# Which older changes still deserve a migration check?

### Does the DOJ Data Security Program affect third-party and evidence architecture?

**It warrants a separate data-access assessment where the programme’s transaction and data conditions may apply.** DOJ’s programme prohibits or restricts specified transactions giving countries of concern or covered persons access to US government-related data or Americans’ bulk sensitive personal data. It became effective on **8 April 2025**. ([justice.gov](https://www.justice.gov/nsd/data-security))

DOJ’s updated FAQ identifies **6 October 2025** as the start of specified additional due-diligence, audit and reporting obligations. Annual reporting is not a universal requirement for every US business. ([justice.gov](https://justice.gov/nsd/media/1415006/dl))

**Recommended vendor-risk review:** assess data categories, access, ownership and relevant transaction facts—not just the supplier’s headquarters. Include implementation partners, support arrangements and AI subprocessors in the review where relevant. Avoid placing sensitive source material in a GRC repository before the access model is approved.

### Are control libraries carrying obsolete versions?

NIST issued **SP 800-53 Release 5.2.0 on 27 August 2025**, including changes concerning software updates, deployment and integrity, with corresponding assessment-procedure updates. This is a reason to check the actual catalogue and assessment version—not to assume that every customer contract automatically changed. ([csrc.nist.gov](https://csrc.nist.gov/news/2025/nist-releases-revision-to-sp-800-53-controls?utm_source=openai))

The IAF transition deadline for accredited ISO/IEC 27001 certification from the 2013 edition to the 2022 edition was **31 October 2025**. ([iaf.nu](https://iaf.nu/en/changes-in-the-scope-of-the-iaf-mla-during-2024-2025/?utm_source=openai))

**Recommended migration rule:** retain the version associated with historical assessments, certificates and evidence. Add the successor mapping with an approval trail. Never silently relabel a historical assessment as having tested a newer version.