https://infosecstandards.org/news Plain-language help for anyone facing a security compliance standard: what applies, what it costs, and how to move forward. en-us https://infosecstandards.org/news/site-launch https://infosecstandards.org/news/site-launch Thu, 03 Sep 2026 00:00:00 GMT The catalog, first-contact standard pages, news follows, and What applies? picker are live. This is an educational site operated by Aeris Secure. https://infosecstandards.org/news/who-decides-what-to-ask https://infosecstandards.org/news/who-decides-what-to-ask Thu, 03 Sep 2026 00:00:00 GMT The HIPAA, PCI DSS, CMMC, and SOC 2 pages each gained a section naming the party that actually sets your obligation and the questions to put to them in writing. HIPAA and SOC 2 also gained a first-decision picker. https://infosecstandards.org/news/risk-assessment-tool https://infosecstandards.org/news/risk-assessment-tool Wed, 02 Sep 2026 00:00:00 GMT Infosec Standards now has a guided, NIST SP 800-30 based risk assessment tool. Everything stays in your browser; you leave with a JSON file to resume from, a spreadsheet register, and a printable report. https://infosecstandards.org/news/pci-dss-roc-saq-guide https://infosecstandards.org/news/pci-dss-roc-saq-guide Mon, 10 Aug 2026 00:00:00 GMT On August 4, 2026, PCI SSC updated FAQ 1331 so merchants cannot use SAQ eligibility criteria to decide ROC applicability without Compliance Accepting Entity agreement. https://infosecstandards.org/news/hipaa-osf-settlement https://infosecstandards.org/news/hipaa-osf-settlement Thu, 06 Aug 2026 00:00:00 GMT HHS OCR resolved a 2021 ransomware investigation with OSF Healthcare System for risk analysis, impermissible disclosure, and late breach-notification failures. https://infosecstandards.org/news/welcome https://infosecstandards.org/news/welcome Wed, 29 Jul 2026 00:00:00 GMT Introducing Infosec Standards, a plain-language catalog for security compliance standards. https://infosecstandards.org/news/cmmc-phase-2-suspended https://infosecstandards.org/news/cmmc-phase-2-suspended Mon, 13 Jul 2026 00:00:00 GMT The Defense Department suspended the November 2026 ramp-up of CMMC Level 2 third-party assessments and opened a short review of the program. Phase 1 self-assessment rules stay in force. https://infosecstandards.org/news/hipaa-security-rule-delay https://infosecstandards.org/news/hipaa-security-rule-delay Mon, 06 Jul 2026 00:00:00 GMT HHS OCR’s proposed Security Rule update is now a long-term action with a projected final action date of July 2027. The current Security Rule stays in force. https://infosecstandards.org/news/cmmc-final-rule https://infosecstandards.org/news/cmmc-final-rule Tue, 15 Oct 2024 00:00:00 GMT On October 15, 2024, DoD published the CMMC Program final rule. It took effect December 16, 2024 and is the current CMMC 2.0 program regulation. https://infosecstandards.org/news/pci-dss-v4-0-1 https://infosecstandards.org/news/pci-dss-v4-0-1 Tue, 11 Jun 2024 00:00:00 GMT On June 11, 2024, PCI SSC published PCI DSS v4.0.1, a limited revision of v4.0. Future-dated v4 requirements became mandatory on March 31, 2025. https://infosecstandards.org/news/soc-2-2022-points-of-focus https://infosecstandards.org/news/soc-2-2022-points-of-focus Sat, 01 Oct 2022 00:00:00 GMT In October 2022, AICPA revised the points of focus that support the 2017 Trust Services Criteria. The criteria themselves did not change. This remains the current SOC 2 basis. https://infosecstandards.org/news/hipaa-omnibus-rule https://infosecstandards.org/news/hipaa-omnibus-rule Fri, 25 Jan 2013 00:00:00 GMT On January 25, 2013, HHS published the HIPAA Omnibus Final Rule. It took effect March 26, 2013, with a compliance date of September 23, 2013, and remains the rule set in force today.