriate to the data being processed. More specifically, Miljödata:
- Ran no adequate checks when installing new software.
- Had no automated real-time monitoring to catch intrusions or suspicious activity.
Alongside a large number of private companies, a majority of Sweden’s municipalities, several regions, and government agencies ran on Miljödata. IMY has opened separate reviews of two municipalities and one region, which means controller accountability for the same breach is still being decided apart from the processor’s fine.
Your next step: Add the two questions that decided this case to your next vendor assessment — what gets checked before new software reaches production, and what monitors the environment in real time.
OAIC Sets a December Deadline for Automated Decision Disclosures
Starting December 10, the agencies and organizations bound by Australia’s Privacy Act 1988 and its Australian Privacy Principles must disclose automated decision-making in their privacy policy. More specifically, APP requires them to describe in their privacy policy any computer program they have arranged to make, or to substantially inform, decisions that significantly affect individuals.
The obligation came in through the Privacy and Other Legislation Amendment Act 2024. It applies only where all three conditions in APP 1.7 are met:
- The entity has arranged for a computer program to make a decision, or to do something substantially and directly related to making it.
- The decision could reasonably be expected to significantly affect an individual’s rights or interests.
- Personal information about that individual is used in the program’s operation.
Where those conditions apply, APP 1.8 sets what the privacy policy has to say — the kinds of personal information the programs use, the kinds of decisions made solely by those programs, and the kinds of decisions where the program does something substantially and directly related to the decision.
Supporting resources are available from Office of the Australian Information Commissioner (OAIC):
- An updated version of its APP 1 Guidelines
- A fact sheet on the APP 1.7 to 1.9 transparency obligation
- A supplementary fact sheet for government agencies, and a flowchart.
At its core, the obligation is transparency. An accurate disclosure still depends on upstream work — knowing which automated decisions exist, which of them clear the significant-effect threshold, and what personal information each one uses.
Your next step: Run the OAIC flowchart against your automated decisions in production, then draft APP 1.8 language for the ones clearing the significant-effect threshold before December 10.
GRC Strategies
NIST Drafts Revision 4 of OT Security Guide
On September 21, NIST released the initial public draft of SP 800-82 Revision 4, Guide to Operational Technology (OT) Security. It covers programmable systems that interact with the physical environment, including industrial control systems, building automation, transportation systems, physical access control, and environmental monitoring.
The revision reorganizes the guide around how OT risk is governed:
- Restructured around NIST Cybersecurity Framework (CSF) 2.0, with the old risk management section rebuilt around the Govern Function
- Expanded treatment of how OT risk management lines up with enterprise risk management as described in NIST IR 8286r1
- Adoption of the NIST Risk Management Framework (RMF) in Appendix F
- Expanded control guidance for asset management and network monitoring and detection
- Security architecture guidance on protecting system management functions and applying zero trust principles
The sector coverage also widens, adding building automation and control systems, water and wastewater, food and agriculture, freight rail, maritime vessels, and the convergence of industrial IoT with cloud services.
Revision 3 remains the current version until the final publication lands, so nothing in the draft changes an assessment today. Comments are open through November 30.
Your next step: Compare the draft’s asset management and network monitoring guidance against what an OT environment produces today, then file the gaps as comments.
FSB Finalizes 12 AI Adoption Practices
On October 15, the Financial Stability Board published the final version of its Sound Practices for Responsible Adoption of Artificial Intelligence. It names 12 practices for financial institutions, reflecting feedback on the June consultation. The FSB published an overview of consultation responses the same day.
Four of the practices cover organization-wide governance. They:
1. Put the board and senior management in charge of aligning AI adoption with the business model, risk appetite, and strategy.
2. Call for a governance framework with defined roles and responsibilities.
3. Fold AI risks into the existing risk management framework with documentation of where AI is used.
4. Treat learning and adaptation as continuous work.
The remaining eight follow the AI lifecycle:
5. Systematic assessment of each use case’s materiality and risk, at inception and afterward.
6. Selection of appropriate AI technologies.
7. Appropriate data governance.
8. Explainability for different types of AI, with compensating controls where explanation falls short.
9. Evaluation of use case performance.
10. Effective human oversight.
11. Management of AI-related cyber and information and communication technology (ICT) risk.
12. Management of risks from third-party AI dependencies.
The FSB describes the practices as a toolkit institutions can tailor and fold into frameworks they already run, including those for cyber and third-party risk.
