Sean Martin reports from ISC2 Security Congress 2026 in Denver and tells Marco Ciappelli why practitioners are buried under overlapping privacy and security rules from California, New York, and Nevada. The question underneath it all: if every state writes its own rules and every rule brings its own audit, how do security teams stay secure and stay solvent?
⬥EPISODE NOTES⬥
Sean Martin is on the ground at ISC2 Security Congress 2026 in Denver, and Marco Ciappelli is following from a distance. The event is rooted in education and in a mission to build up the profession, so practitioners have the skills to do their jobs at work, at home, and in society. For Sean, the hallways are full of familiar faces and the conversations are practical.
The practical topic of the day is the California Consumer Privacy Act. Sean sits in on a panel with John Bates and Aaron Shierlaw and comes away with a blunt read: things are about to hit the fan. He calls it GDPR on steroids. Where compliance has typically meant the systems that hold regulated data, this law opens up every part of the business, including HR, marketing, sales, and web traffic data. A company that crosses the threshold is bound to the letter of the law even outside California, if it has California customers, prospects, or visitors.
Marco brings the European angle. After years of GDPR conversations, and the constant prompts to accept things online whenever he is in Europe, he asks why states and countries keep writing separate rules instead of agreeing on one approach. Sean points to New York's DFS and a Nevada regulation tied to the gaming environment as two more entries on the list, with more certain to follow.
Regulation is only half the equation. The other half is the audit, then another audit, each with its own gaps and its own timing, some yearly and some every other year. Marco calls it a monster that keeps building on its own: laws to follow, audits to pass, certifications to earn, and adversaries who have no interest in obeying any of it. Defenders have to find a way to protect the business and obey the rules at the same time.
The same constraint runs through the practitioner conversations Sean has at ISC2 Security Congress 2026: keep the business secure without breaking the bank. Those chats cover insider threat programs, security operations, tabletop exercises, and AI in the SOC, with a health insurer and a home improvement retailer already in the books and an airline on deck. Sean also volunteers to contribute to the AI exam, which he describes as truly focused on AI rather than a CISSP with AI slapped over it. Sean and Marco meet up again in London for Black Hat Europe in December.
When every new law arrives with its own audit cycle, the real work for security teams is making sure compliance does not consume the budget that protects the business.
⬥HOSTS⬥
Sean Martin, CISSP -- Co-Founder, ITSPmagazine & Studio C60 | Host, Redefining CyberSecurity Podcast & Music Evolves Podcast | https://www.seanmartin.com/
Marco Ciappelli -- Co-Founder, ITSPmagazine & Studio C60 | Host, An Analog Brain In A Digital Age Podcast | https://www.marcociappelli.com/
⬥RESOURCES⬥
ISC2 Security Congress 2026 is taking place October 26-28, 2026 | Denver, Colorado -- Follow our coverage: https://www.itspmagazine.com/blog?p=isc2-security-congress-2026-on-location
The Future of Cybersecurity Newsletter | https://www.linkedin.com/newsletters/7108625890296614912/
An Analog Brain In A Digital Age Newsletter | https://www.linkedin.com/newsletters/7079849705156870144/
Redefining CyberSecurity Podcast | https://www.seanmartin.com/redefining-cybersecurity-podcast
An Analog Brain In A Digital Age Podcast | https://redefiningsocietyandtechnologypodcast.com
On Location | https://www.itspmagazine.com/on-location
California Consumer Privacy Act (CCPA) | https://oag.ca.gov/privacy/ccpa
New York Department of Financial Services (NYDFS) | https://www.dfs.ny.gov/
Nevada Gaming Commission Cybersecurity Regulation | https://nvbar.org/wp-content/uploads/Nevada-Gaming-Law_New-Nevada-Gaming-Commission-Cybersecurity-Regulation.pdf
John Bates on LinkedIn | https://www.linkedin.com/in/john-bates-jd/
Aaron Shierlaw on LinkedIn | https://www.linkedin.com/in/aaron-shierlaw-52246ab/
⬥KEYWORDS⬥
sean martin, marco ciappelli, isc2 security congress 2026, isc2, state privacy laws, california consumer privacy act, ccpa, nydfs, nevada gaming cybersecurity regulation, regulatory compliance, security audits, ciso, security operations, ai in the soc, insider threat, tabletop exercises, cissp, ai exam, black hat europe, on location, itspmagazine
Regulation, Regulation, Regulation: What Practitioners Are Weighing at ISC2 Security Congress | An On Location Conversation at ISC2 Security Congress 2026 with Sean Martin and Marco Ciappelli
[00:00:10] Sean Martin: Marco, I'm in the Smoky Mountains. Why are you not here? [crosstalk: "you and why am I not there?"] Smoky Mountains of Denver.
