Cybersecurity Guides and Best Practices: The Complete 2026 Enterprise Playbook

Cybersecurity Guides and Best Practices

In 2025, the fastest recorded cyberattack went from initial break-in to moving across a victim’s network in 27 seconds. Not 27 minutes — 27 seconds. A year earlier, the record was 51 seconds. The median time of the average attack, across all the incidents CrowdStrike responders had to deal with during that year, took 29 minutes to propagate after an attacker gained initial access, compared to 48 minutes in 2024 and 98 minutes in 2021. Whatever “best practice” became, when that phrase first started appearing in vendor whitepapers a decade ago, it never envisioned a world where the period between breach and disaster was quicker than a coffee break.

This guide is an attempt to lay out what actually holds up in that world — not a repackaged checklist of password-rotation advice, but a working map of the controls, frameworks, and habits that the data says matter right now. Every statistic, case, and deadline in this piece is sourced; you’ll find the full list at the bottom, along with links to primary reports so you can check our work rather than take our word for it.

We’ll cover five things in depth: the threat landscape driving urgency in 2026, the identity and cloud controls that stop the most common attacks, the new wave of AI-generated social engineering (including a scam that cost one firm $25 million over a single video call), how the major compliance frameworks fit together, and what a functioning incident response program actually looks like now that NIST has rewritten its own guidance on the subject. Along the way, we’ll point you to deeper guides on specific topics — patch management, SME-specific measures, industry-by-industry considerations — rather than cramming everything into one page.

Why “Best Practices” Keep Changing: The 2026 Threat Landscape

If two distinctly different reports (both published within a few months of each other in early 2026) are indicative of reality then.

In the 2026 Data Breach Investigations Report, Verizon has published the largest 4 dataset ever (more than 31,000 incidents and over 22,000 confirmed breaches across 145 countries). Its headline insight is that in 62 percent of breaches the human layer from phishing to stolen credentials to social engineering to plain old oversight was involved, up slightly from 60% in 2025.  For years that number has juggled around 60%,  and that should be a worry:  the technical controls are getting better, but the human layer just isn‘t keeping pace.

What did shift is how attackers get in. For the first time, exploitation of software vulnerabilities overtook stolen credentials as the leading initial access vector — 31% of breaches started with an unpatched flaw, versus 13% that started with stolen credentials. That’s a meaningful reversal from a few years of “credentials are the new perimeter” conventional wisdom, and it lines up with another finding in the same report: only 26% of critical vulnerabilities were fully remediated by organizations in 2025, down from 38% the prior year, while the median time to fully resolve an incident stretched from 32 days to 43. Teams aren’t necessarily doing less patching — they’re drowning in more vulnerabilities than they were a year ago, and the backlog is winning. This is exactly the gap our patch management guide digs into in more detail, including where prioritization tends to break down.

Ransomware, meanwhile, is showing up quite differently from the apocalyptic stories. The median ransom payment is down to $139,875, with 69% of victims paying nothing at all. The cause isn‘t that ransomware is less profitable — it‘s that an increasing number of victims had working backups and incident response plans that weren‘t predicated on the ransom payment. Verizon found that 73% of ransomware victims had experienced info stealer infection or credential leak in the year prior to the incident, and half of these precursor events occurred an average of 95 days prior to the ransomware.  Here‘s the takeaway: ransomware is more and more not the first thing to go wrong in a cascade of malware. It’s the last stage of a chain that started with a stolen credential sitting on a criminal marketplace weeks or months earlier.

CrowdStrike’s 2026 Global Threat Report adds the speed dimension. Beyond the headline breakout-time figures, the report found that 82% of detections in 2025 involved no malware at all — attackers logging in with valid, stolen credentials and native admin tools rather than deploying anything a signature-based tool would catch. It also documented an 89% year-over-year increase in activity from AI-enabled adversaries, including nation-state groups using large language models to automate reconnaissance and document collection, and criminal groups using AI-generated scripts to speed up credential theft and erase forensic evidence. In one intrusion CrowdStrike investigated, data exfiltration began four minutes after initial access.

