Cybersecurity breaches in 2026 are making headlines, but the real story isn’t about technology, it’s about governance. Most incidents happen because processes fail, risks aren’t escalated, or oversight is missing, not because tools are broken. This article explores how human judgment, AI, and strong GRC practices can prevent failures, manage evolving risks, and turn governance into a strategic advantage.
Artificial intelligence is transforming Cyber GRC, but not in the way many people expect. Instead of replacing professionals, AI is taking over repetitive tasks and allowing people to focus on strategy, judgment, and decision making. As organizations move toward real time compliance and face faster, more complex risks, the need for AI savvy GRC professionals is growing quickly. The future is not about humans versus AI, it is about how well they work together.
Most cyber breaches aren’t caused by elite hackers—they’re caused by missed steps, misconfigurations, and unclear accountability. The 2019 Capital One breach is a case study in how weak governance, not weak tech, opens the door to disaster. Here’s how stronger oversight could have changed everything—and why it still can.
Discover why playing it cool during DEF CON is your best defense strategy! Uncover tips on staying secure while blending in with the crowd of hackers and cybersecurity experts in Las Vegas.
Manufacturing faces unique GRC cybersecurity challenges due to the convergence of IT and OT, complex global supply chains, and stringent regulatory requirements. Understanding these complexities is crucial for developing robust strategies that safeguard operations, intellectual property, and compliance.
The evolution of cyber threats in healthcare highlights the urgent need for robust cybersecurity measures to protect patient data and ensure service continuity. Embracing advanced technologies while addressing cyber risks is essential for maintaining trust and integrity in healthcare.
The high-profile breach of Target's data reinforced that cyber security does not only impact IT but also the whole of a business. The resignation of the CEO and CIO underscored the repurcussions a cyber-incident can have on the confidence in an organization's leadership, market reputation, and shareholder value.
Admin Assistant Jane was considered a “trusted employee” by the non-profit’s CEO. Jane also happened to own a bridal business and was regarded a "fairy godmother" for having donated over a million dollars. So how was Jane able to pocket $5 million dollars over an eight-year period, undetected?
Although larger companies may be equipped to weather a cyberstorm and its aftermath, 60% of small businesses close their doors within six months after an attack, making cybercrime an equal opportunity with unequal consequences. Some enterprises are beginning to consider cyberinsurance as a component of their risk transfer strategy.
Effective Date: May 25, 2018
This policy explains what information we collect when you use ControlPoints’ site, services, mobile applications, products, and content (“Services”). It also has information about how we store, use, transfer, and delete that information. Our aim is not just to comply with privacy law. It’s to earn your trust.
We obtain personal information about you if you choose to provide it — for example, to contact mailboxes or to register for certain services. In some cases, you will have previously provided your personal information to ControlPoints (if, for example, you are a former employee). If you choose to register or login to a ControlPoints web site using a third party single sign-in service that authenticates your identity and connects your social media login information (e.g., LinkedIn, Google, or Twitter) with ControlPoints, we will collect any information or content needed for the registration or log-in that you have permitted the social media provider to share with us, such as your name and email address. Other information we collect will depend on the privacy settings you have set with your social media provider, so please review the privacy statement or policy of the applicable service.
When you register or submit personal information to ControlPoints we will use this information in the manner outlined in this privacy statement. Your personal information is not used for other purposes, unless we obtain your permission, or unless otherwise required or permitted by law or professional standards. For example, if you register to a ControlPoints web site and provide information about your preferences we will use this information to personalize your user experience. Where you register or login using a third party single user sign-in we may also recognize you as the same user across any different devices you use and personalize your user experience across other ControlPoints sites you visit. If you send us a resume or curriculum vitae (CV) to apply online for a position with ControlPoints, we will use the information that you provide to match you with available ControlPoints job opportunities. In some cases where you have registered for certain services we will store your email address temporarily until we receive confirmation of the information you provided via an email (i.e. where we send an email to the email address provided as part of your registration to confirm a subscription request).
ControlPoints generally collects only the personal information necessary to fulfill your request. Where additional, optional information is sought, you will be notified of this at the point of collection. The law in the United States and Europe allows us to process personal information, so long as we have a ground under the law to do so. It also requires us to tell you what those grounds are. As a result, when we process your personal information, we will rely on one of the following processing conditions:
Examples of the ‘legitimate interests’ referred to above are:
In some cases, the personal data that we collect will also include special categories of data, such as diversity related information (including data about racial and ethnic origin, political opinions, religious beliefs and other beliefs of a similar nature, trade union membership and data about sexual life and sexual orientation), or health data and data about alleged or proven criminal offences in each case where permitted by law.
