Cybersecurity Deadlines
Cybersecurity Maturity Model Certification (CMMC) 2.0 for the U.S. Department of Defense (DoD) contracts
DEADLINE: Nov 10, 2025
APPLIES TO: The “48 CFR Acquisition Rule” becomes effective so new DoD solicitations start including CMMC requirements (handling FCI/CUI).
U.S. Securities and Exchange Commission (SEC) amended Regulation S P
DEADLINE: Dec 3, 2025
APPLIES TO: Large Firms. Requirements for registered investment advisers (RIAs) to adopt, implement, and maintain written policies and procedures to establish an incident response program with respect to unauthorized access to or use of customer information.
DEADLINE June 3, 2026
APPLIES TO: Small Firms. U.S. Securities and Exchange Commission (SEC) amended Regulation S P
Cybersecurity and Infrastructure Security Agency (CISA) cyber-incident reporting rule under Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)
DEADLINE: May 2026
APPLIES TO: Final rule requiring critical infrastructure owners/operators to report “covered cyber-incidents” and ransom payments within specified timeframes.
Revised California Consumer Privacy Act (CCPA) regulations (by the California Privacy Protection Agency)
DEADLINE: Jan 1, 2026
APPLIES: New requirements around cookie banners, opt-out signals (e.g., Global Privacy Control), privacy policy disclosures, and other consumer-data practices become effective.
