Every dated change across the framework registry, in one list.

NERC CIP — NERC CIP: Effective dates are staggered per standard: CIP-003-9 took effect 2026-04-01, CIP-012-2 took effect 2026-07-01, and CIP-015-1 (internal network security monitoring, FERC-approved 2025-06-26) requires high- and medium-impact BES Cyber Systems with external routable connectivity to comply by 2028-10-01, with all other in-scope systems following by 2030-10-01.

Teams in electric utilities should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

EU Cyber Resilience Act — EU Cyber Resilience Act: Phased. Notification-body provisions applied from 2026-06-11 and actively-exploited-vulnerability reporting from 2026-09-11. The main manufacturer obligations, CE marking, and SBOM requirements apply from 2027-12-11.

Teams in hardware, software, IoT should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

EU AI Act — EU AI Act: Regulation (EU) 2026/1744 (the 'Digital Omnibus on AI'), adopted 2026-07-08 and published in the OJ 2026-07-24, entered into force 2026-07-27, amending Regulation (EU) 2024/1689 (confirmed directly against the regulation's own EUR-Lex text). It defers Annex III high-risk obligations (Article 6(2) systems) to 2027-12-02 and Annex I embedded-product obligations (Article 6(1) systems) to 2028-08-02. Article 50 transparency duties began applying 2026-08-02, with a four-month transitional allowance for systems already placed on the market before that date. Treat the Omnibus as amending legislation, not a replacement framework.

Teams in AI, technology, regulated industries should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

CJIS Security Policy — CJIS Security Policy: the coexistence window for 6.1 — Priority 2 through 4 modernized requirements (zero-cycle) (applying to Every agency and vendor covered by v6.1 — findings on these lower-priority requirements are recorded but not sanctioned during the zero-cycle) is scheduled to close.

Every agency and vendor covered by v6.1 — findings on these lower-priority requirements are recorded but not sanctioned during the zero-cycle should move to 6.1 on or before this date; after it, 6.1 — Priority 2 through 4 modernized requirements (zero-cycle) is no longer a recognized alternative under CJIS Security Policy.

CJIS Security Policy — CJIS Security Policy: The FBI frames the transition not by version number but by a zero-cycle running 2024-10-01 to 2027-09-30 for lower-priority modernized requirements (Priority 2 through 4): findings are recorded but not yet sanctionable. Priority 1 controls have been sanctionable since 2024-10-01. A state's own audit program may still cite an older baseline against its own timeline (for example, Texas DPS audits have historically referenced v5.9.5) — that is a state-sourced fact, not an FBI one, and should be verified per state before quoting an enforced version.

Teams in law enforcement, public safety, government should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

FedRAMP (Rev. 5 baselines) — FedRAMP (Rev. 5 baselines): FedRAMP 20x is the forward program path, while Rev. 5 remains available during transition. FedRAMP Ready submissions under Rev. 5 stopped being accepted 2026-07-28. FedRAMP will stop accepting applications for new Rev. 5 Certifications on 2027-06-11. Existing Rev. 5 authorizations remain valid through at least 2028-12-31; FedRAMP has not stated a final retirement date for all of them.

Teams in federal cloud should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

GDPR — GDPR: Regulation (EU) 2025/2518, adopted 2025-11-26 and published 2025-12-12, lays down additional procedural rules for cross-border GDPR enforcement; its main chapters apply 15 months after entry into force (2027-04-02). Confirmed directly against the regulation's own EUR-Lex text. Separately, the Commission's Digital Omnibus (Data track), proposed 2025-11-19, would amend Art. 5(1)(b), add a new Art. 33a single-entry-point breach notification, and add Art. 88a — it remains under Council/Parliament negotiation and is not enacted law at this check.

Teams in all sectors should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

Colorado AI Act — Colorado AI Act: SB 26-189 (signed 2026-05-14) repeals and reenacts SB 24-205 rather than amending it: the risk management programme, the annual impact assessment, and the duty of reasonable care against algorithmic discrimination are all gone, replaced by notice and disclosure duties on automated decision-making technology. It takes effect 2027-01-01 and leaves implementation detail to AG rulemaking. Nothing is in force today. Do not describe Colorado as a high-risk-AI regime.

