Where the rules stand right now.
Plain-English status on the regulations our clients ask about most, with key dates, what to do next, and links to the official sources.
EU Cyber Resilience Act — Regulation (EU) 2024/2847
The CRA sets mandatory cybersecurity requirements for “products with digital elements” (hardware and software) sold in the EU, across their whole lifecycle. It applies to manufacturers, importers, and distributors, including U.S. companies selling into the EU. Fines reach up to €15 million or 2.5% of worldwide annual turnover.
- DEC 10, 2024Entered into force
- JUN 11, 2026Rules for conformity assessment (notified) bodies apply
- SEP 11, 2026Manufacturers must report actively exploited vulnerabilities and severe incidents: 24-hour early warning, 72-hour notification, then a final report (14 days after a fix for vulnerabilities; one month for incidents) via ENISA's Single Reporting Platform
- DEC 11, 2027Full application: essential requirements, conformity assessment, technical documentation, and CE marking
What to do now
- Inventory every product with digital elements you place on the EU market
- Stand up a 24/72-hour vulnerability and incident reporting runbook
- Publish a coordinated vulnerability disclosure policy and generate SBOMs
- Map secure-by-design and update obligations into your product lifecycle
- Plan conformity assessment and CE marking for the December 2027 deadline
CMMC 2.0: where things stand
On July 13, 2026, the Department of War paused Phase 2, which would have made third-party (C3PAO) Level 2 certification the default for many contracts starting November 10, 2026. It also launched a 60-day CMMC Reform Task Force and a public request for information. As of late October 2026, no resumption date has been announced. The 32 CFR Part 170 rule itself remains on the books.
- DEC 16, 2024CMMC program rule (32 CFR Part 170) takes effect
- NOV 10, 2025Phase 1 begins: Level 1 and Level 2 self-assessments in contracts (DFARS rule)
- JUL 13, 2026Phase 2 (C3PAO by default) suspended; reform task force and RFI launched
- SEP 2026Class deviation tells contracting officers to accept self-assessments and remove third-party assessment requirements at the next modification
- OCT 2026Task force review closed; final determinations pending
What still applies today
- DFARS 252.204-7012 safeguarding and 72-hour incident reporting
- NIST SP 800-171 Rev. 2 (110 requirements) for systems handling CUI
- Level 1 / Level 2 self-assessments, SPRS scores, and annual senior-official affirmations
- Existing C3PAO certifications remain valid for their three-year term
- False Claims Act exposure for inaccurate affirmations continues
Our view: the pause is a window to get audit-ready, not a reason to stop. Requirements can return quickly.
HIPAA Security Rule
The current HIPAA Security Rule remains in force. HHS proposed the first major update in two decades (published January 6, 2025). The federal regulatory agenda now lists final action no earlier than mid-2027, and agenda dates are not binding.
- JAN 6, 2025Proposed rule published in the Federal Register
- MAR 7, 2025Public comment period closed
- 2026Final rule delayed; current rule still enforced by HHS OCR
What the proposal would require
- Remove “addressable” flexibility: MFA, encryption, and segmentation become expected
- Written asset inventory and network map for systems touching ePHI
- Risk analysis reviewed at least every 12 months
- Vulnerability scans every 6 months and penetration tests every 12 months
- Ability to restore critical systems within 72 hours
Smart move: adopt HHS 405(d) Health Industry Cybersecurity Practices now; they line up with where the rule is heading.
PCI DSS v4.0.1
Version 4.0.1 is the active standard for anyone who stores, processes, or transmits cardholder data. The “future-dated” requirements introduced in v4.0 became mandatory on March 31, 2025, so assessments now test all of them.
- MAR 31, 2024PCI DSS v3.2.1 retired
- JUN 2024v4.0.1 published (clarifications, no new requirements)
- MAR 31, 2025Future-dated requirements became mandatory
Where teams most often fall short
- MFA for all access into the cardholder data environment
- Targeted risk analyses to justify control frequencies
- Inventory and integrity monitoring of payment-page scripts (e-commerce skimming)
- Authenticated internal vulnerability scanning
- Stronger password and service-account management
NIST Risk Management Framework (SP 800-37 Rev. 2)
The RMF is the seven-step process federal agencies and many contractors use to manage security and privacy risk across a system's lifecycle. Click a step:
Direct links
- RMF overview, quick-start guides, and FAQs
- SP 800-37 Rev. 2: the RMF process itself
- SP 800-53 Rev. 5: the control catalog used in the Select step
- Pairs with NIST AI RMF for AI systems, and with CSF 2.0 for enterprise programs
Last reviewed October 23, 2026. This summary is general information, not legal advice; confirm requirements against the official sources.