None of this means the fundamentals stopped mattering — if anything, it’s the opposite. It means the fundamentals now have to work faster and with less room for the “we’ll patch it next sprint” mentality that used to be tolerable. The sections below walk through where to focus first.

Identity and Access: Where Most Breaches Still Start

Given that stolen and abused credentials remain one of the two largest breach categories, identity controls are the highest-leverage place to start — and the good news is that the technology to close this gap has matured a lot faster than most organizations’ actual deployment of it.

The Cybersecurity and Infrastructure Security Agency (CISA) has been direct about this: it calls phishing-resistant multi-factor authentication the “gold standard” and names exactly two approved implementations — FIDO2/WebAuthn (the technology behind passkeys and hardware security keys) and PKI-based authentication using PIV or CAC smart cards.⁴ Everything else — SMS codes, push notifications, one-time password apps — can be phished, SIM-swapped, or defeated through “MFA fatigue” attacks where a user is bombarded with approval requests until they tap “yes” out of irritation. Verizon’s own data shows this happening: prompt-bombing showed up in 14% of incidents in their 2025 dataset. It actually is important since FIDO2/WebAuthn credentials are cryptographically bound to the true domain name of the website, a phishing site can‘t make your hardware token sign a valid response for its own deceiving domain.

NIST formalized this in Special Publication 800-63 B-4, stating that systems at AAL2 must provide “a minimum of one phishing-resistant authentication method”; it‘s required at all AAL3 highest assurance levels in the federal government. NIST was influenced heavily by OMB Memorandum M-22-09; if you‘re a vendor or contractor for the U. S. government,  known as a government prime this is contractual obligations working down the supply chain, not simply recommendations.

Most organizations’ practical roll-out resembles this:  begin with administrators and anyone who directly interacts with financial systems or the PCI DSS 4.0.1 now mandates MFA for all access into that environment (not just remotes – we‘ll get into more below), progress onto hardware keys or platform passkeys for the vast majority of your workforce, and treat SMS-based MFA as a transition you are in the process of eliminating. If your team is still working through the basics of what a layered identity program looks like before diving into FIDO2 specifics, our guide to cybersecurity fundamentals is a good place to establish that baseline, and our business-focused tips walk through the practical sequencing for a typical company.

Identity isn’t only about authentication, though. Least-privilege access — making sure an account can only reach what its job actually requires — remains one of the more neglected basics, largely because it requires ongoing maintenance rather than a one-time project. Access review cycles, automatic de-provisioning when someone leaves or changes roles, and separating standard user accounts from administrative ones are unglamorous, and they’re also exactly the kind of control that turns a single compromised account into a contained incident instead of a company-wide one.

Locking Down Cloud and Hybrid Infrastructure

Most mid-size and large organizations today aren’t running one cloud environment — they’re running several, often stitched together with SaaS platforms that nobody centrally inventoried. That‘s why threesome acronyms has become common in cloud security discussions, and it‘s worth being specific about what each one does because they are often used interchangeably in vendor marketing.

CSPM (Cloud Security Posture Management) tools keep checking your cloud setup (storage buckets, network rules, permission for identities) for deviant deviations compared to predefined good states and will report drift (like an S3 bucket that was made public or a security group exposed on port 22). CWPP (Cloud Workload Protection Platform) tools safeguard your active workloads (machines, containers, serverless functions) from the threats of runtime malware and suspicious activity. CIEM (Cloud Infrastructure Entitlement Management) focuses specifically on the identity and permissions layer across cloud providers, which matters because cloud permission models are complicated enough that “who can actually do what” is often a different answer than “who was granted what role.” Increasingly these three categories are converging into unified platforms, but understanding them separately helps you evaluate whether a tool you’re being sold actually covers your gap or just sounds like it does. Our rundown of cybersecurity technologies for business goes deeper on how these categories fit alongside endpoint and network tools in a broader stack.