Teams in AI, employment, lending should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

FedRAMP 20x — FedRAMP 20x: CR26 took effect 2026-07-04 (optional) and becomes mandatory 2027-01-01. The Class A application pipeline opened 2026-08-03. Class B and C application pipelines opened 2026-08-31. Class D has not yet opened (targeted FY27 Q1-Q2).

Teams in federal cloud should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

TISAX — TISAX: ENX has published ISA2027, which becomes the basis for TISAX assessments ordered from 2027-01-01. Assessments ordered before then may remain on ISA 6, and March 2027 is the final date to open an initial ISA 6 assessment.

Teams in automotive, manufacturing, supply chain should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

Sarbanes-Oxley ICFR — Sarbanes-Oxley ICFR: PCAOB and SEC-approved amendments to AS 2201 paragraph .09 and new paragraph .99 become effective on 2026-12-15. They affect the auditor standard, not the statutory text of SOX.

Teams in public companies, financial reporting, audit firms should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

PCI Contactless Payments on COTS (CPoC) — PCI Contactless Payments on COTS (CPoC): the coexistence window for PCI MPoC v1.1 (designated successor) (applying to New solutions and any CPoC solution being migrated ahead of the sunset) is scheduled to close.

New solutions and any CPoC solution being migrated ahead of the sunset should move to v1.0 on or before this date; after it, PCI MPoC v1.1 (designated successor) is no longer a recognized alternative under PCI Contactless Payments on COTS (CPoC).

PCI Contactless Payments on COTS (CPoC) — PCI Contactless Payments on COTS (CPoC): PCI SSC announced the formal sunset period for CPoC from 2026-05-01 to 2026-10-31, the same window as SPoC. PCI MPoC v1.1 is the standard's designated successor.

Teams in payments, mobile point-of-sale should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

PCI Mobile Payments on COTS (MPoC) — PCI Mobile Payments on COTS (MPoC): MPoC is the designated successor absorbing PCI SPoC and CPoC, which are both in their formal sunset window (2026-05-01 to 2026-10-31).

Teams in payments, mobile point-of-sale should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

PCI Software-based PIN Entry on COTS (SPoC) — PCI Software-based PIN Entry on COTS (SPoC): the coexistence window for PCI MPoC v1.1 (designated successor) (applying to New solutions and any SPoC solution being migrated ahead of the sunset) is scheduled to close.

New solutions and any SPoC solution being migrated ahead of the sunset should move to v1.1 on or before this date; after it, PCI MPoC v1.1 (designated successor) is no longer a recognized alternative under PCI Software-based PIN Entry on COTS (SPoC).

PCI Software-based PIN Entry on COTS (SPoC) — PCI Software-based PIN Entry on COTS (SPoC): PCI SSC announced the formal sunset period for SPoC from 2026-05-01 to 2026-10-31. PCI MPoC v1.1 is the standard's designated successor for organizations moving off SPoC.

Teams in payments, mobile point-of-sale should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

AIUC-1 — AIUC-1: AIUC states that it updates the standard quarterly; the next scheduled release is 2026-10-15.

Teams in AI, technology, SaaS should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

GAO FISCAM — GAO FISCAM: The June 2026 revision is already effective for fiscal-year and calendar-year 2026 federal financial statement audits; it becomes effective for attestation and performance-audit engagements beginning on or after 2026-10-01.

Teams in federal, government audit, public sector should track this date against their own assessment or renewal calendar; the authority has signalled the change but has not yet made it effective.

OWASP GenAI LLM Top 10 — OWASP GenAI LLM Top 10 2026 supersedes 2025 and is the current edition.

Teams in AI, technology, SaaS under OWASP GenAI LLM Top 10 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2026.

ISO/IEC 27017 — ISO/IEC 27017 2026 supersedes 2015 and is the current edition.

Teams in cloud services, SaaS, technology under ISO/IEC 27017 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2026.

AIUC-1 — AIUC-1 Q3 2026 (2026-07-15 release) supersedes Q2 2026 (2026-04-15 release) and is the current edition.