[00:00:15] Marco Ciappelli: Mountain?
[00:00:16] Sean Martin: No such thing. I'm trying to play that you are here.
[00:00:19] Marco Ciappelli: What? What's [unclear]
[00:00:20] Sean Martin: Where we say we're somewhere that we're not.
[00:00:22] Marco Ciappelli: I know. I get a notification that I've been mentioned on LinkedIn every [unclear]
[00:00:26] Sean Martin: ... saying that you're not here? You're missing out, man. ISC2 conference, it's a good event.
[00:00:31] Marco Ciappelli: I know, I know. I didn't even expect that, but I guess, you know, people, and you have been, you've been [unclear] the event, [crosstalk: "know people"]
[00:00:41] Sean Martin: Yep, it's good. Good, good conversations here. I mean, it's an organization rooted in education and a mission to build up the profession and make sure we all have the skills we need to do our jobs at work, at home, in society. And they give, they give quite a bit. Something like that? Yeah. I think a little more, maybe.
[00:01:06] Marco Ciappelli: [unclear] people there that want to keep the [unclear]
[00:01:09] Sean Martin: There's a lot of brainwaves going on. [unclear] know a lot of them. We've seen very, very familiar faces today. I got a lot more selfies today. Yeah, so it's good. I wish you were here next year.
[00:01:26] Marco Ciappelli: Tell me more about it. What are you guys talking [unclear]
[00:01:28] Sean Martin: They did launch, a...
[00:01:29] Marco Ciappelli: Agentic AI, what?
[00:01:30] Sean Martin: I'm actually volunteering. I got my email yesterday or the day before to help contribute to the AI exam. So it's not just a CISSP with AI slapped over it. They're really focused on AI. So I haven't seen anything yet, so I'm excited to get into that. But... All right, it's AI?
[00:01:51] Marco Ciappelli: Oh, I'll tell you what it is. Is [unclear] test. That's what it [unclear]. You just need to figure out if a computer can [unclear] enough.
[00:01:54] Sean Martin: There you go. I passed it. I'm a robot.
[00:02:05] Marco Ciappelli: Don't be [unclear]
[00:02:05] Sean Martin: Yeah, so there's that, but I mean, there's a lot of practical stuff. So, you know, I'm part of a few CISO groups. One meets weekly. Sorry, guys, I haven't been there in a few weeks. But John Bates and Aaron Shierlaw were on a panel with two other... Well, Aaron's not a lawyer, but two other lawyers on the panel talking about the California, um, CCPA, which I can't... Yeah, the California Consumer Privacy Act, I think. Is that what it is? Bottom line is things are about to hit the fan. It's basically GDPR on steroids, where typically you cover certain systems that hold data, and this particular law opens it up to every part of the business. So your HR data, your marketing data, your sales data, your web traffic data, it's hitting everything. And if you hit a certain threshold, you're covered, which sounds like a positive thing, but it means you're bound to adhere to the letter of the law, even if you're not in California. If you have California customers or prospects or visitors, and it's pretty intense. Pretty intense. So that was very eye-opening. But that's the kind of conversations we're having here, which is practitioners trying to figure out how to keep the business secure and do it without breaking the bank. And I had two chats, one with a health insurance company and another one with Home Depot, and I'm chatting with someone tomorrow from Southwest Airlines, talking about their programs, the insider threats yesterday. Today was security operations, tabletops, and AI in the SOC. And yeah, it's pretty cool. Pretty cool stuff.
