Cybersecurity Predictions for 2027

DigitalXForce makes 10 cybersecurity predictions for 2027. Control evidence becomes continuous, vendor security answers get a shelf life, incident clocks shrink to hours, AI governance becomes an inventory and AI agents are governed as identities. Boards ask for quantified trends, GRC and security posture share one control set, resilience joins the security review, encryption keys move into contracts and mid-sized suppliers meet enterprise expectations.

Each prediction below gives the claim in one sentence, the evidence with its source, what it means for a security or risk leader and what to do now. The evidence comes from regulators, standard bodies, universities, industry research and the DigitalXForce Security Posture Benchmark 2026, which scored the published security control answers of 2,112 companies. The page closes DigitalXForce's Cybersecurity Awareness Month 2026, and every source is listed at the end.

One thread runs through all ten. Several regulatory deadlines moved in 2026, some of them by more than a year, yet no regulator, auditor or board stopped asking for evidence. The predictions therefore follow what will be asked for rather than any single date.

Published by DigitalXForce on 27 October 2026.

1. Control evidence becomes continuous

DigitalXForce predicts that in 2027 auditors, regulators and boards will ask for proof that a control worked across the whole period, and a control attested once a year will count as the weakest evidence on the table.

The rules already point that way. California's approved regulations require every business whose processing of personal information presents significant risk to complete a cybersecurity audit. Those with 2026 revenue above $100 million must complete their first audit report by 1 April 2028, and the regulation's own example has that audit covering 1 January 2027 to 1 January 2028. The NACD's 2026 guidance for directors asks for cyber-risk reporting at least quarterly, with year-over-year trends that show improvement or deterioration. ISACA's February 2026 guide to its IT Audit Framework, ITAF 5, describes the move from periodic reviews to continuous insight and from sampling to data-driven testing. Forrester wrote in December 2025 that continuous monitoring of controls and risk quantification are moving GRC platforms from static checklists to real-time insight.

Self-reported answers cannot carry that weight on their own. In the DigitalXForce Security Posture Benchmark 2026, the median company score for answers dated in each year from 2021 to 2026 stayed between 98.4% and 99.2%. A published answer records whether a company considers a control in place on the day it answers, so it cannot show whether security got better or worse.

For a security or risk leader, the question in 2027 moves from whether a control exists to how often it was tested and what happened when it failed. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. CCM is a capability within CCA.

The audit stays, and the evidence behind it becomes a running record. The step to take now is to list the 10 controls behind most of your audit findings, test each one every month against system data and keep every result as evidence. Why point-in-time audits miss control failures explains the gap, and how to move from annual compliance to continuous governance sets out the sequence. DigitalXForce runs this model in its AI-Powered Risk Management and Automated GRC module, which tests controls continuously and maps each result once to 50+ compliance frameworks.

2. Vendor security answers get a shelf life

DigitalXForce predicts that in 2027 buyers will treat a vendor's security answers as perishable: every answer will carry a date, and critical vendors will be asked again once their answers are more than 12 months old.

Third parties now sit behind almost half of all breaches. Verizon's 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches, up 60% on the previous year's dataset, and only 23% of the third-party organizations it tracked fully fixed missing or improperly secured multifactor authentication on their cloud accounts. The 2026 KPMG Global Third-Party Risk Management Survey of 851 organizations found that only 15% of leaders have high confidence in the data behind their program.

The answers buyers rely on leave gaps. In the DigitalXForce Security Posture Benchmark 2026, 54.9% of 2,112 companies report at least one Data Protection and Encryption control not in place, and 47.9% of the 1,798 companies answering the question say customers cannot manage their own data encryption keys. A set of threat scenarios for 2027 to 2029, published in May 2026 by UC Berkeley's Center for Long-Term Cybersecurity, describes the limit of the paper trail: a supplier qualification process can confirm that a supplier passed an ISO/IEC 42001 audit, yet it cannot easily confirm that the system holds up against attacks nobody put in scope.

For a risk leader, a vendor file without dates stops being evidence. The assessment becomes a starting point that outside signals keep current between reviews.

The step to take now is to record the date of every critical vendor's latest security answers, ask again for any that are more than 12 months old and ask for independent evidence such as a SOC 2 Type 2 report. The 30 minute cloud vendor review sets out the steps. DigitalXForce's third-party risk management module scores each vendor from questionnaire, evidence and external signals, and the External Risk View watches exposed services, breach intelligence and fourth-party and nth-party relationships between reviews.