Your next step: Map the 12 practices onto existing governance, cyber, and vendor risk processes and name an owner for each. The practices left without one are your gap list.
CISA Retires Weekly Vulnerability Bulletin
On September 28, CISA stopped publishing its weekly Vulnerability Bulletin. The agency announced the change on September 16, tying it to a shift away from severity-based vulnerability management. The move also aligns with BOD 26-04, which directs federal agencies to prioritize vulnerabilities on real-world risk factors instead of severity scores alone.
Because the directive binds federal agencies only, the reporting change matters more than the mandate for most teams. Anyone who used the weekly CVSS summary as the front door to vulnerability intake now has several narrower feeds instead of one digest.
- The Known Exploited Vulnerabilities (KEV) catalog
- CISA cybersecurity alerts and advisories
- CVE records
Still, each resource carries a different trigger. KEV says something is being exploited, an advisory says something needs attention, and a vendor bulletin says a specific product has a fix. Former bulletin subscribers can keep receiving email by updating their GovDelivery preferences to the KEV catalog and cybersecurity advisories topics. CISA also points organizations to vendor and provider advisories for the products they run.
Your next step: Name the feed that now opens a ticket and the person who watches it, and write down what evidence of exploitation or exposure moves a vulnerability to the front of the queue.
Censys Counts 268,000 Internet-Exposed AI Devices
Roughly 268,000 internet-connected devices are running AI products, according to a Censys report. The internet monitoring firm identified 44 distinct products, from workflow automation to assistants and large language model gateways.
- 82% of exposed devices run just five of those 44 products, among them the automation platform n8n, the assistant tool OpenClaw, and the chatbot interface Open WebUI.
- Exposure climbed 63% between October 2025 and June 2026, peaking near 300,000 endpoints early this year.
The takeaway? An AI deployment is not one asset. “The attack surface grows not simply when another AI application is deployed,” the report’s analysts wrote, “but when each layer supporting that application becomes independently reachable from the Internet.” Because orchestration tools sit in a privileged position, a compromise there reaches downstream systems.
Industrial equipment shows the same pattern. Censys scans found around 134,000 internet-accessible ICS devices in early 2026, about 4% more than in 2024. The findings change how exposure should be measured:
- More than 80% run at least one non-ICS function, such as an HTTP or FTP server, alongside their primary role.
- An attacker who can reach those services does not need to understand industrial protocols to get in.
- Roughly 70% sit on mobile or consumer networks, where operators are hard to identify and updates arrive rarely.
Censys measured what answers a request from the public internet, not what an attacker reached. So, none of these counts proves a breach. The question the scans raise is answerable in a week: Which AI and industrial systems in your own environment respond to someone outside it?
Your next step: List every layer behind each AI application — orchestrators, gateways, and model-serving components. Then, search your own public IP ranges and domains in Censys or Shodan. Send a request to each layer from outside the network to see which answer.
Cyber Incidents & Risk Implications
Cisco Confirms Secure Email Gateway Exploitation
In October, Cisco’s product security incident response team became aware of active exploitation of CVE-2026-76519, an arbitrary file write in Cisco Secure Email Gateway that can hand an unauthenticated remote attacker command execution with root privileges.
Cisco found the vulnerability during internal security scanning. It sits in the Advanced Malware Protection feature, which mishandles email attachments when the file reputation service is enabled, so an attacker exploits it by sending a crafted attachment through an affected device.
Whether a gateway is affected depends on its configuration. A physical or virtual gateway is vulnerable only if it runs an affected AsyncOS release with File Reputation enabled and assigned to a mail policy, and a Content Scanner Tools version earlier than 25.3.0.5525. The contentscannerstatus command at the CLI shows that version. No workarounds exist.
Fixed releases are 15.5.5-014 and 16.5.0-780, with 16.0 requiring migration to a fixed release. The fix also ships through Content Scanner Tools 25.3.0.5525 and later, without a software upgrade or restart. Once the update applies, appliances with automatic Content Scanner Tools updates enabled need no further patching action. Cisco has applied the fix to Secure Email Cloud Gateway. Cloud customers Cisco has contacted about compromise still need to renew credentials and cryptographic material installed on the appliance.
Still, check for compromise before upgrading. The system_logs output flags a suspected compromise indicator, but root access lets an attacker remove or hide evidence. Cisco recommends cross-checking network and firewall logs off the device for unexpected uploads to external addresses. Because SSH key pairs authenticate cluster members, a single compromised appliance puts the rest of its cluster in scope.