Teams in AI, technology, SaaS under AIUC-1 should confirm which edition their engagement, contract, or assessment cycle requires before relying on Q3 2026 (2026-07-15 release).

CMS Acceptable Risk Safeguards — CMS Acceptable Risk Safeguards ARS 5.2 supersedes ARS 5.1 and is the current edition.

Teams in federal healthcare, CMS contractors under CMS Acceptable Risk Safeguards should confirm which edition their engagement, contract, or assessment cycle requires before relying on ARS 5.2.

GAO FISCAM — GAO FISCAM June 2026 (GAO-26-108633) supersedes September 2024 (GAO-24-107026) and is the current edition.

Teams in federal, government audit, public sector under GAO FISCAM should confirm which edition their engagement, contract, or assessment cycle requires before relying on June 2026 (GAO-26-108633).

CJIS Security Policy — CJIS Security Policy 6.1 supersedes 6.0 and is the current edition.

Teams in law enforcement, public safety, government under CJIS Security Policy should confirm which edition their engagement, contract, or assessment cycle requires before relying on 6.1.

CSA AI Controls Matrix — CSA AI Controls Matrix v1.1 supersedes v1.0 and is the current edition.

Teams in AI, cloud services, SaaS under CSA AI Controls Matrix should confirm which edition their engagement, contract, or assessment cycle requires before relying on v1.1.

Colorado AI Act — Colorado AI Act SB 26-189 supersedes SB 24-205 (as enacted 2024) and is the current edition.

Teams in AI, employment, lending under Colorado AI Act should confirm which edition their engagement, contract, or assessment cycle requires before relying on SB 26-189.

NIST SP 800-172 — NIST SP 800-172 Rev. 3 supersedes 2021 and is the current edition.

Teams in defense industrial base, federal contractors, critical programs under NIST SP 800-172 should confirm which edition their engagement, contract, or assessment cycle requires before relying on Rev. 3.

HITRUST CSF — HITRUST CSF v11.8.0 supersedes v11.7.0 and is the current edition.

Teams in healthcare, technology, financial services under HITRUST CSF should confirm which edition their engagement, contract, or assessment cycle requires before relying on v11.8.0.

APRA CPS 230 — APRA CPS 230 2026 determination (effective 2026-07-01) supersedes 2023 determination (effective 2025-07-01) and is the current edition.

Teams in banking, insurance, superannuation under APRA CPS 230 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2026 determination (effective 2026-07-01).

OSCAL — OSCAL 1.2.2 supersedes 1.2.0 and is the current edition.

Teams in all sectors under OSCAL should confirm which edition their engagement, contract, or assessment cycle requires before relying on 1.2.2.

UK Cyber Essentials — UK Cyber Essentials Requirements for IT infrastructure v3.3 supersedes Requirements for IT infrastructure v3.2 and is the current edition.

Teams in all sectors, government suppliers, small and medium businesses under UK Cyber Essentials should confirm which edition their engagement, contract, or assessment cycle requires before relying on Requirements for IT infrastructure v3.3.

CMS Enhanced Direct Enrollment — CMS Enhanced Direct Enrollment Year 9 (PY 2026–PY 2027) supersedes Year 8 and is the current edition.

Teams in healthcare, insurance under CMS Enhanced Direct Enrollment should confirm which edition their engagement, contract, or assessment cycle requires before relying on Year 9 (PY 2026–PY 2027).

UK GDPR — UK GDPR UK GDPR + DPA 2018, as amended by DUAA 2025 (in force via Commencement No. 6, SI 2026/82) supersedes UK GDPR + DPA 2018 and is the current edition.

Teams in all sectors under UK GDPR should confirm which edition their engagement, contract, or assessment cycle requires before relying on UK GDPR + DPA 2018, as amended by DUAA 2025 (in force via Commencement No. 6, SI 2026/82).

CSA CCM and CAIQ — CSA CCM and CAIQ v4.1 supersedes v4.0 and is the current edition.

Teams in cloud services, SaaS, technology under CSA CCM and CAIQ should confirm which edition their engagement, contract, or assessment cycle requires before relying on v4.1.

ISO/IEC 27701 — ISO/IEC 27701 2025 supersedes 2019 and is the current edition.