A newer piece of the cloud security conversation is confidential computing — using hardware-based Trusted Execution Environments (TEEs) to keep data encrypted even while it’s actively being processed in memory, not just at rest or in transit. Historically, data had to be decrypted to be computed on, which meant a brief but real window of exposure even in an otherwise well-secured cloud environment. Confidential computing closes that window by performing computation within a hardware-enforced secure enclave that even the cloud provider‘s own layer could not view.  It‘s especially meaningful for institutions that must work with regulated data healthcare information, financial data, or any information that is subject to strict data residency mandates where ‘the cloud provider could technically see this’ has been a thorn in the side of compliance practitioners.

The practical takeaway for most teams: before adding another point tool, get an accurate inventory of what’s actually running across your cloud accounts. It’s a less exciting first step than buying a shiny CNAPP platform, but Verizon’s own vulnerability-remediation numbers above suggest the bigger problem is usually visibility and follow-through, not a lack of available tooling.

When the Attacker Looks Like Your CFO: AI-Driven Social Engineering

In January 2024, a finance employee at Arup — the British engineering firm known for structural work on the Sydney Opera House — received an email that looked like it came from the company’s UK-based chief financial officer, requesting a confidential transaction. He was suspicious enough to ask for a video call to confirm it. That’s exactly the instinct security training teaches, and it’s exactly what failed him: on the call, the CFO was there. So were several other colleagues. Everyone looked right and sounded right. None of them were real.

Hong Kong police later confirmed that every participant on that call, besides the victim, was an AI-generated deepfake, built from publicly available video and audio of Arup’s actual executives — the kind of footage anyone can pull from a LinkedIn video, a YouTube interview, or a recorded earnings call. Believing he was on a call with real colleagues corroborating a real request, the employee authorized fifteen separate transfers totaling roughly $25.6 million to five Hong Kong bank accounts before anyone at the company realized something was wrong. Arup later confirmed the incident to CNN, noting that fake voices and images were used and that the company’s broader systems were not compromised — this wasn’t a hack, it was a conversation.

The Arup case gets cited constantly because it’s a clean illustration of something the data backs up more broadly: verification protocols built around “does this look and sound right” no longer work, because looking and sounding right is now cheap to fake in real time. Sumsub‘s Identity Fraud Report 2025–2026 examined over 4 million fraud attempts and discovered that despite a small dip in the overall rate of global identity fraud (from 2.6% to 2.2%), the most advanced attacks those involving interwoven synthetic identities, deepfakes,  manipulation of the device, and social engineering techniques were up 180%. Sumsub’s researchers describe this as a “sophistication shift”: fewer total attacks, but each one professionalized and far harder to catch with a single control. Deepfakes specifically accounted for 11% of first-party fraud attempts in the report, and country-level deepfake attempt increases ranged from 53% in Germany to 96% in France.

We’ve written a full deep dive on how these attacks actually work mechanically — the difference between GAN-based and diffusion-based deepfakes, voice cloning, and why “just look for the glitches” stopped being reliable defense advice — in our guide to deepfakes and AI social engineering. The short version for this page: the defense that actually holds up is out-of-band verification that doesn’t rely on anything the attacker could have faked. That means calling a known phone number (not one provided in the suspicious message) rather than trusting a video call alone, using a pre-agreed verification phrase for high-value transaction requests, and building a policy — not just a suggestion — that no financial transfer above a set threshold gets authorized on the basis of a single video or voice interaction, no matter how senior the person on the call appears to be.

