Latest industry updates, including news and PCI-related knowledge.
How PCI DSS v4.0.1 Requirements 6.4.3 and 11.6.1 apply to e-commerce payment page scripts, the e-skimming risk they address, and where merchant and payment service provider responsibilities divide.
Read article →
An analysis of what PCI DSS v4.0.1 requires of TLS protocol versions, comparing the security differences from TLS 1.0 to 1.3, citing the PCI SSC official FAQ and the latest NIST SP 800-52 Rev. 2 comment period, with upgrade recommendations from our QSA consultants.
Read article →
A close read of the file integrity monitoring (FIM) requirements in PCI DSS v4.0.1 Requirement 11.5.2, comparing where the open-source HIDS tools OSSEC and WAZUH fit and where they stop, with practical assessment guidance from our QSA consultants.
Read article →
Taiwan's FSC has issued its PQC migration guidelines, and the PCI SSC is now tracking cryptographic inventory too. Understand the HNDL and TNFL quantum threats, how to build a CBOM, and the four preparatory steps for getting ahead of PQC migration.
Read article →
What's the difference between a vulnerability scan and a penetration test? A clear breakdown of PCI DSS Requirements 11.3 and 11.4 — testing frequency, internal vs. external scope, and how to spot a real penetration test report.
Read article →
The prEN 40000 harmonised standards matched to the CRA are still in draft, but manufacturers need not wait. From a laboratory's point of view, this article analyses how far EN 303 645, EN 18031 and IEC 62443-4-2 each carry you, what is still missing, and the two gaps every manufacturer shares.
Read article →
Once the classification is settled, how do you choose a CRA conformity assessment route? Using a router, a firewall and a smart doorbell, this article unpacks the differences between Modules A, B+C and H, the documentation each requires, and where the notified body queue stands in 2026.
Read article →
How is CRA product classification determined? Using a router, a firewall and a smart doorbell, this article unpacks the difference between default products and important products Class I / Class II, how to make the call, and where the rules stand in 2026 — so manufacturers can pin down their own obligations.
Read article →
The SBOM associated with EN 18031 certification is not quite the SBOM the CRA requires. Starting from the CRA text, this article explains the SBOM's legal position, the itemised requirements in the draft prEN 40000 harmonised standards, and how it connects to penalties and reporting obligations.
Read article →
More and more customers are demanding an SBOM in contracts and security questionnaires. This article uses everyday analogies to explain what an SBOM is, why almost every customer is asking for one now, and what a genuinely usable SBOM has to contain.
Read article →
Annex I is the only part of the CRA that directly specifies what the product must do — the compliance backbone that technical documentation, CE marking and the penalty regime all point to. A testing-laboratory breakdown of Part I's 13 product requirements and Part II's 8 vulnerability-handling obligations.
Read article →
The 24-hour and 72-hour reporting deadlines in Article 14 of the EU Cyber Resilience Act (CRA) test whether a company has a process that can actually carry them. This article breaks down the skeleton of an internal vulnerability management SOP, the split between reporting to the authorities and notifying customers, and several blind spots we see repeatedly among manufacturers.
Read article →
EU Cyber Resilience Act (CRA) Article 14 applies from 11 September 2026, well ahead of the 11 December 2027 general application date. This article breaks down the reporting duties for actively exploited vulnerabilities and severe incidents, the 24-hour / 72-hour / 14-day / one-month statutory deadlines, the top penalty tier, and the misreadings we see most often among manufacturers.
Read article →
Not every product sold into the EU falls under the Cyber Resilience Act (CRA). A four-step scope determination, with case studies on semiconductors, wireless communication modules, SaaS, and automotive T-Boxes — plus why “covered by the RED” doesn’t mean “excluded from the CRA.”
Read article →
The EU Cyber Resilience Act is counting down, with fines up to 2.5% of global revenue. What EN 18031's three parts actually test, and why waiting until 2027 is too late.
Read article →
As the US FDA, EU MDR, the CRA and Taiwan's TFDA keep raising cybersecurity requirements, SV Surveillance and Applus+ Laboratories build a Taiwan security lab to help medical device makers clear security verification.
