Compliance Is the Baseline. Risk Is the Real Question.

For years, cybersecurity compliance was largely treated as a security function. Policies were documented, controls were tested, evidence was collected and audits were completed.

The US regulatory environment is increasingly connecting cybersecurity to something much larger: how a business understands, manages and communicates risk.

Consider the numbers. The FBI's 2025 Internet Crime Report recorded 452,868 cyber-enabled fraud complaints and $17.7 billion in reported losses in the United States. Internet Crime Complaint Center At the same time, Verizon's 2026 DBIR reports that 31% of breaches in its dataset began with exploitation of vulnerabilities, making vulnerability exploitation the leading initial access vector in that report. Verizon

The question is no longer simply whether an organisation has security controls.

Can the organisation demonstrate that it understands the risk those controls are supposed to manage?

The US is changing what “cybersecurity responsibility” looks like

One of the clearest examples is the US Securities and Exchange Commission.

For public companies subject to the relevant reporting requirements, a material cybersecurity incident generally has to be disclosed on Form 8-K within four business days after the company determines that the incident is material. The SEC's rules also require disclosures about processes for assessing and managing material cybersecurity risks. SEC

That distinction is important.

The requirement is not simply about having an incident response policy. It connects a cyber incident to materiality, governance, business impact and investor disclosure.

Cybersecurity has therefore moved closer to the boardroom.

A security incident can become a financial reporting issue, a governance issue and a corporate communication issue at the same time.

Compliance is no longer sitting inside the security team

The same shift can be seen in consumer and financial data protection.

The FTC's Safeguards Rule requires covered financial institutions to maintain safeguards for customer information. Following amendments that took effect in 2024, certain notification events involving the unauthorized acquisition of unencrypted customer information affecting at least 500 consumers must be reported to the FTC, generally no later than 30 days after discovery. Federal Trade Commission

Again, the important point is not the reporting deadline itself.

It is the chain behind it.

Security controls → detection → investigation → risk assessment → legal interpretation → notification → business response.

A weakness anywhere in that chain can create a problem far beyond the security department.

The attack surface is moving faster than the audit cycle

There is another challenge.

Organisations do not operate in a static environment.

Applications change. Cloud infrastructure changes. Vendors change. Employees join and leave. New vulnerabilities appear. Internet-facing systems are added. Data moves between platforms.

Verizon's 2025 DBIR found that exploitation of vulnerabilities accounted for 20% of breaches in its dataset, up 34% from the previous year. It also reported that only about 54% of the perimeter-device vulnerabilities it examined were fully remediated, with a median remediation time of 32 days. Verizon

This creates a fundamental problem with periodic compliance.

An assessment can accurately describe an organisation at the time it was performed.

The environment can change the next day.

The US regulatory environment reflects this reality

CISA's guidance for federal civilian agencies provides an interesting example of the direction cybersecurity programmes are moving toward. Under Binding Operational Directive 23-01, agencies were required to perform automated asset discovery every seven days and initiate vulnerability enumeration every 14 days. CISA

The significance goes beyond the federal government.

It reflects a broader security principle:

You cannot manage what you cannot continuously see.

Asset visibility, vulnerability visibility and security monitoring are increasingly becoming operational capabilities rather than annual compliance activities.

The cost of not seeing the full picture

There is also a financial dimension.

The FBI's 2025 IC3 report recorded $17.7 billion in reported losses from cyber-enabled fraud, with investment fraud alone accounting for approximately $8.65 billion. Internet Crime Complaint Center

These figures are not simply security statistics.

They represent financial loss, customer impact, operational disruption and, in many cases, reputational consequences.

This is why the traditional separation between compliance risk and business risk is becoming harder to maintain.

A compliance control exists for a reason. If the underlying risk is not understood, the organisation can end up measuring the existence of controls without understanding the exposure those controls are intended to reduce.

The problem is not more compliance

It is the distance between compliance and reality.

An organisation may have an incident response plan, vulnerability management policy, vendor risk programme and access control framework.

But leadership still needs to know:

What is exposed today?

Which risks could materially affect the business?

Which controls are actually reducing those risks?

What remains unresolved?

And when an incident happens:

Can we establish what happened, determine its impact and make the right business decision quickly enough?

These are not questions that can be answered by a compliance certificate alone.

From compliance evidence to risk evidence

This is where the next stage of cybersecurity maturity becomes important.

Compliance evidence tells an organisation that a requirement has been addressed.

Risk evidence tells the organisation what that requirement is achieving.

Instead of simply reporting that a vulnerability management process exists, leadership should be able to see the vulnerabilities that remain open, their affected assets, business relevance, remediation status and whether compensating controls exist.

Instead of simply showing that vendors have been assessed, organisations need visibility into which third parties represent meaningful exposure.

Instead of showing that policies were approved, organisations need to understand whether the controls described by those policies are operating as intended.

The difference is subtle, but significant.

What US organisations should take away

The direction of US cybersecurity regulation does not suggest that frameworks, policies or audits are becoming irrelevant. They remain important mechanisms for governance and accountability.

What is changing is the expectation around what organisations do with the information those programmes produce.

Cybersecurity is increasingly expected to be understandable in terms of business impact, materiality, customer risk and operational resilience.

That requires security, compliance, legal, risk and business teams to work from a common picture rather than maintaining separate versions of organisational risk.

Where we sit

At NMT Security, we see compliance as one layer of a much larger cyber risk picture.

The objective should not be to create another dashboard filled with compliance percentages. It should be to connect external exposure, vulnerabilities, third-party risk, compliance controls and business impact into a view that security teams can act on and leadership can understand.

Because the question is no longer simply:

“Are we compliant?”

The more useful question is:

“What does our compliance programme tell us about the risk we are carrying today?”

That is where compliance starts becoming more than an audit exercise.

It becomes business risk intelligence.