Updates to the standards and frameworks we consult and audit against.
ISO and IEC have published ISO/IEC 27090:2026, guidance on understanding, detecting, and mitigating security threats specific to AI systems, designed to sit alongside ISO/IEC 27001 and 27002.
The European Commission proposes faster standards development and free access to the harmonised standards that support EU law.
The PCI Security Standards Council has published a new Key Management and Operations Standard, Secure Software Lifecycle Standard v2.0, and guidance on AI systems.
NIST has published the initial public draft of SP 800-82 Rev. 4, its guide to operational technology security, for comment until 30 November 2026.
ISO and IEC publish the second edition of ISO/IEC 27017, updating cloud security controls to align with ISO/IEC 27002:2022.
Stricter Cyber Essentials requirements apply from today, with MFA failures and unpatched critical vulnerabilities now resulting in automatic failure.
The three-year transition to ISO/IEC 27001:2022 has ended; certificates against the 2013 edition are no longer valid.
The CCB has published CyFun 2025, with more emphasis on supply chain and operational technology security.
The revised ISO/IEC 27701 can now be implemented and certified independently of ISO/IEC 27001.
ISO and IEC publish the third edition of ISO/IEC 27018, aligned to ISO/IEC 27002:2022, for protecting PII in public clouds.
CAF v4.0 responds to the growing threat, with new emphasis on threat understanding, secure software and AI-related risks.
Updated Cyber Essentials requirements and the new Willow question set apply to assessments from today.