Where exploitation is suspected on a virtual appliance, Cisco’s recovery sequence is:
- Preserve forensic data.
- Deploy a new virtual machine on a fixed release.
- Rebuild the configuration without importing previous configuration files.
- Renew credentials and any cryptographic material installed on the appliance.
- Keep monitoring for anomalous behavior afterward.
Your next step: Run contentscannerstatus to check the current scanner version, confirm the AsyncOS release and File Reputation configuration, and review system_logs for compromise indicators.
DOJ Charges 14 in North Korean IT Worker Schemes
On October 13, the Justice Department announced charges against 14 people, two arrests, and the seizure of roughly 187 devices tied to North Korean remote IT worker schemes facilitated by Famous Chollima. A four-count indictment in the Northern District of Ohio charges US nationals with wire fraud, money laundering, and identity theft, along with ten China-based defendants.
According to the indictment, the scheme ran from 2019 to around July 2025, reaching more than 70 US companies. Victim employers span health care, communications, cyber support, retail, and manufacturing across Ohio, sixteen other states, and the District of Columbia.
Authorities believe it generated about $3 million in revenue for sanctioned entities controlled by the North Korean government. The indictment describes the alleged scheme:
- Perpetrators used stolen or fabricated identity documents to apply for remote positions.
- They routed their work through VPN and proxy infrastructure to appear as US persons working inside the country.
- US-based facilitators received company-issued laptops at their homes, configured them, and installed remote-access software.
Between September 21 and 25, the FBI conducted searches and other law-enforcement action at more than 40 Texas residences known or suspected to be laptop farms under Operation Lonestar Roundup. The department seized about 187 laptops and keyboard, video, mouse devices.
The FBI also published a public service announcement with mitigation guidance, and listed fraudulent email accounts employers can add to their detection indicators.
Your next step: Compare the shipping address for company-issued hardware against each remote worker’s stated location, and route a mismatch to security.
Astrana Health Files Material Incident Disclosure
On September 22, health care company Astrana Health determined that a cybersecurity incident was material and filed an Item 1.05 disclosure the following day. Threat actors impersonated company personnel and spoofed the company’s main corporate telephone number, then contacted employees to obtain unauthorized access to systems.
Astrana Health Management, a subsidiary, detected the unusual activity. The security team responded, engaged a third-party forensics firm, notified law enforcement, and began notifying state and federal regulators along with payer partners. In the filing, remediation covers four actions:
- Resetting affected credentials.
- Restricting remote access tools.
- Restoring certain systems from clean backups.
- Enhancing monitoring, logging, and detection across the environment.
Astrana believes private or confidential information on its servers was accessed or taken, but has not yet established what kind. The categories still under review are patient, employee, and credentialed provider information, confidential business and financial information, and intellectual property. Notifications, including to affected patients, follow once the findings support them. The company carries cybersecurity insurance that may cover some losses and does not currently expect a material effect on its financial condition.
Astrana determined that the incident was material based on the potential sensitivity of the information involved, while its investigation into the scope and impact remained ongoing.
The attack is also easy to copy. Spoofing a company’s main number takes an attacker almost nothing, and the employee who answers sees an internal number on the screen, so caller ID confirms the lie instead of catching it.
Your next step: Call the help desk from a spoofed internal number and ask for a password reset. Passing means the agent hangs up and calls back on the number in the directory before changing anything.
Microsoft Patches Exploited Windows Shell Bypass
Microsoft’s October 13 updates fixed CVE-2026-96951, a Windows shell security feature bypass already exploited in the wild and scored 8.8. The flaw evades Mark of the Web, the tag Windows applies to files downloaded from the internet, which tells Defender SmartScreen and Office Protected View to restrict automatic execution.
With the tag bypassed, a malicious file opens without the usual warning. But the attack still requires a user to open attacker-supplied content delivered by email or instant message. Researchers at Fujitsu, Anthropic, and an independent expert reported the flaw separately, and CISA added it to the KEV catalog the same day. The remediation date for federal agencies is October 16.
Two other patched vulnerabilities were publicly disclosed before fixes shipped.
- CVE-2026-108398 bypasses Windows Defender Application Control enforcement, which Microsoft believes is unlikely to be exploited.
- CVE-2026-92707 is a denial-of-service flaw in MessagePack for C#, the serialization library shipped with Visual Studio and .NET: deserializing attacker-controlled data as
System.ObjectthroughPrimitiveObjectFormatterallocates excessive memory until the process terminates.
