[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:gdpr\u002F32":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"gdpr","32","Article 32","Security of processing",2391,"Regulation (EU) 2016\u002F679 (General Data Protection Regulation)","**What it asks for.** Controllers and processors must put in place technical and organisational measures that give a level of security appropriate to the risk, taking into account the state of the art, implementation costs and the nature, scope, context and purposes of the processing. The article names examples such as pseudonymisation, encryption, resilience, the ability to restore availability and regular testing of the measures.\n\n**In practice.** Organisations base their controls on a documented risk assessment of each processing activity rather than a generic checklist. Typical evidence includes access control and encryption standards, backup and restore tests, vulnerability management records and results of periodic security testing. Processors are expected to show the same discipline for the data they handle on a controller's behalf.\n\n**Common gaps.** Measures are often chosen once and never revisited as risks change. Testing and evaluating effectiveness, which the article explicitly mentions, is frequently missing or undocumented.",null,"https:\u002F\u002Feur-lex.europa.eu\u002Flegal-content\u002FEN\u002FTXT\u002FHTML\u002F?uri=CELEX:32016R0679#art_32","Read the official text on EUR-Lex","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},2389,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","2026-10-18T20:20:25.794+00:00",{"slug":24,"title":25,"published_at":26},"connectwise-cloud-backup-suspended-after-microsoft-365-tenant-compromise","ConnectWise Cloud Backup Suspended After Microsoft 365 Tenant Compromise","2026-10-18T10:20:20.475+00:00",{"slug":28,"title":29,"published_at":30},"critical-drupal-rce-flaws-demand-immediate-patching","Critical Drupal RCE Flaws Demand Immediate Patching","2026-10-17T16:20:34.593+00:00",{"slug":32,"title":33,"published_at":34},"connectwise-supply-chain-attack-compromises-162-microsoft-365-tenants","ConnectWise Supply-Chain Attack Compromises 162 Microsoft 365 Tenants","2026-10-17T16:20:21.545+00:00",{"slug":36,"title":37,"published_at":38},"government-encryption-backdoors-threaten-global-data-security","Government Encryption Backdoors Threaten Global Data Security","2026-10-17T14:20:19.334+00:00",{"slug":40,"title":41,"published_at":42},"ad-network-used-as-zero-click-spyware-delivery-channel-via-real-time-bidding","Ad Network Used as Zero-Click Spyware Delivery Channel via Real-Time Bidding","2026-10-17T12:20:32.316+00:00",{"slug":44,"title":45,"published_at":46},"malicious-npm-package-imgdecode-delivers-hidden-shellcode-loader","Malicious npm Package 'imgdecode' Delivers Hidden Shellcode Loader","2026-10-17T12:20:17.17+00:00",{"slug":48,"title":49,"published_at":50},"compromised-connectwise-credential-exposes-173-microsoft-365-tenants","Compromised ConnectWise Credential Exposes 173 Microsoft 365 Tenants","2026-10-17T08:20:20.122+00:00",{"slug":52,"title":53,"published_at":54},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":56,"title":57,"published_at":58},"critical-magento-rce-flaw-demands-immediate-patching","Critical Magento RCE Flaw Demands Immediate Patching","2026-10-16T22:20:34.131+00:00",{"slug":60,"title":61,"published_at":62},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":64,"title":65,"published_at":66},"aomei-backupper-update-servers-hijacked-to-distribute-backdoor","AOMEI Backupper Update Servers Hijacked to Distribute Backdoor","2026-10-16T18:21:08.893+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",667,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",488,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",479,{"slug":84,"name":85,"problem":86,"stories":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",436,{"slug":89,"name":90,"problem":91,"stories":92},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",372,{"slug":94,"name":95,"problem":96,"stories":97},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",356,[99,105,110,115,120,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","6","Control 6","Access Control Management",924,{"family":106,"item":107,"code":108,"title":108,"together":109},"itil","overview","ITIL",829,{"family":100,"item":111,"code":112,"title":113,"together":114},"7","Control 7","Continuous Vulnerability Management",725,{"family":100,"item":116,"code":117,"title":118,"together":119},"3","Control 3","Data Protection",716,{"family":121,"item":122,"code":123,"title":124,"together":125},"nist-800-53","ac-2","AC-2","Account Management",713,{"family":100,"item":127,"code":128,"title":129,"together":130},"13","Control 13","Network Monitoring and Defense",615,{"family":100,"item":132,"code":133,"title":134,"together":135},"2","Control 2","Inventory and Control of Software Assets",530,{"family":121,"item":137,"code":138,"title":139,"together":140},"si-2","SI-2","Flaw Remediation",522]