3. Incident clocks shrink to hours, and risk gets an operations center

DigitalXForce predicts that in 2027 more organizations will run risk the way they run security operations, with control failures triaged and escalated within hours, because the reporting clocks now demand it.

The clocks are already running. Since 11 September 2026, manufacturers of products with digital elements must send an early warning within 24 hours of becoming aware of an actively exploited vulnerability and a full notification within 72 hours, under the EU Cyber Resilience Act. From 18 March 2027, the Bank of England's Prudential Regulation Authority and the FCA apply one regime in which firms report operational incidents on a single form completed in three phases and keep a register of their material third-party arrangements. Under DORA, the European Supervisory Authorities published their list of designated critical ICT third-party providers on 18 November 2025, built from the registers of information that financial entities keep on their ICT contracts, and they now oversee those providers directly.

Attackers are moving faster as well. The UK's National Cyber Security Centre assessed in May 2025 that the time between disclosure and exploitation has shrunk to days and that AI will almost certainly reduce it further. Verizon's 2026 report found exploitation of vulnerabilities to be the most common way into a breach, at 31%, while organizations fully fixed only 26% of the critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog in 2025 and took a median of 43 days to do it.

For a CISO, a quarterly risk review cannot meet a 24 hour clock. A risk operations center works the way a security operations center does: it watches control and exposure signals continuously, decides what matters and escalates it with the evidence attached.

The step to take now is to write down, for each regulation you report under, the clock that starts at detection and the person who starts it, and then to test the path once in a tabletop exercise. X-ROC, the XForce Risk Operations Center, is DigitalXForce's implementation, with real-time risk alerting, triage and escalation. The article on how a risk operations center differs from a SOC compares the two models.

4. AI governance becomes an inventory with evidence

DigitalXForce predicts that in 2027 AI governance will be judged by an inventory: which AI systems an organization runs, who owns each one, which rules apply to it and when it was last tested.

The EU has fixed its date. Regulation (EU) 2026/1744, the Digital Omnibus on AI, entered into force on 27 July 2026, and the European Commission's AI Act timeline now applies the rules for high-risk AI systems in Annex III areas, including biometrics, critical infrastructure, education, employment, migration, asylum and border control, from 2 December 2027. The rules for high-risk AI embedded in regulated products follow on 2 August 2028.

Adoption has run ahead of governance. Stanford HAI's AI Index 2026 reports that 88% of surveyed organizations used AI in 2025 and that documented AI incidents rose to 362, up from 233 in 2024. IBM's Cost of a Data Breach Report 2025 found that 63% of the breached organizations it studied lacked AI governance policies. The gap is closing: the World Economic Forum's Global Cybersecurity Outlook 2026 found that 64% of organizations now assess the security of AI tools before deploying them, up from 37% a year earlier, and the AI Index found ISO/IEC 42001 cited by 36% of respondents and the NIST AI Risk Management Framework by 33%.

The largest AI markets are moving the same way. The AI Index records that one of the most advanced AI markets finalized mandatory labeling rules for AI-generated and synthetic content in 2025, and that the largest year-over-year increases in organizational use of generative AI came in Europe and that same market. The EU's own transparency rules under Article 50 of the AI Act have applied since 2 August 2026, and US state legislatures passed 150 AI-related bills into law in 2025, up from fewer than 10 in 2020.

For a CISO or a chief AI officer, an AI policy without an inventory will not survive an audit in 2027. The inventory has to include the AI inside vendors' products, because that is where much of it arrives.

The step to take now is to build the inventory before the policy: list every model, copilot, agent and AI feature in use, including those inside vendor products, give each one an owner and map each to the EU AI Act risk categories and the NIST AI RMF. The AI Readiness Check takes 3 questions, and the workplace policy for public AI tools covers the tools employees already use. DigitalXForce's AI TRiSCM and AI Risk Governance module discovers AI assets across cloud, code, pipelines, containers, model endpoints and RAG stores and maps them to the NIST AI RMF, ISO/IEC 42001, the EU AI Act, the OWASP LLM Top 10 and MITRE ATLAS.

5. AI agents are governed as identities

DigitalXForce predicts that in 2027 every AI agent with access to company systems will be governed like a privileged identity, with an owner, a defined scope, logged actions and a way to stop it.

