Separate existing obligations from proposals and changes that still need a decision.
Suspended in July 2026; previous November schedule is not a safe planning assumption
As at 20 October 2026Who should investigateDefense supply-chain organizations handling relevant contract information
Read current guidance and actual contract clauses
Proposed; existing rule remains in force
As at 20 October 2026Who should investigateCovered entities and business associates
Separate existing duties from preparation for possible changes
Final-rule review pending at OIRA
As at 20 October 2026Who should investigatePotentially covered critical-infrastructure entities
Monitor final publication and effective date
Compliance dates for both size groups have passed
As at 20 October 2026Who should investigateSpecified SEC-regulated institutions
Verify the operating incident program and supplier oversight
Existing regulation; new September 2026 risk-assessment guidance
As at 20 October 2026Who should investigateDFS-regulated covered entities, subject to scope/exemptions
Connect the assessment to control decisions
Effective since May 2024
As at 20 October 2026Who should investigateCovered non-bank financial institutions
Maintain an applicable notification decision process
Existing disclosure regime
As at 20 October 2026Who should investigateRelevant public-company registrants
Separate materiality decisions from technical triage
Future-dated requirements became effective in March 2025
As at 20 October 2026Who should investigateIn-scope payment-card environments
Confirm validation scope with acquirer/QSA
An organization may fall into several rows; deadlines and definitions should not be merged into a single generic reporting clock. Status is recorded at the research cutoff.
Research cutoff: 20 October 2026. Geography: United States unless expressly stated.
Start with applicability and current status. A requirement for a particular financial institution, government contractor or healthcare entity is not a universal requirement for every US company.
This is a dated buying and implementation brief, not a determination of any company's legal obligations. No legal entity details, licenses, contracts, data flows or exemptions were supplied. The actions below are editorial procurement recommendations to take to the accountable compliance owner or counsel. Recheck official sources before making a filing, signing an attestation or relying on a deadline.
Sources and the details behind each row follow.
The official CMMC material reports that Phase II was suspended on 13 July 2026.
No final modernization rule was established by the sources checked.
The official record checked shows the CIRCIA final rule in pending OIRA review, received 1 October 2026.
The SEC's amendments became effective 2 August 2024, with compliance dates of 3 December 2025 for larger entities and 3 June 2026 for smaller entities.
On 10 September 2026, NYDFS issued guidance on cybersecurity risk assessments under Part 500.
Official sources: FTC notification announcement, FTC scope and rule guide and SEC disclosure compliance guide.
PCI DSS is an industry standard within the payment-card ecosystem, not a general federal law.
Use a change register with the rule, legal entity, official URL, status, publication date, effective date, compliance date, accountable reviewer and next check.
No; the official program material reports the July 2026 Phase II suspension.
Read →No entity specific legal applicability opinion, contract clause analysis, exemption analysis or 50 state breach notification survey was performed. CMMC…
Read →CMMC Phase II suspended 2026; HIPAA Security Rule proposal status; CIRCIA effective date; Regulation S-P small firm deadline; NYDFS risk assessment guidance; cybersecurity reporting obligations for US businesses.
Read →Strong use of dated official sources and explicit legal-status distinctions.
Read →Sources and publication dates for Regulatory news and changes. Undated product and job pages are observations at the research cutoff.
Read →Strong use of dated official sources and explicit legal-status distinctions. Completeness is limited to the selected US buyer scenarios and does not establish individual applicability.
Read the scoring context →
Cybersecurity buying research