ControlPoints understands the importance of protecting children’s privacy, especially in an online environment. In particular, our sites are not intentionally designed for or directed at children under the age of 13. It is our policy never to knowingly collect or maintain information about anyone under the age of 13, except as part of an engagement to provide professional services.
ControlPoints won’t transfer information about you to third parties for the purpose of providing or facilitating third-party advertising to you. We won’t sell information about you. We may share your account information with third parties in some circumstances, including: (1) with your consent; (2) to a service provider or partner who meets our data protection standards; (3) with academic or non-profit researchers, with aggregation, anonymization, or pseudonomization; (4) when we have a good faith belief it is required by law, such as pursuant to a subpoena or other legal process; (5) when we have a good faith belief that doing so will help prevent imminent harm to someone. If we are going to share your information in response to legal process, we’ll give you notice so you can challenge it (for example by seeking court intervention), unless we’re prohibited by law or believe doing so may endanger others. We will object to requests for information about users of our services that we believe are improper.
ControlPoints uses third-party vendors and hosting partners, for hardware, software, networking, storage, and related technology we need to run ControlPoints. We maintain two types of logs: server logs and event logs. By using ControlPoints Services, you authorize ControlPoints to transfer, store, and use your information in the United States and any other country where we operate.
Some of the content that you see displayed on ControlPoints is not hosted by ControlPoints. These “embeds” are hosted by a third-party and embedded in ControlPoints. For example: YouTube or Vimeo videos, Amazon products, SoundCloud audio files, Twitter tweets, GitHub code, or Scribd documents that appear within a ControlPoints post. These files send data to the hosted site just as if you were visiting that site directly (for example, when you load a ControlPoints post page with a YouTube video embedded in it, YouTube receives data about your activity). ControlPoints does not control what data third parties collect in cases like this, or what they will do with it. So, third-party embeds on ControlPoints are not covered by this privacy policy. They are covered by the privacy policy of the third-party service. Some embeds may ask you for personal information, such as your email address, through a form. We do our best to keep bad actors off of ControlPoints. However, if you choose to submit your information to a third party this way, we don’t know what they may do with it. As explained above, their actions are not covered by this Privacy Policy. So, please be careful when you see embedded forms on ControlPoints asking for your email address or any other personal information. Make sure you understand who you are submitting your information to and what they say they plan to do with it. We suggest that you do not submit personal information to any third-party through an embedded form. If you embed a form that allows submission of personal information by users, you must provide near the embedded form a prominent link to an applicable Privacy Policy that clearly states how to you intend to use any information collected. Failure to do so may lead ControlPoints to disable the post or take other action to limit or disable your account.
We use browser cookies and similar technologies to recognize you when you return to our Services. We use them in various ways, for example to log you in, remember your preferences (such as default language), evaluate email effectiveness, allow our paywall and meter to function, and personalize content and other information. ControlPoints doesn’t track you across the Internet. We track only your interactions within the ControlPoints network (which encompasses ControlPoints.com and custom domains hosted by ControlPoints). Further information about managing cookies can be found in your browser’s help file or through sites such as www.allaboutcookies.org.
Some third-party services that we use to provide the ControlPoints Service, such as Google Analytics, may place their own cookies in your browser. This Privacy Policy covers use of cookies by ControlPoints only and not the use of cookies by third parties.
ControlPoints complies with the “Do Not Track” (“DNT”) standard recommended by the World Wide Web Consortium. For logged-out users browsing with DNT enabled, ControlPoints’s analytics will not receive data about you, but we will do some first-party tracking in order to customize content and provide data to third-party service providers that enable ControlPoints Services to work. When you use ControlPoints while logged-in to your account, we cannot comply with DNT.
If you have a ControlPoints account, you can access, modify or export your personal information, or delete your account. To protect information from accidental or malicious destruction, we may maintain residual copies for a brief time period. But, if you delete your account, your information and content will be unrecoverable after that time. ControlPoints may preserve and maintain copies of your information when required to do so by law.
We use encryption (HTTPS/TLS) to protect data transmitted to and from our site. However, no data transmission over the Internet is 100% secure, so we can’t guarantee security. You use the Service at your own risk, and you’re responsible for taking reasonable measures to secure your account.
If we are involved in a merger, acquisition, bankruptcy, reorganization or sale of assets such that your information would be transferred or become subject to a different privacy policy, we’ll notify you in advance so you can opt out of any such new policy by deleting your account before transfer.
Sometimes we’ll send you emails about your account, service changes or new policies. You can’t opt out of this type of “transactional” email (unless you delete your account). But, you can opt out of non-administrative emails such as digests, newsletters, and activity notifications. When you interact with an email sent from ControlPoints (such as opening an email or clicking on a particular link in an email), we may receive information about that interaction. We won’t email you to ask for your password or other account information. If you receive such an email, please send it to us so we can investigate.
