John Z Black

John Z Black Mar 19, 2026 Policy, Law & Governance #geopolitics #sanctions #dprk #ofac #risk-governance #soc #enterprise-controls

Geopolitical cyber risk used to live in intel briefings and quarterly decks. Now it lands in hiring workflows and SOC escalation rules.

Treasury sanctioned facilitators of DPRK IT worker fraud targeting U.S. businesses, pointing to hundreds of millions in annual revenue tied to that ecosystem. Greek firms are increasing cyber scanning over conflict-related spillover concerns. CISA says they haven’t seen a major Iran-linked spike in U.S. networks. Pressure is real, but calibration still matters.

The problem is this isn’t something security can solve alone. When sanctions and geopolitical signals move fast, the calls cross HR, procurement, legal, and executive risk leadership. If those groups operate on separate tracks, you get noisy overreaction or slow underreaction. Neither is good.

A mature posture doesn’t react to every headline and doesn’t wait for perfect attribution either. It uses predefined triggers: new sanctions actions in relevant jurisdictions, credible government advisories tied to active campaigns, sector-specific warning signals from trusted sources. When triggers fire, controls shift automatically for a defined period.

In practice, that means event-driven re-screening for contractors and vendors, stricter access defaults for high-risk onboarding paths, and legal-to-SOC handoffs when sanctions context changes. Organizations that set this up in advance make fewer emotional decisions when news cycles get volatile.

Full post covers the cross-functional workflow design that makes this practical.