Updates to the standards and frameworks we consult and audit against.
The PCI Security Standards Council has published a new Key Management and Operations Standard, Secure Software Lifecycle Standard v2.0, and guidance on AI systems.
NIST has published the initial public draft of SP 800-82 Rev. 4, its guide to operational technology security, for comment until 30 November 2026.
ISO and IEC publish the second edition of ISO/IEC 27017, updating cloud security controls to align with ISO/IEC 27002:2022.
Stricter Cyber Essentials requirements apply from today, with MFA failures and unpatched critical vulnerabilities now resulting in automatic failure.
The three-year transition to ISO/IEC 27001:2022 has ended; certificates against the 2013 edition are no longer valid.
The CCB has published CyFun 2025, with more emphasis on supply chain and operational technology security.
The revised ISO/IEC 27701 can now be implemented and certified independently of ISO/IEC 27001.
ISO and IEC publish the third edition of ISO/IEC 27018, aligned to ISO/IEC 27002:2022, for protecting PII in public clouds.
CAF v4.0 responds to the growing threat, with new emphasis on threat understanding, secure software and AI-related risks.
Updated Cyber Essentials requirements and the new Willow question set apply to assessments from today.
The future-dated requirements in PCI DSS v4.0 become mandatory, including targeted risk analyses, wider MFA and payment page script controls.
The US launches the Cyber Trust Mark, a voluntary FCC security label for consumer IoT products.