[00:04:01] Marco Ciappelli: You know what I'm curious about is, when you talk about different rules, and of course we did talk a lot about that when the GDPR came out. And I see that every time I go in Europe, but there's more
[00:04:13] Sean Martin: Right?
[00:04:14] Marco Ciappelli: [unclear] about you need to accept all the time, and here it is obviously much more linear than when you go online. But now I'm thinking, so California, which is a state, it's gonna have its own regulation. Wouldn't it be easier if we all agree on
[00:04:31] Sean Martin: Yeah.
[00:04:32] Marco Ciappelli: We're gonna do the same thing? Because it seems to me that a different state in the United States, or a different state in other parts of the world, they have all come up with their own rules. [unclear] practitioners and companies and data management, they're gonna go nuts, crazy.
[00:04:51] Sean Martin: Yeah. Yeah, pretty much. I [unclear]
[00:04:53] Marco Ciappelli: [unclear] conversation is now there?
[00:04:55] Sean Martin: [unclear] regulations. So New York has its own DFS, NYDFS. I learned today that Nevada has its own, connected to the gambling environment and the infrastructure around that. So there's two more states. I'm certain others will have their own. And to your point, it's regulation, regulation, regulation, regulation, and teams have to figure all that stuff out. And that's just half the equation, because then on the other side, it's the audit, the audit, the audit, the audit, the audit, each with their own caps [VERIFY: "caps"] and gaps, at different points in time, and some are yearly, some are every other year, things like that. But it's super complicated, I guess, is the bottom line.
[00:05:38] Marco Ciappelli: And it...
[00:05:39] Sean Martin: Right.
[00:05:40] Marco Ciappelli: It's a monster that keeps building on its own because, like you said, there's gonna be the audit, then there's gonna be [crosstalk: "Yeah"] get certified and don't break the law, and then there's gonna be the one that wants to break the law. Obviously, the bad guys. [unclear] you need to find a way to defend, but also be obeying the rules.
[00:06:01] Sean Martin: Yep.
[00:06:02] Sean Martin: It is complicated. It is complicated.
[00:06:05] Marco Ciappelli: It's definitely complicated. And,
[00:06:07] Sean Martin: I do have to run. I'm meeting a good friend, Yolanda Craig [VERIFY: surname, spoken as Craig; LinkedIn profile slug reads Reid]. She's been on the podcast before. She's here. I'm gonna go say hi. But,
[00:06:14] Marco Ciappelli: Yeah.
[00:06:17] Marco Ciappelli: She's there with many other people. So let's do this. You go. You talked a little bit about regulations and how the new California privacy law is coming up. But,
[00:06:28] Sean Martin: Yeah, before I jump on the plane [VERIFY: "plane"].
[00:06:30] Marco Ciappelli: Before you [unclear] a little bit
[00:06:31] Sean Martin: We tried to do it with the mountains behind me, but technology was against us. Dang, dang technology. So you get the window out to the other side of the Gaylord property [VERIFY: Gaylord Rockies?], which is the... It's basically the U-turn where people drop off and get picked up. So that's the view. There you go.
[00:06:53] Marco Ciappelli: Never [unclear] but I've [unclear]
[00:06:54] Sean Martin: It's a cool spot. It's a cool spot. Well, I wish you were here. Next year, perhaps, we'll come together
[00:06:58] Marco Ciappelli: [unclear] enjoy the [unclear]
[00:07:00] Sean Martin: And... But we'll be in London at Black Hat Europe in December, so we'll be together for that one, and lots of good stuff for that one too.
[00:07:09] Marco Ciappelli: We're...
[00:07:09] Sean Martin: All right, man.
[00:07:10] Marco Ciappelli: ...be there.
[00:07:11] Sean Martin: Yeah, see you tomorrow. All right.
[00:07:12] Marco Ciappelli: Yeah, anyway, we'll, we'll,
[00:07:13] Sean Martin: All right, see you everybody.
[00:07:14] Marco Ciappelli: Before you leave. Okay. Goodbye, everybody. Stay tuned.