Regulation, Regulation, Regulation: What Practitioners Are Weighing at ISC2 Security Congress | An On Location Conversation at ISC2 Security Congress 2026 with Sean Martin and Marco Ciappelli
⬥EPISODE NOTES⬥ Sean Martin is on the ground at ISC2 Security Congress 2026 in Denver, and Marco Ciappelli is following from a distance. The event is rooted in education and in a mission to build up the profession, so practitioners have the skills to do their jobs at work, at home, and in society. For Sean, the hallways are full of familiar faces and the conversations are practical. The practical topic of the day is the California Consumer Privacy Act. Sean sits in on a panel with John Bates and Aaron Shierlaw and comes away with a blunt read: things are about to hit the fan. He calls it GDPR on steroids. Where compliance has typically meant the systems that hold regulated data, this law opens up every part of the business, including HR, marketing, sales, and web traffic data. A company that crosses the threshold is bound to the letter of the law even outside California, if it has California customers, prospects, or visitors. Marco brings the European angle. After years of GDPR conversations, and the constant prompts to accept things online whenever he is in Europe, he asks why states and countries keep writing separate rules instead of agreeing on one approach. Sean points to New York's DFS and a Nevada regulation tied to the gaming environment as two more entries on the list, with more certain to follow. Regulation is only half the equation. The other half is the audit, then another audit, each with its own gaps and its own timing, some yearly and some every other year. Marco calls it a monster that keeps building on its own: laws to follow, audits to pass, certifications to earn, and adversaries who have no interest in obeying any of it. Defenders have to find a way to protect the business and obey the rules at the same time. The same constraint runs through the practitioner conversations Sean has at ISC2 Security Congress 2026: keep the business secure without breaking the bank. Those chats cover insider threat programs, security operations, tabletop exercises, and AI in the SOC, with a health insurer and a home improvement retailer already in the books and an airline on deck. Sean also volunteers to contribute to the AI exam, which he describes as truly focused on AI rather than a CISSP with AI slapped over it. Sean and Marco meet up again in London for Black Hat Europe in December. When every new law arrives with its own audit cycle, the real work for security teams is making sure compliance does not consume the budget that protects the business. ⬥HOSTS⬥ Sean Martin, CISSP -- Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.sea