How should US regulatory change influence the roadmap?

Use configurable obligation management rather than coding assumptions about unfinished proposals into the platform. The proposed interagency third-party guidance emphasises proportionate risk management; the OCC says it would not create enforceable standards. HHS’s Security Rule proposal page likewise does not establish a new final-rule compliance deadline. Neither source supports assuming a compulsory Q1 2027 GRC-platform replacement. (occ.gov)

For existing requirements, the September NYDFS guidance offers a more immediate evaluation question: can the organisation preserve a repeatable assessment methodology and show the reasoning behind its conclusions? The guidance expressly says it creates no new obligations. (dfs.ny.gov)

Recommended obligation-register fields: source, legal entity, applicability owner, status, effective date where established, review date, linked controls and approved interpretation. Keep “proposed”, “final”, “guidance” and “internal policy” distinct.