When you choose to opt in to materials on www.controlpoints.com or provide your email address for any reason, you are subject to receive promotional emails, educational emails, and content emails that include video material, blog material, and special offers or notices of upcoming live events and workshops hosted by ControlPoints. The email address that you provide is stored in our database for www.controlpoints.com so that we may track user behavior and tag your behavior in order to provide a better user experience based on items you have shown an interest in or have opted in for on the website. We may maintain separate email lists for different purposes. In order to end your email subscription to a particular list, you must follow the instructions on how to unsubscribe contained in every email correspondence that you receive from ControlPoints. Unsubscribing from one list will not automatically unsubscribe you from all email lists. We only send email marketing to individuals that have agreed, whether by opting in for materials on this website or through third party websites, to receive email marketing from ControlPoints or its affiliates and partners. Though we make every effort to preserve user privacy, we may be required to disclose personal information in some instances, such as: 1) when required by law wherein we have a good faith belief that such action is necessary to comply with a judicial proceeding, court order, and/or subpoena; 2) in the event that ControlPoints is sold or acquired; or 3) in the event that we believe that the Website is being, or has been, used in violation of our terms and conditions or to commit unlawful acts. Moreover, you hereby consent to the disclosure of any record or communication to any third party when ControlPoints, in its sole discretion, determines the disclosure to be appropriate including, without limitation, sharing your email address with other third parties for suppression purposes in compliance with the provisions of the CAN-SPAM Act of 2003, as amended from time-to-time. To prevent unauthorized access, maintain data accuracy and to ensure the appropriate use of information, we have put in place physical, electronic and managerial procedures to protect the information we collect online. We shall continue to take reasonable steps to provide effective data protection at all times, however, no security technology can provide invulnerability to information compromise. Therefore ControlPoints cannot, and does not, guarantee the security of any information that you transmit to us or to any third party affiliated with the Site. It is important for you to protect against unauthorized access to your password and to your computer. Be sure to sign off when finished using a shared computer.
ControlPoints collects and stores personal information about its users to customize their reading experience and enable personalized distribution of content. It shares minimal data with its service providers.
In order to provide the services, ControlPoints collects and stores personal data about its users on the legal basis of consent given when you create an account and agree to the Privacy Policy. ControlPoints also pursues its legitimate interests by collecting minimal data of logged out users to provide the services, as outlined above.
Where ControlPoints collects and stores personal data about non-users, it does so under performance of contract obligations with users who use the services to publish content on web sites hosted by ControlPoints. In such cases, users authoring such content containing personal data of third parties are responsible for that content. ControlPoints will consider related complaints in compliance with the General Data Protection Regulation’s rights of the data subject, as well as rights of expression and access to information.
Logged-in users may choose to interact publicly with the ControlPoints Services in the form of liking a post, highlighting parts of a post, following other user accounts, sharing links on connected social media accounts, or writing original posts. Where such personal data may reveal special category protected data, it is processed on the basis that it is manifestly made public by the user. Additional information on potential consequences of such processing can be found below. If you do not agree to this public usage, do not create an account or use these features of ControlPoints Services.
Logged out users
Logged in users:
Members:
Partner authors:
ControlPoints shares minimal personal data with third-party processors in order to provide the Services. These processors offer at least the same level of data protection as that set out in this statement. This includes the following categories of recipients:
Search engines will index user profiles, public interactions, and any user-generated content. Users may also share links to your content on social media.
ControlPoints provides Services in conjunction with several payment processors, including: Stripe, Paypal, Google Play, and Apple Pay, through which users may pay for ControlPoints memberships or receive payment based on participation in our Partner program. Those companies acting as payment processors may collect and store personal data related to your billing information and history in order to provide their services, and may collect and store personal data and business data to prevent fraud and other abuse. When you delete your ControlPoints account, ControlPoints deletes your personal data as outlined in this document. However, to delete your payment or billing information, you will need to do so with your payment provider, as ControlPoints only has minimal secure access to those records as needed to provide the services.
ControlPoints posts may contain third-party embeds, which may in some cases collect and store personal data. The use of personal data by embedded content providers is not covered by this statement, but by the privacy policies of those sites or services.
ControlPoints collects and stores personal data about its users to customize reading. This includes automated decision-making to promote content tailored to the preferences and interests indicated by the user, and to their browsing history and network interactions. ControlPoints also filters content for the purposes of fighting and preventing spam, fraud, and other forms of abuse.
