Sources

Official regulators, government records and standard-setting bodies support the regulatory conclusions below. Industry press, job-board and practitioner-media searches were used for discovery, not as legal authority. URLs are provided in code form; the inline citations provide source links.

California privacy and Colorado automated decision-making

• CPPA, completed rulemaking: https://cppa.ca.gov/regulations/ccpa_updates.html
• CPPA, approved regulations: https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf
• CPPA, finalisation announcement and staged dates: https://www.cppa.ca.gov/announcements/2025/20250923.html
• Colorado Attorney General, current rulemaking and status: https://coag.gov/ai/
• Colorado General Assembly, enacted SB26-189: https://leg.colorado.gov/bills/sb26-189

Financial services and banking

• NYDFS, cybersecurity resource centre: https://www.dfs.ny.gov/cybersecurity
• NYDFS, implementation timeline: https://www.dfs.ny.gov/industry_guidance/cybersecurity/implementation_timeline_covered_entities
• NYDFS, MFA guidance: https://www.dfs.ny.gov/system/files/documents/2025/09/multifactor-authentication.pdf
• SEC, Regulation S-P compliance guide: https://www.sec.gov/files/rules/final/2024/regulation-s-p-small-entity-compliance-guide.pdf
• Federal Reserve, SR 26-2: https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
• Federal Reserve, revised joint model-risk guidance: https://www.federalreserve.gov/frrs/guidance/supervisory-guidance-on-model-risk-management.htm
• OCC, proposed third-party guidance: https://occ.gov/news-issuances/bulletins/2026/bulletin-2026-46.html
• Federal Register, proposed third-party guidance: https://www.govinfo.gov/content/pkg/FR-2026-09-15/html/2026-18859.htm
• OCC, consultation dates: https://www.occ.gov/topics/laws-and-regulations/occ-regulations/proposed-issuances/occ-proposed-issuances-2026.html
• Agencies, joint third-party announcement: https://www.occ.gov/news-issuances/news-releases/2026/nr-ia-2026-77.html
• OCC, Cybersecurity Supervision Work Program update: https://www.occ.gov/news-issuances/bulletins/2026/bulletin-2026-48.html
• FDIC, FFIEC CAT sunset: https://www.fdic.gov/news/financial-institution-letters/2024/sunset-ffiec-cybersecurity-assessment-tool

Healthcare

• HHS, Part 2 overview: https://www.hhs.gov/hipaa/part-2/index.html
• HHS, Part 2 enforcement announcement: https://www.hhs.gov/press-room/hhs-announce-civil-enforcement-program-sud-patient-records.html
• HHS, Part 2 final-rule fact sheet: https://www.hhs.gov/hipaa/for-professionals/regulatory-initiatives/fact-sheet-42-cfr-part-2-final-rule/index.html
• HHS, HIPAA Security Rule proposal: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html
• HHS, proposal fact sheet: https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/factsheet/index.html
• HHS, current Security Rule summary: https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html
• Regulatory agenda, HIPAA proposal: https://mobile.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA22&pubId=202510
• HHS, HTI-5 announcement: https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html

Incident reporting, contracting and data access

• OIRA, CIRCIA pending review: https://www.reginfo.gov/public/do/eoDetails?rrid=1550967
• CISA, CIRCIA fact sheet: https://www.cisa.gov/sites/default/files/2023-01/CIRCIA_07.21.2022_Factsheet_FINAL_508%20c.pdf
• Official CMMC programme status: https://dodcio.defense.gov/cmmc/About/
• SBA Office of Advocacy, CMMC reform review: https://advocacy.sba.gov/2026/07/20/dow-requests-information-for-cmmc-reform-task-force/
• DOJ, Data Security Program: https://www.justice.gov/nsd/data-security
• DOJ, updated programme FAQs: https://justice.gov/nsd/media/1415006/dl

Climate reporting

• CARB, 12 October 2026 approval and deadline notice: https://content.govdelivery.com/accounts/CARB/bulletins/42ee5c1
• CARB, reporting resources: https://content.govdelivery.com/accounts/CARB/bulletins/427b576
• CARB, SB 261 enforcement status: https://ww2.arb.ca.gov/our-work/programs/corporate-ghg-reporting/climate-related-financial-risk

Professional standards and European AI requirements

• IIA, applicability and topical requirements: https://www.theiia.org/en/standards/2024-standards/topical-requirements/
• IIA, cybersecurity: https://www.theiia.org/en/standards/2024-standards/topical-requirements/cybersecurity
• IIA, third-party: https://www.theiia.org/en/standards/2024-standards/topical-requirements/third-party/
• IIA, organisational behaviour: https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-behavior/
• IIA, organisational resilience: https://www.theiia.org/en/standards/2024-standards/topical-requirements/organizational-resilience/
• European Commission, AI Omnibus entry into force: https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
• European Commission, AI Act implementation: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
• NIST, SP 800-53 Release 5.2.0: https://csrc.nist.gov/news/2025/nist-releases-revision-to-sp-800-53-controls
• IAF, ISO/IEC 27001 transition: https://iaf.nu/en/changes-in-the-scope-of-the-iaf-mla-during-2024-2025/