Agents are still early, which makes this the right time to set the rules. Stanford's AI Index 2026 found AI agent deployment in the single digits across nearly all business functions, and Forrester expects agentic use cases in GRC platforms to emerge over the 18 to 24 months from December 2025. The NCSC assessed that AI connected to company systems, data and operational technology almost certainly gives attackers a larger attack surface, including through prompt injection.

Unmanaged use is already common. Verizon's 2026 report found that 45% of employees now use AI regularly on corporate devices, up from 15% a year earlier, and that 67% of users reach AI services through non-corporate accounts on those devices. Among the organizations that reported AI-related breaches in IBM's 2025 study, 97% said they lacked proper AI access controls.

For a security leader, the useful question about an agent is what it can touch. An agent that can read a mailbox, call an API and approve a payment carries the risk of all three, and it acts faster than the person reviewing it.

The step to take now is to give every agent its own identity rather than a shared service account, scope its permissions to its task, log what it does and name the person who can switch it off. DigitalXForce's AI TRiSCM module assesses LLMs, copilots, agents and models, and ESRPM checks identity and access configurations across the security stack through 250+ technology integrations. DigitalXForce does not replace an identity provider or a privileged access management tool, and it relies on them for the controls it tests. The article on whether AI will replace cybersecurity teams sets out which decisions stay with people.

6. Boards ask for quantified trends rather than heat maps

DigitalXForce predicts that in 2027 boards will expect cyber risk to be reported every quarter in financial terms and as a trend, and a static heat map will stop being an acceptable board paper.

Directors are being told to ask for exactly that. The NACD's 2026 guidance on cybersecurity risk measurement and reporting encourages standard risk quantification models that translate technical metrics into probable financial loss, reporting at least quarterly and year-over-year trends that show improvement or deterioration. The stakes are measured in money: IBM's Cost of a Data Breach Report 2026 puts the global average cost of a breach at $4.99 million, 12% more than the year before.

A self-reported score cannot show a trend. The median score in the DigitalXForce Security Posture Benchmark 2026 is 98.9%, 26.7% of companies report every control in place, and the median has stayed within about 1 percentage point for six years. A number that sits near 100% for almost everyone cannot tell a board whether its own organization improved.

For a CISO, the board paper of 2027 has three parts: the exposure in money, the direction of travel and the decisions needed. Each part needs evidence that changes when the environment changes.

The step to take now is to pick 3 risk scenarios, estimate each in financial terms and report the same measures every quarter, so that the trend becomes visible. The article on how CISOs speak the language of the board shows the format.

Digital Trust translates connected assurance and risk evidence into an enterprise-level view for decision-makers. The Digital Trust Score is DigitalXForce's composite score from 300 to 850, computed continuously from live control evidence across seven sub-postures: security, compliance, audit, resilience, third-party, AI and risk. AI JedAI analyzes the evidence behind it, XForce GPT writes the board-ready report, and the Cyber Risk and Liability Insurance module turns the same posture data into the inputs insurers ask for.

7. GRC and security posture share one control set

DigitalXForce predicts that in 2027 more organizations will run governance, risk, compliance and security posture on one set of controls, tested once and reported to every framework, because obligations are growing faster than teams.

The obligations keep multiplying. US state legislatures alone passed 150 AI-related bills into law in 2025, according to Stanford's AI Index 2026, and MIT's AI Risk Initiative reported in April 2026 that it had classified more than 1,000 AI governance documents. In the EU, the Commission proposed targeted amendments to NIS2 on 20 January 2026, while the Cyber Resilience Act and the AI Act add their own dates in 2027.

Programs are not yet joined up. The 2026 KPMG survey found that only 18% of third-party risk programs are fully integrated with enterprise risk management. Forrester's assessment in December 2025 was that GRC platforms have matured into integrated systems, yet many programs still struggle to get full business value from them.

For a head of risk or compliance, a separate tool for each framework means the same control is tested several times and reported several ways. DigitalXForce calls the alternative TRiSCM™. TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance. Enterprise TRiSCM connects control assurance to Trust, Risk, Security and Compliance across the enterprise.

The step to take now is to list the frameworks you report against, find the controls that appear in most of them and give each of those controls one owner across compliance, risk and security. The guide to moving GRC from spreadsheets to an automated platform covers the move, and What is TRiSCM sets out the model. DigitalXForce maps each control once to 50+ compliance frameworks and reads its evidence through 250+ technology integrations, and the platform is built on a Cybersecurity Mesh Architecture.

8. Resilience evidence joins the security review

DigitalXForce predicts that in 2027 buyers will ask vendors for their recovery objectives and the date of their last recovery test alongside their security answers.

