PCI DSS v4.0 future-dated requirements become mandatory
31 Mar 2025
The future-dated requirements in PCI DSS v4.0 become mandatory, including targeted risk analyses, wider MFA and payment page script controls.
Updates to the standards and frameworks we consult and audit against.
The future-dated requirements in PCI DSS v4.0 become mandatory, including targeted risk analyses, wider MFA and payment page script controls.
The US launches the Cyber Trust Mark, a voluntary FCC security label for consumer IoT products.
Australia’s Protective Security Policy Framework Release 2024 restructures government security requirements and adds new risk and technology domains.
NIST publishes FIPS 203, 204 and 205, the first finalised post-quantum cryptography standards.
NIST AI 600-1 identifies risks unique to or exacerbated by generative AI and suggests actions to manage them.
CIS releases Controls v8.1, adding a Govern security function and aligning with NIST CSF 2.0.
NIST has published Revision 3 of SP 800-171, realigning CUI protection requirements with SP 800-53 Rev. 5.
CAF v3.2 refreshes guidance on remote access, privileged operations, user access and system monitoring.
Japan now requires medical device manufacturers to follow JIS T 81001-5-1 for secure software development.
TISAX assessments commissioned from 1 April 2024 must use version 6.0 of the VDA Information Security Assessment catalogue.
NIST has released CSF 2.0, adding a new Govern function and broadening the framework to all organisations.
ISO has amended its management system standards, including ISO/IEC 27001 and ISO 22301, to require consideration of climate change.