Regulatory movement, threat activity and control changes worth a practitioner's attention.
CMMC POA&M scope tightened: 8 controls now block conditional cert. Re-run SPRS for any account holding open POA&Ms in AC, IA, SC, SI families.
Active VPN exploit chain (CVE-2026-1841) maps to AC-17 + SC-7. Treat patch evidence as SI-2(2) timeliness artifact.
Updated 32 CFR 170 guidance restricts POA&M-eligible practices, removing 8 previously deferrable controls. Self-assessments due within 180 days for affected DIB contractors.
Run a fresh SPRS calc against your current POA&Ms. Anything in those four families now blocks conditional certification.
Pre-auth RCE chain observed in production attacks against federal contractors. Maps to AC-17, SC-7, SI-2 across NIST 800-53. Patch available; mitigation requires segmentation review.
Document patch + boundary review as evidence for SI-2(2) timeliness and AC-17 remote access controls.
AI impact assessment requirements clarified for high-risk systems. New thresholds for training data documentation align with EU AI Act technical files.
If you certified under early ISO 42001, refresh AIIA documentation. Auditors are now scoping training-data lineage.
Mid-size health system penalized for failure to maintain enterprise risk analysis. Settlement includes 2-year corrective action plan.
Risk analysis must be living. Annual update + every significant change. Document the trigger, not just the output.
PMO reports 65% reduction in time-to-authorization using machine-readable artifacts. SSP-as-code patterns validated across all impact levels.
If you're starting a FedRAMP path now, plan for 20x from day one. Manual SSP edits become technical debt fast.
Indian Data Protection Board publishes draft rules covering consent management, breach notification windows, and Significant Data Fiduciary thresholds.
If you process Indian PII, comments due in 45 days. Significant Data Fiduciary criteria likely to capture mid-tier SaaS.
Third-party logging library used by IDP vendor was modified to exfiltrate session tokens. Customers in CMMC, FedRAMP, and SOC 2 environments affected.
Inventory which SBOM components you ingest from this vendor. Audit log review for token-replay patterns is the immediate task.
New profiles cover RAG architectures, agentic workflows, and multi-model orchestration. Aligns with EU AI Act Article 13 transparency requirements.
If you run RAG in production, the new MP.4.1 subcategory applies. Document retrieval source provenance now.
New campaign impersonates audit firm portals to harvest auditee credentials and exfiltrate evidence packages. SOC 2 CC6.1 controls under stress.
Verify auditor portal URLs out-of-band. Consider portal access via SSO with phishing-resistant MFA only.
Rs 2 crore penalty levied for gaps in cyber risk framework, vendor risk management, and incident reporting timelines.
CERT-In 6-hour reporting + RBI 2-hour notification require automated detection-to-report tooling.
ISO/IEC JTC 1/SC 27 working group circulates draft amendment. New controls expected for AI system security and post-quantum cryptography readiness.
Track this — re-cert cycles in 2027 will need expanded SoA scoping for AI and PQC.
Foreign providers offering high-risk AI systems to EU users must register and appoint authorized representative. Penalties up to 3% global turnover.
Review your AI product use in the EU. Even SaaS embedded models can trigger high-risk classification.
Pulse periodically ingests regulatory updates, threat intelligence, enforcement actions, and framework changes from authoritative sources. Each signal is mapped to the controls it affects across your framework portfolio, then rendered for the persona you operate in.