# Sources

Official regulators, government records and standard-setting bodies support the regulatory conclusions below. Industry press, job-board and practitioner-media searches were used for discovery, not as legal authority. URLs are provided in code form; the inline citations provide source links.

### California privacy and Colorado automated decision-making

- CPPA, completed rulemaking: `https://cppa.ca.gov/regulations/ccpa_updates.html`
- CPPA, approved regulations: `https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf`
- CPPA, finalisation announcement and staged dates: `https://www.cppa.ca.gov/announcements/2025/20250923.html`
- Colorado Attorney General, current rulemaking and status: `https://coag.gov/ai/`
- Colorado General Assembly, enacted SB26-189: `https://leg.colorado.gov/bills/sb26-189`

### Financial services and banking

- NYDFS, cybersecurity resource centre: `https://www.dfs.ny.gov/cybersecurity`
- NYDFS, implementation timeline: `https://www.dfs.ny.gov/industry_guidance/cybersecurity/implementation_timeline_covered_entities`
- NYDFS, MFA guidance: `https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf`
- SEC, Regulation S-P compliance guide: `https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf`
- Federal Reserve, SR 26-2: `https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm`
- Federal Reserve, revised joint model-risk guidance: `https://www.federalreserve.gov/frrs/guidance/supervisory-guidance-on-model-risk-management.htm`
- OCC, proposed third-party guidance: `https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-46.html`
- Federal Register, proposed third-party guidance: `https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm`
- OCC, consultation dates: `https://www.occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/occ-proposed-issuances-2026.html`
- Agencies, joint third-party announcement: `https://www.occ.gov/news-issuances/news-releases/2026/nr-ia-2026-77.html`
- OCC, Cybersecurity Supervision Work Program update: `https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-48.html`
- FDIC, FFIEC CAT sunset: `https://www.fdic.gov/news/financial-institution-letters/2024/sunset-ffiec-cybersecurity-assessment-tool`

### Healthcare

- HHS, Part 2 overview: `https://www.hhs.gov/hipaa/part-2/index.html`
- HHS, Part 2 enforcement announcement: `https://www.hhs.gov/press-room/hhs-announce-civil-enforcement-program-sud-patient-records.html`
- HHS, Part 2 final-rule fact sheet: `https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html`
- HHS, HIPAA Security Rule proposal: `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html`
- HHS, proposal fact sheet: `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html`
- HHS, current Security Rule summary: `https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html`
- Regulatory agenda, HIPAA proposal: `https://mobile.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA22&pubId=202510`
- HHS, HTI-5 announcement: `https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html`

### Incident reporting, contracting and data access

- OIRA, CIRCIA pending review: `https://www.reginfo.gov/public/do/eoDetails?rrid=1550967`
- CISA, CIRCIA fact sheet: `https://www.cisa.gov/sites/default/files/2023-01/CIRCIA_07.21.2022_Factsheet_FINAL_508%20c.pdf`
- Official CMMC programme status: `https://dodcio.defense.gov/cmmc/About/`
- SBA Office of Advocacy, CMMC reform review: `https://advocacy.sba.gov/2026/07/20/dow-requests-information-for-cmmc-reform-task-force/`
- DOJ, Data Security Program: `https://www.justice.gov/nsd/data-security`
- DOJ, updated programme FAQs: `https://justice.gov/nsd/media/1415006/dl`

### Climate reporting

- CARB, 12 October 2026 approval and deadline notice: `https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1`
- CARB, reporting resources: `https://content.govdelivery.com/accounts/CARB/bulletins/427b576`
- CARB, SB 261 enforcement status: `https://ww2.arb.ca.gov/our-work/programs/corporate-ghg-reporting/climate-related-financial-risk`

### Professional standards and European AI requirements

- IIA, applicability and topical requirements: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/`
- IIA, cybersecurity: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity`
- IIA, third-party: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/`
- IIA, organisational behaviour: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/`
- IIA, organisational resilience: `https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/`
- European Commission, AI Omnibus entry into force: `https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force`
- European Commission, AI Act implementation: `https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai`
- NIST, SP 800-53 Release 5.2.0: `https://csrc.nist.gov/news/2025/nist-releases-revision-to-sp-800-53-controls`
- IAF, ISO/IEC 27001 transition: `https://iaf.nu/en/changes-in-the-scope-of-the-iaf-mla-during-2024-2025/`