Regulatory Landscape Shifts

CISA BOD 26-04 (three-day patching), $6B centralized cyber procurement RFI (Sept 1), EU CRA reporting (Sept 11) with ENISA guidance, Dutch NIS2 in force Aug 15, California CCPA cybersecurity audit requirements (Jan 2027). Industry groups push CISA to narrow CIRCIA rule, creating uncertainty. Microsoft mandates passkeys for Entra ID by Feb 2027. DORA compliance articles highlight identity governance gaps.