55
30
42
55
42
30
55
30
55
30
30
42
30
55
30
30
55
30
30
55
30
55
55
55
55
30
60
CMMC Hit Pause, the FAR Council Hit Play
DoD paused CMMC Phase 2 pending a 60-day review while a proposed FAR Council rule would extend NIST 800-171 Rev 3 to all federal contractors.
The Department of Defense suspended CMMC Phase 2 third-party certification requirements, but Phase 1 self-assessments under DFARS 252.204-7021 remain in force since November 2025, and prime contractors are still directing suppliers to proceed. A CMMC Reform Task Force must report recommendations to the DoD CIO within 60 days, likely by September or October 2026. Separately, the FAR Council's proposed CUI rule from June 23 would apply NIST 800-171 Revision 3, 72-hour incident reporting, and flowdown obligations to all FAR-based federal contracts, not just the defense industrial base. False Claims Act exposure grows as DIBCAC assessment teams now cooperate directly with the DOJ.
62
30
42
55
30
55
30
NYS DFS Issues New Cybersecurity Guidance on Risk Assessments for Financial Services Entities
New York DFS issued cybersecurity guidance defining expectations for risk assessments that regulated financial services entities must conduct.
On September 10, 2026, NYS DFS Acting Superintendent Kaitlin Asrow issued new cybersecurity guidance on conducting risk assessments sufficient to inform cybersecurity programs. The guidance covers scope, frequency, and the role of assessments for DFS-regulated financial services entities. It does not describe any incident or vulnerability, but sets regulatory compliance expectations under DFS cybersecurity rules.
22
UK's Online Safety Act has made 'absolutely no difference,' kids say
UK Children's Commissioner tells Lords committee the Online Safety Act has 'made absolutely no difference' and criticizes Ofcom over risk assessment transparency.
England's Children's Commissioner Dame Rachel de Souza testified that more than a year after key Online Safety Act child-protection duties took effect, children report no meaningful change in accessing harmful content. She criticized Ofcom for refusing to share companies' safety risk assessments under section 393(1) of the Communications Act 2003, and planned to use statutory powers to compel disclosure. She argued the OSA has not kept pace with AI-driven harms (citing the 'Grok nudifying' controversy) and urged Ofcom to 'use its teeth,' contrasting the UK's approach with Meta's proposed $18 billion US child-safety settlement.
40
55
55
42
55