# What should regulated buyers distinguish from new legislation?

| Audience | Verified position | Recommended platform requirement |
|---|---|---|
| NYDFS-covered entities | The **10 September 2026** risk-assessment guidance clarifies requirements and good practices; DFS explicitly says it creates no new obligations. It discusses repeatable methodologies and consistent likelihood-and-impact criteria. ([dfs.ny.gov](https://www.dfs.ny.gov/industry_guidance/industry_letters/il20260910-cyber-risk-assessment)) | Preserve assessment methodology versions, scoring rationale, supporting inputs and approval history. |
| Banks and credit unions | The September interagency third-party guidance remains a **proposal**, with comments due **16 November 2026**. ([govinfo.gov](https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm?utm_source=openai)) | Make risk-tiering and monitoring workflows configurable; retain the rationale for differentiated treatment. |
| Healthcare organisations | HHS’s official Security Rule proposal page continues to describe the measure as proposed and states that the current Security Rule remains in effect during rulemaking. No new final-rule deadline is established by that page. ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html)) | Separate existing obligations from proposed changes in the obligations register; require compliance review before activating new mappings. |