By creating an account on ControlPoints, users may make certain personal data about themselves public and accessible to others on their profile and through network interactions. This may in some cases constitute special category protected data which is considered manifestly made public by the user. Due to the public nature of information posted to ControlPoints, it may be possible for third parties to derive identifying personal data from posts, whether by reading, inference, supplemental research, or automated extraction and analysis. Users are free to use their real name and information, or a pseudonym of their choosing, for their account. Users may also choose to use the service without posting data or engaging in network interactions. However, if you do not agree with and accept the risks of such usage, you may not use the services.
ControlPoints is hosted in the United States. By using ControlPoints Services, you authorize ControlPoints to transfer, store, and use your information in the United States and any other country where we operate. Where your data is disclosed to our processors, it is subject by contract to at least the same level of data protection as that set out in this statement.
ControlPoints retains personal data associated with your account for the lifetime of your account. If you would like to delete your personal information, you can delete your account at any time. Deleted account profile pages will yield an error 404 “file not found” page, immediately upon initiating deletion, and will become unrecoverable in our system after a period of fourteen days. It may take several additional days for your personal data to be de-indexed from search engines, depending on those search engines’ practices, over which ControlPoints may have limited or no control. To delete your payment or billing information, you will need to do so with your payment provider, as ControlPoints only has minimal secure access to those records as needed to provide the services.
If ControlPoints processes personal information about you, you have the following rights:
ControlPoints has reasonable security policies and procedures in place to protect personal information from unauthorized loss, misuse, alteration, or destruction. Despite ControlPoints’ best efforts, however, security cannot be absolutely guaranteed against all threats. To the best of our ability, access to your personal information is limited to those who have a need to know. Those individuals who have access to the data are required to maintain the confidentiality of such information.
ControlPoints may modify this Privacy Statement from time to time to reflect our current privacy practices. When we make changes to this statement, we will revise the “updated” date at the top of this page. Any changes to the processing of personal information as described in this Privacy Statement affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.
ControlPoints is committed to protecting the online privacy of your personal information. If you have questions or comments about our administration of your personal information, please contact us at info@controlpoints.com.
ControlPoints
www.controlpoints.com
Houston, Texas
United States of America
ControlPoints is a US entity that provides Services and Products. The information contained and accessed on this site (the “Site”) is provided by ControlPoints for general guidance and is intended to offer the user general information of interest. The information provided is not intended to replace or serve as substitute for any governance, risk, compliance, audit, cyber, advisory, or other professional advice, consultation or service. You should consult with a ControlPoints professional to obtain such services.
The application of laws and regulations may vary depending on specific facts or circumstances. Due to the nature of electronic communication processes, ControlPoints does not guarantee or warrant the Site will be uninterrupted, without delay, error-free, omission-free, or free of viruses. Therefore, the information is provided ‘as is’ without warranties of any kind, express or implied, including accuracy, timeliness and completeness. In no event shall ControlPoints, or any of its respective partners, principals, agents or employees, be liable for any direct, indirect, incidental, special, exemplary, punitive, consequential or other damages (including but not limited to, liability for loss of use, data or profits), without regard to the form of any action, including but not limited to, contract, negligence or other tortious actions, arising out of or in connection with the Site, any content on or accessed by use of the Site, or any copying, display or other use.
As content on the Site (including any concepts, ideas, methods, procedures, processes, know-how, techniques, programs, publications, models, products templates, technologies, software, designs, art work, graphics and information on or described in the Site) may be copyrighted, proprietary and subject to intellectual property or other rights (which rights are owned by ControlPoints), any unauthorized use of any materials on the Site may violate copyright, trademark and other laws or applicable intellectual property or other rights. Users are encouraged to print or distribute content (e.g., via link on a social network) provided that:
Materials on the Site may not be modified, reproduced, publicly displayed, performed, distributed or used for any public or commercial purposes without explicit written permission from the appropriate content or material provider (including third-party links). ControlPoints bears no risk, responsibility or liability in the event that a user does not obtain such explicit written permission as advised by ControlPoints.
The ControlPoints name and logo are registered trademarks or trademarks of ControlPoints and other product and service names mentioned on the Site may be the registered trademarks or trademarks of ControlPoints. Use of these marks requires express prior permission from, and a license agreement with, ControlPoints. Unauthorized use of these and any other of ControlPoints’ portfolio of trademarks will be prohibited to the fullest extent of the law. To request this written approval, contact the webmaster or use the “Contact us” feature.
Third-party links are provided as a convenience to our users. ControlPoints does not control and is not responsible for any of these sites or their content. ControlPoints vigorously protects its reputation and trademarks and ControlPoints reserves the right to request removal of any link to our web site.
The following web link activities are explicitly prohibited by ControlPoints and may present trademark and copyright infringement issues: