Updates to the standards and frameworks we consult and audit against.
The International Medical Device Regulators Forum publishes N60, Principles and Practices for Medical Device Cybersecurity, a shared lifecycle approach for regulators and manufacturers.
Germany’s BSI publishes C5:2020, updating its Cloud Computing Compliance Criteria Catalogue for cloud security attestations.
China’s updated Multi-Level Protection Scheme standards now apply to cloud, mobile, IoT and industrial control systems.
The second edition of the business continuity management system standard has been published.
FIPS 140-3 becomes effective, updating US federal security requirements for cryptographic modules and aligning with ISO/IEC 19790.
ISO/IEC 27701 extends ISO/IEC 27001 and 27002 to cover privacy information management, supporting GDPR accountability.
The IEC publishes IEC 62443-4-2, setting technical security requirements for industrial automation and control system components.
SOC 2 reports for periods ending on or after 15 December 2018 must use the AICPA’s 2017 Trust Services Criteria.
The NCSC has published the Cyber Assessment Framework, the basis for assessing operators of essential services under the UK NIS Regulations.
NIST has published version 1.1 of the Cybersecurity Framework, with expanded guidance on supply chain risk, identity management and self-assessment.
France replaces its health data hosting approval process with mandatory HDS certification for hosts of personal health data.
SWIFT users must attest compliance with the Customer Security Controls Framework mandatory controls for the first time.