Cybersecurity buying research| Topic | Status at 20 October 2026 | Affected buyer to investigate | Practical decision |
|---|---|---|---|
| CMMC Phase II | Suspended in July 2026; previous November schedule is not a safe planning assumption | Defense supply-chain organizations handling relevant contract information | Read current guidance and actual contract clauses |
| HIPAA Security Rule modernization | Proposed; existing rule remains in force | Covered entities and business associates | Separate existing duties from preparation for possible changes |
| CIRCIA reporting rule | Final-rule review pending at OIRA | Potentially covered critical-infrastructure entities | Monitor final publication and effective date |
| Regulation S-P amendments | Compliance dates for both size groups have passed | Specified SEC-regulated institutions | Verify the operating incident program and supplier oversight |
| NYDFS Part 500 | Existing regulation; new September 2026 risk-assessment guidance | DFS-regulated covered entities, subject to scope/exemptions | Connect the assessment to control decisions |
| FTC Safeguards notification | Effective since May 2024 | Covered non-bank financial institutions | Maintain an applicable notification decision process |
| SEC incident disclosure | Existing disclosure regime | Relevant public-company registrants | Separate materiality decisions from technical triage |
| PCI DSS v4.0.1 | Future-dated requirements became effective in March 2025 | In-scope payment-card environments | Confirm validation scope with acquirer/QSA |
Sources and the details behind each row follow. An organization may fall into several rows; deadlines and definitions should not be merged into a single generic reporting clock.
Working view: explore the first table
Topic
CMMC Phase II
- Status at 20 October 2026
- Suspended in July 2026; previous November schedule is not a safe planning assumption
- Affected buyer to investigate
- Defense supply-chain organizations handling relevant contract information
- Practical decision
- Read current guidance and actual contract clauses
Sources cited on this page
No external source is linked directly in this page.
Open the section source register →