Read article →
Under Mastercard GLB 12772, a 5% refund/chargeback rate triggers a mandatory 72-hour investigation. See how Payment Facilitators should react.
Read article →
Master PCI DSS v4.0.1 rules for 6 and 8-digit BINs. Learn exact PAN truncation (storage) and masking (display) limits to secure your payment data.
Read article →
At Medical Taiwan 2026, Taiwanese device makers asked most about the MDR transition, FDA Section 524B, and the SVS-Applus+ route to FDA and MDR compliance.
Read article →
Secure Vectors Surveillance signs an alliance with Applus+ Laboratories, becoming a recognized security lab offering full EN 18031 testing and a one-stop CRA compliance path in Taiwan. (iThome coverage)
Read article →
On June 29, Secure Vectors Surveillance and Applus+ Laboratories formally signed their alliance: Taiwanese medical device makers can now complete the full path from QMS and security testing to EU Notified Body review locally.
Read article →
prEN 40000-11:2026 gives Hardware Devices with a Security Box a harmonised route to EU CRA conformity: scope, the 18 requirement families, and evidence reuse.
Read article →
What ISO 27701 (PIMS) covers, how it differs from ISO 27001, its link to GDPR compliance, and who needs certification.
Read article →
What internal auditors do in ISO management systems — why they're mandatory, how priorities shift across ISO standards, and the step-by-step audit process.
Read article →
Why medical device makers need ISO 27001 — patient data sensitivity, IoMT attack surfaces, supply chain risk, and the 5-step certification process.
Read article →
Most ASV scan failures aren't real vulnerabilities — the CVSS 4.0 threshold, QSA-ready reporting, and the backporting trap explained.
Read article →
What ISO 13485 is, why medical device companies need it, the 5-step certification process, and common misconceptions about the standard.
Read article →
From September 2026 the EU Cyber Resilience Act makes Article 14 incident reporting mandatory. The two triggers, the reporting deadlines, and who to notify.
Read article →
FDA guidance pushes medical device cybersecurity governance into the QMS — what QMSR harmonization and Section 524B mean for manufacturers.
Read article →
Applus+ Laboratories' Shanghai lab passed an EMVCo on-site audit, adding Contactless (C-8) testing - an accredited certification route for APAC terminal makers.
Read article →
Secure Vectors is now a PCI SSC Approved Scanning Vendor, adding ASV to its QSA, 3DS and PIN Security accreditations. What ASV status demands, and why.
Read article →
Microsoft's July 2025 Patch Tuesday fixes 130 vulnerabilities including CVE-2025-49719 in SQL Server — what it means for PCI DSS environments.
Read article →
From August 1, 2025 all radio equipment sold in the EU must meet the RED cybersecurity requirements. Who is affected, EN 18031, and what to do if you miss it.
Read article →
Anyone storing, processing or transmitting cardholder data must meet PCI DSS. Here are the merchant and service provider levels and what each level submits.
Read article →
There are 10 PCI DSS SAQ types. This guide compares SAQ A, A-EP and D for merchants and service providers, and walks through the five steps of self-assessment.
Read article →
Service Providers must conduct quarterly inspections under PCI DSS v4.0 provision 12.4.2 — the 5 inspection items and how to comply.
Read article →
Google Cloud Build may have a Bad.Build vulnerability allowing privilege escalation — what PCI DSS entities using GCP should check.
Read article →
A critical SSL-VPN flaw (CVE-2023-27997, CVSS 9.8) lets attackers run remote code on FortiOS, FortiOS-6K7K and FortiProxy. Check your version and patch.
Read article →
CVE-2021-36934 lets an ordinary Windows 10 or 11 user read system files and gain administrator rights. What it means for cardholder data, and how to fix it.
Read article →
An out-of-bounds write flaw in the Linux kernel's seq_file — what it means for PCI DSS compliance and how to remediate.
Read article →
An introduction to the PCI DSS compliance standards process, an explanation of PCI DSS levels of compliance and their required costs.
Read article →
3DS 2.0 changes who must validate. This guide sets out which 3DSS, ACS, cloud and HSM providers need a PCI 3DS assessment, and the seven steps to certification.
Read article →Related