The latter is fixed in library version 2.5.303 or 3.1.9, rather than a Windows update.
But the volume behind these vulnerabilities is still an issue. This month set a record for CVEs addressed in a single Patch Tuesday, according to Microsoft’s October 2026 release notes. Alongside the updates, the company introduced risk cohorts, groupings of CVEs that raise the same question about a customer’s environment even when they share no root cause or score.
Microsoft is calling the approach exploratory and the cohorts provisional, and the Security Update Guide does not display them yet. The company still advises reviewing each CVE for:
- Active exploitation
- Severity
- Attack vector
- Required user interaction
- Product-specific guidance
With only one confirmed exploited CVE in this month’s set, that split orders the queue more cleanly than any severity score. Everything else sorts on attack vector, required user interaction, and whether the product runs in your environment at all.
Your next step: Patch CVE-2026-96951 ahead of the rest against the federal October 16 date.
CERT-FR Expands Its Refrigeration Controller Alert
France’s national CERT knows of numerous compromises of remote refrigeration installation controllers. It widened its alert on October 13 to add Copeland xweb and Dixell xweb, alongside the Danfoss AK-SM and AK-SC series named when the alert first appeared on October 12. CERT-FR identifies no CVE and no actor. The common factor is a management interface reachable from the internet, which CERT-FR calls contrary to good practice on its own.
For equipment that has not been compromised, CERT-FR’s guidance runs in four steps:
- Remove internet exposure from affected units and from every unit sitting on a public IP address, after checking insurance contract terms that may require the data feed to the refrigeration contractor.
- Verify the full configuration, including defrost ranges.
- Restore access only through a secure VPN or a protected network, treating firewall filtering of contractor source addresses as an emergency measure rather than a lasting one.
- Apply the manufacturer’s hardening guidance, which for Danfoss equipment means updating firmware, setting the security level to Strict, and confirming default passwords were changed.
For compromised equipment, CERT-FR says to remove internet exposure first, after checking applicable insurance contract terms, then perform a factory reset. Restore access only through a secure VPN or protected network, then reconfigure and harden the equipment.
CERT-FR attaches a warning to that reset. Attack campaigns are probably still running, and a factory reset on end-of-life equipment clears the attacker’s persistence while leaving the device unpatched and almost certain to be compromised again if it remains exposed to the internet. For gear with no security updates coming, removing public exposure is the remediation rather than a step toward it.
Your next step: List which controllers a refrigeration contractor reaches and confirm none of them answer on a public address, then review the configuration itself, since changed defrost settings can cause product loss without exploiting a software vulnerability.
SaltyCloud Research
TPRM Frameworks, Programs & Governance: Complete Guide [2026]
How to structure a third-party risk program, from framework selection and tiering through the governance that keeps vendor decisions documented.
NIST CSF 2.0: Complete Guide [2026]
A walkthrough of the six Functions in CSF 2.0, including the Govern Function that newer federal guidance keeps building on.
Resource
NIST CSF 2.0 Readiness Scorecard
Score cybersecurity maturity against CSF 2.0, see which Function is holding the program back, and get a prioritized list of next steps.
Wrapping Up
Most stories in this edition turned on a record of what an organization had approved, inventoried, or verified, and on how far that record sat from what was running.
- Approval and oversight: the Met used a platform no one cleared, and Miljödata’s fine turned on software installation checks and monitoring.
- Identity: DOJ alleged that North Korean IT worker schemes used stolen or fabricated identities, and Astrana’s attackers spoofed the company’s main number.
- Exposure: Censys counted internet-exposed AI and industrial systems, and CERT-FR found controllers answering from public addresses.
The deadlines ahead favor programs that can produce those records on request. Automated decision disclosures are due December 10, comments on the OT draft close November 30, and exploited flaws in email gateways and Windows are being patched against evidence rather than scores.
If you’re on LinkedIn, follow SaltyCloud for more insights and updates between newsletters. And, as always, feel free to leave a comment with questions, concerns, ideas, or memes. We’re always listening.
Thanks for being part of our community and for letting us be part of your day. We’ll keep doing our part to deliver content that’s as essential as salt itself.
Wishing you resilience and security,
The SaltyCloud Research Team
This content is for informational purposes only and does not constitute legal or compliance advice. See our full disclaimer.
Past Editions