There’s also a fast-moving regulatory response worth tracking. In EU the AI Act came into force on August 2, 2026, requiring all providers and deployers of generative AI systems in the EU to label “human-visible and machine-detectable outputs of synthetic audio, image, video and text” with an enhanced disclosure duty for deepfakes.  In the US the Federal TAKE IT DOWN Act (in May 2025) established the first US federal criminal penalties for non-consensual deepfake pictures, and mandated covered platforms to establish a formal notice-and-takedown mechanism by May 19, 2026. Neither law specifically tackles the CFO-impersonation style of scam that struck at Arup, but both suggest regulatory bodies believe synthetic media is a discrete category of risk instead of a type of general fraud, which is likely to result in more provenance and disclosure requirements imposed on corporations in the coming years rather than less.

One advanced technical response already worth a mention:  Content provenance protocols such as the Coalition for Content Provenance and Authenticity (C2PA), which cryptographically fingerprints media at capture for later authentication. Leica‘s 2023 M11-P camera was the first commercially available camera to support this at a hardware level and Google built upon that with the Pixel 10, which signs every photo snapped by its native camera application by default with dedicated security hardware. This won‘t prevent a deepfake video call, but it is an important part of the provenance infrastructure that newsrooms, lawyers and insurers will increasingly use to define what‘s true.

Choosing and Harmonizing a Security Framework

Ask five security leaders which framework their organization follows and you’ll often get five different, only partially overlapping answers. This isn‘t a necessarily a problem many organizations find that they map to more than one framework depending on their industry, customers, and regulatory footprint but it‘s useful to know what all of them are before making investments in formal certification or attestation.

ISO/IEC 27001:2022 is the globally adopted ISO standard for an Information Security Management System (ISMS); ie a formal, auditable, risk management process for managing information security, not simply a technical checklist. The 2022 update streamlined the nomenclature for its reference set of Controls (Annex A) from 114 across 14 different categories to 93 with four key themes; Organizational (37 controls), People (8), Physical (14), and Technological (34). 11 controls were genuinely redefined to reflect threats, which hardly existed in 2013 version,  including threat intelligence, cloud services security and data leakage prevention:  updated each organization certified against the 2013 version will be required to implement by 31st October 2025.

NIST Cybersecurity Framework 2.0 (published26-Feb-2024); although and its predecessors are voluntary frameworks, they have become a de facto standard of care as shown by its citation and use by regulators and courts. Its most notable expansion was the creation of a sixth function to join the five established by the first iteration:  Govern, which explicitly recognizes cybersecurity as an enterprise risk that must be discussed on the same level as financial and reputational concerns. The newly added guidance on cybersecurity supply chain risk management followed directly from the increased number of recent third-party and vendor-based breaches supported by Verizon‘s own data.

Actions make more sense in CIS Critical Security Controls v8.1: 18 controls with 153 clearly defined,  quantifiable safeguards and organized into three Implementation Groups allowing organizations to accelerate practices based on size and risk, not attempt to do everything themselves.’

This standard simply states:  PCI DSS 4.0.1 is for any organization that:  stores, processes, or transmits payment card data. The version we are talking about is significant as a ‘flag’ for its time frame: version 3.2.1 was retired on 31/3/2024; the 51 “future-dated” Requirement in version 4.0 that became executive on 31/3/2025 include requiring MFA for all access to the cardholder data environment, not just remote or admin access, as well as longer minimum password length). If your last PCI assessment treated those requirements as optional best practices rather than mandatory controls, your next assessment will fail unless that’s been corrected.

The pragmatic approach most orgs settle on: use NIST CSF 2.0 as the strategic,  high-level, executive table talking points about risk then use CIS Controls as an operational checklist your technical team will put into motion then attempt ISO 27001 certification (for customers or contracts demanding substantiated evidence of your ISMS) then regard PCI DSS as a firm minimum if you happen to be dealing with card data at some level more of a mandatory sub-region rather than an alternative set of principles to follow.  A number of these frameworks were also intentionally designed to be cross-reference-able (CIS Controls release straight mappings to NIST CSF and NIST SP 800-53, for example) so laying down one framework right often sets most of the foundations for the others. For a look at how these choices tend to shift by sector — healthcare’s HIPAA overlay versus a manufacturer’s OT-heavy environment, for example — see our guide to cybersecurity by industry.