Teams in all sectors under ISO/IEC 27701 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2025.

CCPA/CPRA + US state privacy — CCPA/CPRA + US state privacy CCPA/CPRA with 2026 CPPA regulations supersedes CCPA/CPRA (2020 regulations) and is the current edition.

Teams in all sectors under CCPA/CPRA + US state privacy should confirm which edition their engagement, contract, or assessment cycle requires before relying on CCPA/CPRA with 2026 CPPA regulations.

CMMC — CMMC 32 CFR Part 170; DFARS 252.204-7021 (Nov. 2025) supersedes 1.0 and is the current edition.

Teams in defense industrial base under CMMC should confirm which edition their engagement, contract, or assessment cycle requires before relying on 32 CFR Part 170; DFARS 252.204-7021 (Nov. 2025).

NIST SP 800-53 — NIST SP 800-53 Rev. 5, Release 5.2.0 supersedes Rev. 5, Release 5.1.1 and is the current edition.

Teams in federal, critical infrastructure, technology under NIST SP 800-53 should confirm which edition their engagement, contract, or assessment cycle requires before relying on Rev. 5, Release 5.2.0.

ISO/IEC 27018 — ISO/IEC 27018 2025 supersedes 2019 and is the current edition.

Teams in cloud services, SaaS, technology under ISO/IEC 27018 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2025.

GAO Green Book — GAO Green Book 2025 Revision supersedes 2014 Revision and is the current edition.

Teams in federal, government audit, public sector under GAO Green Book should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2025 Revision.

ARC-AMPE — ARC-AMPE v1.02 supersedes MARS-E 2.2 and is the current edition.

Teams in healthcare, insurance, federal under ARC-AMPE should confirm which edition their engagement, contract, or assessment cycle requires before relying on v1.02.

CJIS Security Policy — CJIS Security Policy 6.0 supersedes 5.9.5.

Teams in law enforcement, public safety, government under CJIS Security Policy should confirm which edition their engagement, contract, or assessment cycle requires before relying on 6.0.

OSCAL — OSCAL 1.2.0 supersedes 1.1.3.

Teams in all sectors under OSCAL should confirm which edition their engagement, contract, or assessment cycle requires before relying on 1.2.0.

PCI Mobile Payments on COTS (MPoC) — PCI Mobile Payments on COTS (MPoC) v1.1 supersedes v1.0 and is the current edition.

Teams in payments, mobile point-of-sale under PCI Mobile Payments on COTS (MPoC) should confirm which edition their engagement, contract, or assessment cycle requires before relying on v1.1.

GovRAMP (formerly StateRAMP) — GovRAMP (formerly StateRAMP) Rev. 5 baselines supersedes Rev. 4 baselines and is the current edition.

Teams in cloud services, SaaS, state and local government under GovRAMP (formerly StateRAMP) should confirm which edition their engagement, contract, or assessment cycle requires before relying on Rev. 5 baselines.

CIS Critical Security Controls — CIS Critical Security Controls v8.1 supersedes v8 and is the current edition.

Teams in all sectors under CIS Critical Security Controls should confirm which edition their engagement, contract, or assessment cycle requires before relying on v8.1.

PCI DSS — PCI DSS v4.0.1 supersedes v4.0 and is the current edition.

Teams in payments, retail, SaaS under PCI DSS should confirm which edition their engagement, contract, or assessment cycle requires before relying on v4.0.1.

SOC 1 — SOC 1 AT-C section 320, as amended by SSAE No. 23 (2025-12-15) supersedes SSAE No. 18 (AT-C section 320) and is the current edition.

Teams in service organizations, payroll, financial services under SOC 1 should confirm which edition their engagement, contract, or assessment cycle requires before relying on AT-C section 320, as amended by SSAE No. 23 (2025-12-15).

NIST SP 800-171 — NIST SP 800-171 Rev. 3 supersedes Rev. 2 and is the current edition.

Teams in defense industrial base, federal contractors under NIST SP 800-171 should confirm which edition their engagement, contract, or assessment cycle requires before relying on Rev. 3.

TISAX — TISAX ISA 6.0.3 supersedes ISA 5.1.0 and is the current edition.

