Fortinet Cybersecurity Podcast · Fortinet Cybersecurity Podcast

Brass Tacks S1E10 - Understanding Cybersecurity Regulations: Why You Shouldn't Fear Regulators

December 10, 2024·20 min·5 clips

Brass Tacks opens by making it clear that the show is about the business impact of cyber risk, not technology for its own sake. Joe Robertson introduces George Fernandez as both CISO and data protection officer at CMVM. The conversation starts with where security leadership should sit inside an organization. Fernandez says the strongest setup is one where the CISO has direct access to senior leadership. Putting that role inside IT can create a clash between keeping systems running and dealing with security problems. He does say some operational security work still belongs with IT. Even so, he keeps a firm line between that work and security leadership. The latter needs its own path to the board or executive team. From there, the discussion turns to regulation. Fernandez pushes back on the idea that regulators are just outsiders making life harder. He treats regulation as a way to stop small problems from turning into bigger ones. The language is more about containment than punishment. That makes the topic feel practical instead of abstract. The episode also brings in examples of national cybersecurity regulation and DORA. Those frameworks are framed as shared protections, not bureaucratic theater. Fernandez says the same logic applies whether the setting is a country, a financial market, or a company. The goal is to lower the chance that one incident spreads through an entire system. The conversation also lands on vendor responsibility. When a company buys software, it is also taking on the vulnerabilities that come with it. Fernandez argues that vendors should be responsible for providing fixes. He presents that as a practical win for buyers, not just a legal burden for sellers. The tone stays measured throughout. Joe asks direct questions, and Fernandez answers with a focus on consequence, structure, and accountability. The result is a clear discussion of why cybersecurity governance matters before anything breaks.

As heard by us

Brass Tacks frames cybersecurity regulation as a business issue, not just a compliance one.

Brass Tacks treats cybersecurity as a business problem first. George Fernandez is strongest when he pushes for direct access to top leadership, frames regulation as a way to keep incidents from spreading, and argues that vendor responsibility for fixes can lower buyer risk.

Read the full review in PlayNext →

Why you'd press play

You want to hear regulation explained without the usual compliance fog.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Fortinet Cybersecurity Podcast