Incident Response: Planning for the Bad Day

For the longest time, the term “incident response” referred to the four-phase NIST SP 800-61 lifecycle that a majority of security certification still teaches Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.  It is an incredibly helpful mental model, and the vast majority of incident response procedures derive from it.  However: it is also now official disused. In April 2025, NIST finally pulled the plug on Revision 2 of SP 800-61, and replaced it with Revision 3, which no longer views the lifecycle as a discrete or linear process, but merely maps the incident response functions to the stripes of the current NIST CSF 2.0 – Identify, Protect, Detect, Respond, Recover, and that last one they threw in there – Govern.

The reason 4: It lacked any tangible logic as to why the change: the previous four phases of response were that of a parallel to normal risk management, a structured playbook only used after a breach had already occurred. Revision 3 instead treats incident readiness as continuous — improvement doesn’t wait for a post-incident lessons-learned meeting, it happens throughout, and incident response planning is explicitly tied to the same governance structure (the Govern function) that’s supposed to be setting your organization’s broader risk tolerance and reporting lines. Even if your plan to help you 0Incident Response can only speak by way of SP 800-61 Revision 2, it is not strictly wrong; it is referencing a document which is a No longer modern NIST using contemporary nomenclature and is worth a tweak.

Whichever model you work through, a small number of things distinguish the organizations that are able to recover cleanly from those that are not and none of them are esoteric. A written plan that names specific people and their responsibilities, not just roles, tends to hold up better under actual pressure than a generic document. Tabletop exercises — walking a leadership team through a simulated incident before a real one happens — reliably surface gaps that look fine on paper (who actually has authority to take a production system offline at 2 a.m.? does legal know to loop in before or after external communications go out?). And given how often ransomware now follows an earlier infostealer infection or credential leak by weeks or months, monitoring for those early warning signs is arguably a more cost-effective investment than most organizations currently make it — catching the precursor event is a fundamentally easier problem than responding to the ransomware itself.

The Mistakes That Undo Otherwise Good Programs

A surprising amount of the incident data above traces back not to sophisticated novel attacks but to a small, recurring set of avoidable errors: reused or shared administrative credentials, security tools purchased but never fully configured or monitored, backups that exist but were never actually tested for restoration, and — the quietest killer of all — alert fatigue, where a real warning gets lost in a flood of low-priority noise because nobody tuned the detection rules after initial deployment. We’ve broken these down in more detail, with concrete fixes for each, in our guide to common cybersecurity mistakes. The quick take-away:  all the formats and functional blocks we‘ve explored are only useful if someone owns that boring work of learning so they are configured properly, used and looked at regularly.  If it generates an alert for a misconfigured storage bucket, but no one‘s paying attention.

Building the Human Firewall: Awareness and Culture

Given that the human element remains present in roughly six out of ten breaches, awareness training isn’t a compliance checkbox — it’s arguably the highest-leverage control most organizations underinvest in relative to its cost. But the format of that training matters more than it used to. Verizon’s 2026 data found that mobile-based phishing simulations (voice and SMS-based social engineering tests) produced engagement rates 40% higher than traditional email-based simulations, reflecting how much work now happens on phones rather than at a desk processing email in a quiet office. That’s a meaningful signal for security teams still running exclusively email-based phishing tests: your workforce is being targeted through channels your training program may not be testing at all.

Effective programs tend to share a few traits: training tied to specific, realistic scenarios relevant to the employee’s actual role (finance staff trained on invoice fraud and CFO-impersonation attempts, not just generic “don’t click links” advice), a reporting culture where flagging a suspicious message is treated as a positive action rather than something to be embarrassed about, and — increasingly necessary given the deepfake material above — explicit callback and verification procedures for any request involving money or credentials, communicated clearly enough that an employee under pressure remembers them without having to look them up. Our dedicated guide to security awareness and training covers program structure and cadence in more depth.