Teams in automotive, manufacturing, supply chain under TISAX should confirm which edition their engagement, contract, or assessment cycle requires before relying on ISA 6.0.3.

NIST Cybersecurity Framework — NIST Cybersecurity Framework 2.0 supersedes 1.1 and is the current edition.

Teams in all sectors under NIST Cybersecurity Framework should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2.0.

ISO 22301 — ISO 22301 2019 (Amd 1:2024) supersedes 2012 and is the current edition.

Teams in all sectors, critical infrastructure, financial services under ISO 22301 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2019 (Amd 1:2024).

42 CFR Part 2 — 42 CFR Part 2 2024 final rule supersedes Pre-2024 Part 2 and is the current edition.

Teams in healthcare, behavioral health under 42 CFR Part 2 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2024 final rule.

GAO Yellow Book (GAGAS) — GAO Yellow Book (GAGAS) 2024 Revision supersedes 2018 Revision (2021 technical update) and is the current edition.

Teams in government audit, public sector, government award recipients under GAO Yellow Book (GAGAS) should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2024 Revision.

IIA Global Internal Audit Standards — IIA Global Internal Audit Standards 2024 IPPF (effective 2025-01-09) supersedes 2017 IPPF and is the current edition.

Teams in internal audit, professional services, all sectors under IIA Global Internal Audit Standards should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2024 IPPF (effective 2025-01-09).

GLBA Safeguards Rule — GLBA Safeguards Rule 16 CFR Part 314 (amended 2023) supersedes 16 CFR Part 314 (2021 amendments) and is the current edition.

Teams in financial services, lending, tax preparation under GLBA Safeguards Rule should confirm which edition their engagement, contract, or assessment cycle requires before relying on 16 CFR Part 314 (amended 2023).

NYDFS 23 NYCRR 500 — NYDFS 23 NYCRR 500 23 NYCRR 500 (2023 amendments) supersedes 23 NYCRR 500 (2017) and is the current edition.

Teams in financial services, insurance under NYDFS 23 NYCRR 500 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 23 NYCRR 500 (2023 amendments).

FedRAMP (Rev. 5 baselines) — FedRAMP (Rev. 5 baselines) Rev. 5 supersedes Rev. 4 and is the current edition.

Teams in federal cloud under FedRAMP (Rev. 5 baselines) should confirm which edition their engagement, contract, or assessment cycle requires before relying on Rev. 5.

NIS2 Directive — NIS2 Directive Directive (EU) 2022/2555 supersedes Directive (EU) 2016/1148 (NIS1) and is the current edition.

Teams in critical sectors under NIS2 Directive should confirm which edition their engagement, contract, or assessment cycle requires before relying on Directive (EU) 2022/2555.

ISO/IEC 27001 — ISO/IEC 27001 2022 (Amd 1:2024) supersedes 2013 and is the current edition.

Teams in all sectors under ISO/IEC 27001 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2022 (Amd 1:2024).

PCI DSS — PCI DSS v4.0 supersedes v3.2.1.

Teams in payments, retail, SaaS under PCI DSS should confirm which edition their engagement, contract, or assessment cycle requires before relying on v4.0.

ISO/IEC 27002 — ISO/IEC 27002 2022 supersedes 2013 and is the current edition.

Teams in all sectors, SaaS, technology under ISO/IEC 27002 should confirm which edition their engagement, contract, or assessment cycle requires before relying on 2022.

NIST SSDF — NIST SSDF v1.1 supersedes v1.0 and is the current edition.

Teams in technology, federal contractors, SaaS under NIST SSDF should confirm which edition their engagement, contract, or assessment cycle requires before relying on v1.1.

PCI PIN Security Requirements — PCI PIN Security Requirements v3.1 supersedes v3.0 and is the current edition.

Teams in payments under PCI PIN Security Requirements should confirm which edition their engagement, contract, or assessment cycle requires before relying on v3.1.

FISMA — FISMA Federal Information Security Modernization Act of 2014 supersedes Federal Information Security Management Act of 2002 and is the current edition.

Teams in federal, federal contractors under FISMA should confirm which edition their engagement, contract, or assessment cycle requires before relying on Federal Information Security Modernization Act of 2014.