PCI SSC revises FAQ 1331 on using SAQs to scope ROC assessments
On August 4, 2026, PCI SSC updated FAQ 1331 so merchants cannot use SAQ eligibility criteria to decide ROC applicability without Compliance Accepting Entity agreement.
CMMC Phase 2 third-party assessments put on hold
The Defense Department suspended the November 2026 ramp-up of CMMC Level 2 third-party assessments and opened a short review of the program. Phase 1 self-assessment rules stay in force.
HIPAA Security Rule overhaul pushed to July 2027 on the federal agenda
HHS OCR’s proposed Security Rule update is now a long-term action with a projected final action date of July 2027. The current Security Rule stays in force.
CMMC Program rule published as 32 CFR Part 170
On October 15, 2024, DoD published the CMMC Program final rule. It took effect December 16, 2024 and is the current CMMC 2.0 program regulation.