Matching Your Program to Your Size and Industry

Everything above scales differently depending on organization size, and pretending otherwise is one of the more common ways security programs stall out — a 200-employee company trying to implement every CIS IG3 safeguard on day one will burn out its (probably very small) IT team before making meaningful progress on anything.

CIS’s own Implementation Group structure exists precisely to address this: IG1’s 56 safeguards were deliberately designed as the achievable baseline for organizations with limited dedicated security staff, covering the handful of controls that stop the most common, opportunistic attacks — the kind that make up the overwhelming majority of incidents hitting small and mid-sized businesses, as opposed to the targeted, resourced campaigns aimed at large enterprises. Our guide to essential cybersecurity measures for SMEs translates this into a concrete starting list without assuming a dedicated security team or budget smaller organizations don’t have.

Industry context matters just as much as size. A healthcare organization is layering HIPAA’s specific safeguards on top of whatever general framework it chooses; a manufacturer is managing operational technology (OT) environments where availability often outweighs confidentiality in the risk calculus, and where a patch cycle that’s perfectly reasonable for office laptops can shut down a production line if applied carelessly; a financial services firm is dealing with PCI DSS obligations discussed above on top of sector-specific regulatory examinations. Our guide to cybersecurity by industry breaks down how these sector-specific pressures reshape the general best practices covered in this guide.

A Practical 90-Day Starting Roadmap

When putting together a security program from scratch or resetting a security program, not refitting the currently running one, order is generally more important than simultaneously doing all at the same time. A reasonable first 90 days, informed by the data above:

Weeks 1–4: Inventory before you invest. You can’t protect what you don’t know you have — get an accurate list of identity accounts (especially privileged ones), cloud assets across every provider in use, and internet-facing systems. Given that unpatched vulnerabilities are now the single largest breach entry point, this inventory should specifically flag anything running outdated or unsupported software.

Weeks 5–8: First close the highest-leverage gaps. Launch phishing-resistant MFA with administrator and financial-system access, then continue with the whole enterprise. Fix the most exposed cloud misconfigurations your inventory surfaced. Establish (or test) backup restoration — not just backup existence.

Weeks 9–12: Formalize response and verification. Write down who does what during an incident, run one tabletop exercise even if it’s informal, and put a specific, written policy in place for verifying high-value financial requests out-of-band — the single control that would have stopped the Arup scam regardless of how convincing the deepfake was.

The choice of framework (ISO 27001, NIST CSF 2.0, CIS Controls) then becomes a more purposeful strategic decision, as opposed to a reactive afterthought, and the ongoing effort then becomes maintenance, monitoring and the awareness culture described above.

FAQs

Q1: What’s the single most cost-effective cybersecurity control for a small business?

A: Given the breach data we have at our disposal, phishing-resistant MFA for admin and financial accounts is arguably the most cost effective control as it directly addresses the credential theft attack vector in a large percentage of the breaches and,  unlike many controls, can normally be implemented at no additional hardware costs if you already have passkeys capable devices in your team.

Q2: Is ISO 27001 certification worth pursuing for a mid-size company?

A: It depends heavily on your customers and contracts. If prospective clients or partners require independently verified proof of your information security management system — increasingly common in B2B sales involving sensitive data — certification pays for itself through sales enablement alone. If no one is asking for it, the CIS Controls or NIST CSF 2.0 can deliver most of the same security improvement without the audit and certification overhead.

Q3: How often should incident response plans be tested?

A: It is good to revisit them no less than annually and more often if you have experienced a significant change to your roadmaps, infrastructure, team composition or vendors. . 8A plan that has not been revisited in a year should not be assumed to be still valid.

Q4: Do phishing simulations still work if attackers are using AI-generated content?
A: Yes, but the simulations need to evolve alongside the threat — testing voice and video-based pretexting scenarios, not just email, given that mobile-based social engineering tests are now showing meaningfully higher engagement than traditional email tests.

