David Hung

On August 18, a new facility of the ASEAN-Japan Cybersecurity Capacity Building Centre (AJCCBC) was opened in Bangkok, Thailand. The Japanese Ministry of Internal Affairs and Communications is providing new contents for AJCCBC Cybersecurity Technical Training. https://lnkd.in/gRpGpZue

23

Cyber risk is no longer just a concern for the CISO or CIO— it’s a true core business issue with direct balance sheet implications.   Tunde Lawson and Jaime Kipnes lay out the numbers:   - The average cost of a data breach in the U.S. exceeded $9 million per incident in 2023 - Cybercrime caused $12.5 billion in financial damage in the U.S. in 2023 - The estimated global cost of cybercrime in 2024? $15 trillion   To protect enterprise value, cyber risk management belongs on the priorities list. Find out how leaders can take a more active role in building financial resilience here:   https://lnkd.in/gzzrAreA

30

𝐂𝐡𝐢𝐧𝐚 𝐏𝐈𝐏𝐋 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐀𝐮𝐝𝐢𝐭 – 𝐚𝐧 𝐞𝐦𝐞𝐫𝐠𝐢𝐧𝐠 𝐚𝐧𝐝 𝐫𝐞𝐰𝐚𝐫𝐝𝐢𝐧𝐠 𝐢𝐧𝐝𝐮𝐬𝐭𝐫𝐲 (𝐏𝐚𝐫𝐭 𝟏 𝐨𝐟 𝟐) Are you aware that China’s (a)  Measures for the administration of PIPL Audit has taken effect from 1 May 2025 ( “Measures”) (b)  Facial recognition technology security management regulations will take effect from 1 June 2025 I will cover PIPL audit requirements here and facial recognition in a follow up post. **** The requirements for PIPL compliance audit can be found in Articles 54 and 64 of China’s Personal Information Protection Law (“PIPL”). PIPL was enacted on 20 Aug 2021 and took effect from 1 Nov 2021. Article 54 requires personal information processors (PIP) to conduct audit on a regular basis. Article 64 states that the authority can require a PIP to conduct PIPL audit by a professional organisation (3rd party audit). I believe it is the first data protection law that has a broad mandate on compliance audit. This is going to create a new industry - the PIPL compliance audit industry. Let me rewind a bit. CAC issued a consultation paper on PIPL audit on 3 Aug 2023. Clause 4 of the paper stated that PIP which processes more than one million personal records should conduct a PIPL audit no less frequent than annually. Those which process less than a million records should conduct at least one audit every two years. I thought (a) this is going to be a burden to the SMEs and (b) the PIPL audit market will be big. Fast forward to 2025. On 14 Feb 2025, CAC published the Measures on PIPL Audit which will take effect from 1 May 2025. Clause 4 of the Measures states that PIP which handles more than 10 millions personal information should conduct an audit at least once every two years. No mention whether this is internal or external audit. I am glad to see that the threshold for a PIPL audit was raised from one to ten millions records and frequency dropped to once every two years from once a year. This will reduce the burden to many PIP. How about those PIP which process less than 10 millions records？ While it wasn’t mentioned in the Measures, in its “Q&A with journalists”, CAC mentioned that “others (which I interpret as “PIP which handle less than 10M records”) “can reasonably determine the frequency of regular PIPL compliance audits based on their own circumstances”. Which means … what huh? Next. Who are the professional PIPL audit firms? How to qualify as one? I am pleased to find that CAC has also changed its approach on qualifying professional PIPL auditors in the Measures compared with the earlier approach in the consultation paper. What? How? Stay tune for Part 2 of this post. ***** Our IAPP #CIPP/CN class is coming up soon. We go deeper into the latest development in data protection in China, covering the laws, guidelines, technical standards, enforcement cases, etc. Interested? Feel free to message me or check out our website: https://www.youngtech.sg/ #IAPP #PDPA #GDPR #PIPL

22

On November 21, 2025, Cybersecurity Administration of China (CAC), together with the Ministry of Industry and Information Technology (MIIT), drafted a new China Cybersecurity Labeling Management Measures (hereafter referred to as the Measure), which aims to enhance the cybersecurity resilience of internet-connected products and safeguarding consumer rights. The Measure was released for public comments until December 6, 2025. According to the Measure, China Cybersecurity Label (CCL) means an information label that reflects the cybersecurity capability level of the product itself, applying to products with internet connectivity functions and subject to a catalog-based management system for specific products. Under the voluntary scheme, manufacturers of eligible products may apply for a CCL to indicate the device’s level of cybersecurity capability. The label will feature a star-based rating system: One star (Basic Level): Meets fundamental national standards, requiring the prohibition of weak/default passwords, vulnerability management, and regular software updates. Two stars (Enhanced Level): Reflects domestically advanced cybersecurity performance. Three stars (Leading Level): Represents internationally advanced capability, including resistance to high-level cyber-attacks through penetration testing. https://lnkd.in/g2JePT67

22

16件のコメント

Kroll Threat Intelligence has discovered multiple actively exploited zero-day flaws affecting Ivanti, SAP and FortiNet products. These vulnerabilities are tracked as: CVE-2025-32756 with a CVSS of 9.8 CVE-2025-42999 with a CVSS of 9.1 CVE-2025-4428 with a CVSS of 7.2 CVE-2025-4427 with a CVSS of 5.3 Contact Kroll's threat intelligence team for more information on how these threats might be affecting your business: http://ms.spr.ly/6042ScupM #stayaheadwithKroll

8

I’m pleased to announce that CyCraft Japan has formed a strategic partnership with Future Secure Wave — two organisations committed to advancing cybersecurity excellence in Japan. By combining Future Secure Wave’s 40+ years of expertise in IT & security with CyCraft’s AI-powered platform and capabilities, we will bring a new level of Active Directory (AD) security and attack surface management (ASM) to the Japanese market. as outlined in the press release. I look forward to supporting our teams and driving real value together. https://lnkd.in/g4zqA5se

28