Introduction
Cyber incidents such as the 2024 event involving Change Healthcare, which compromised the personal information of over 100 million people, highlight the evolving nature of cyber threats – increasingly becoming risk management challenges driven by disruptive new technologies, including AI. Such incidents can halt operations, prompt regulatory investigations, and result in significant financial costs. They often lead to increased insurance claims, litigation from affected parties, and even open the door for further issues like fraud. The Change case also underscores the steady rise in both the number and severity of cyberattacks and data breaches. In response to these trends, regulators and legislators, such as the US Securities and Exchange Commission (SEC) and European Union, have sought to enact new laws and regulations protecting consumers, patients, and investors. While the threats continue to evolve, and new laws are drafted, organizations are fighting back by enacting stronger controls as part of new minimum cybersecurity thresholds mandated by common protection frameworks, such as the one outlined by the National Institute of Standards and Technology…