Q5: What’s the difference between NIST CSF and NIST SP 800-61?
A: The NIST CSF 2.0 is the overall high level strategic guide that encompasses a company‘s complete security risk stance across the six functions.  The NIST SP 800-61 is more of a concrete, operational type of document with respect to incident management, and its revision (0.3) is formatted specifically to attach under the NIST CSF 2.0, not sit on top of it.

Related Guides

• Business Cybersecurity: Practical Tips for Protecting Your Company
• 5 Essential Cybersecurity Measures Every SME Must Implement
• Cybersecurity Awareness & Training: Keeping Your Organization Secure
• 7 Cybersecurity Mistakes to Avoid
• Cybersecurity Technologies for Any Business
• Cybersecurity by Industry
• Good Cybersecurity Starts With the Basics
• Patch Management Explained: Closing the Gaps Attackers Look For First
• Deepfakes and AI Social Engineering: Why “Spotting the Fake” Doesn’t Work Anymore

Sources & References

Threat Intelligence & Fraud Reports

1. CrowdStrike, 2026 Global Threat Report — crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report
2. Verizon, 2026 Data Breach Investigations Report — verizon.com/business/resources/reports/dbir
3. SpyCloud, analysis of the 2026 Verizon DBIR (infostealer-to-ransomware findings) — spycloud.com/blog/top-takeaways-from-the-2026-verizon-data-breach-investigations-report
4. Sumsub, Identity Fraud Report 2025–2026 — sumsub.com/fraud-report-2025
5. FinTech Magazine, coverage of Sumsub’s 2025–2026 report (country-level deepfake data) — fintechmagazine.com/news/sumsub-reports-180-rise-in-sophisticated-fraud-globally

Standards & Frameworks

1. ISO/IEC 27001:2022, official standard page — iso.org/standard/27001
2. Analysis of the ISO 27001:2013-to-2022 transition deadline — cybernion.com.au/insights/iso-27001-2022-new-controls
3. NIST, Cybersecurity Framework 2.0 — nist.gov/cyberframework
4. Center for Internet Security, CIS Controls Implementation Groups — cisecurity.org/controls/implementation-groups
5. PCI Security Standards Council, guidance on PCI DSS 4.0.1 requirements effective after March 31, 2025 — blog.pcisecuritystandards.org/coffee-with-the-council-podcast-guidance-for-pci-dss-e-commerce-requirements-effective-after-31-march-2025
6. NIST, SP 800-61 Revision 3 project page — csrc.nist.gov/projects/incident-response
7. Identity & Authentication Guidance – CISA / IDManagement.gov, Phishing-Resistant Authenticator Playbook — idmanagement.gov/playbooks/altauthn
8. Case Reporting – CNN Business, “Arup revealed as victim of $25 million deepfake scam” — cnn.com/2024/05/16/tech/arup-deepfake-scam-loss-hong-kong-intl-hnk
9. Regulation & Law – European Commission, Code of Practice on Transparency of AI-Generated Content (EU AI Act Article 50) — digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content
10. U.S. Federal Trade Commission, TAKE IT DOWN Act enforcement guidance — ftc.gov/business-guidance/blog/2026/05/take-it-down-act-enforcement-starts-now-what-know-about-ftc-tida
11. Content Provenance – Content Authenticity Initiative, “Leica Launches World’s First Camera with Content Credentials” — contentauthenticity.org/blog/leica-launches-worlds-first-camera-with-content-credentials
12. Additional Verizon DBIR Data Points – Verizon, 2025 Data Breach Investigations Report — Small and Medium-Sized Business Snapshot (prompt-bombing/MFA fatigue figure) — verizon.com/business/resources/infographics/2025-dbir-smb-snapshot.pdf
13. Help Net Security, “Lessons for organizations from the Verizon 2026 Data Breach Investigations Report” (mobile vs. email phishing simulation engagement) — helpnetsecurity.com/2026/05/25/lessons-from-verizon-dbir-2026-findings

Cybersecurity Guides and Best Practices