Frequently asked questions

Can we rely on the old CMMC November 2026 timetable?

No; the official program material reports the July 2026 Phase II suspension. Have the contract owner check the current requirements and clauses rather than assuming either the old timetable or a blanket exemption.

Should we stop HIPAA security work until the proposal is final?

No; HHS says the current Security Rule remains in effect during rulemaking. Separate present obligations from preparatory work on a proposal.

Does pending OIRA review mean CIRCIA is effective?

No; the review record is evidence of review status, not an effective final rule. Recheck publication and effective-date information before applying new reporting requirements.

Is every private business covered by the SEC's public-company incident rule?

No; the SEC guide describes the relevant registrant requirements. A private business may instead have other sector, state or contractual duties that require separate analysis.

Is the NYDFS September guidance a new regulation?

The guidance itself says it does not impose new obligations. It is still useful for reviewing whether an existing risk assessment supports actual control decisions.