Regulators have tied resilience to third parties. The UK regime for operational incident and third-party reporting applies from 18 March 2027, and DORA's oversight framework for critical ICT third-party providers took a formal step with the designations of 18 November 2025. The World Economic Forum's Global Cybersecurity Outlook 2026 found that 78% of the CEOs of highly resilient organizations name third-party and supply chain vulnerabilities as their greatest challenge to becoming cyber resilient.

The published answers show the gap. In the DigitalXForce Security Posture Benchmark 2026, 33.5% of companies report at least one control in the Resilience and Business Continuity domain not in place.

For a risk leader, a vendor that keeps data safe but cannot restore a service quickly can still stop yours. Recovery evidence belongs in the same file as security evidence.

The step to take now is to ask each vendor behind an important service for its recovery time and recovery point objectives for that service and the date it last tested them, and then to add the vendor to your own business impact analysis. The article on how quickly a business should recover from a major IT outage sets out the targets, and the security policy and plan review checklist covers the plans. DigitalXForce's X-BCOR module ties business continuity and disaster recovery planning to live control coverage and supports DORA alignment.

9. Encryption keys move into the contract

DigitalXForce predicts that in 2027 customer control of encryption keys will become a standard term in cloud contracts for regulated data, and cryptography will be managed as an inventoried asset.

The benchmark shows where the gap sits. In the DigitalXForce Security Posture Benchmark 2026, 47.9% of the 1,798 companies that answered the question say customers cannot manage their own data encryption keys, the most common no answer among the controls it lists. Data Protection and Encryption is the weakest DigitalXForce domain, with 54.9% of companies reporting at least one control not in place, and companies with more than 5,000 employees report an encryption and key management gap at 29.5%, against 49.8% to 55.6% of smaller companies.

Cryptography itself is due for change. NIST published the initial public draft of IR 8547, Transition to Post-Quantum Cryptography Standards, on 12 November 2024, describing its expected approach to moving away from quantum-vulnerable algorithms.

For a CISO, whoever holds the keys decides who can read the data if a provider is compelled or compromised. That makes key custody a contract question as much as a technical one.

The step to take now is to ask every cloud vendor that holds regulated data whether you can bring or hold your own keys and what happens to them at exit, and then to write the answer into the contract. DigitalXForce's ESRPM module evaluates cloud account configurations directly, and its third-party risk management module tracks each vendor's answer through review and reassessment. DigitalXForce does not replace a cryptographic discovery tool that finds every certificate and algorithm in code and firmware.

10. Mid-sized suppliers meet enterprise expectations

DigitalXForce predicts that in 2027 mid-sized suppliers will be asked for the same dated, independent evidence as their largest customers, and the gap between organizations that keep pace and those that do not will widen.

The NCSC assessed that there will almost certainly be a digital divide between systems that keep pace with AI-enabled threats and a large proportion that are more vulnerable. The benchmark shows the same split in one domain, since companies with more than 5,000 employees report an encryption and key management gap at 29.5%, against 49.8% to 55.6% of smaller companies. The cost of proving compliance has become a policy question too: on 13 July 2026 the US Department of War suspended Phase II of its CMMC program, which had been due to start on 10 November 2026, and the Small Business Administration welcomed the step on behalf of small defense contractors.

For a supplier with a small security team, the requests will arrive from several customers at once, each in its own format.

The step to take now is to keep one current evidence pack with dates, an independent report where one exists and your recovery objectives, and to send it before customers ask. A small team with a few customers can do this with a shared folder and a named owner. For teams that have outgrown that, DigitalXForce Lite is the full platform hosted in the cloud for any organization that prefers cloud hosting, with the same functionality and a faster deployment.

The 2027 regulatory calendar

The dates below were read at each regulator's own page on 25 September 2026. Dates move, as the EU AI Act and CMMC both showed in 2026, so check each one at its source before planning around it.

What others expect for 2027

DigitalXForce's view sits alongside what regulators, analysts, universities and industry bodies have published. The table shows each view and where DigitalXForce stands on it.

How DigitalXForce's earlier predictions held up

DigitalXForce has not published a predictions page before. The company has published forward-looking posts, and three of them can be checked against what happened.

In January 2024, the post Shaping the Future of Cybersecurity with Digital Trust made a prediction for 2024 and beyond, and two parts of it held. It said trust by design would take hold, and the EU Cyber Resilience Act, which sets security requirements for products with digital elements, entered into force on 10 December 2024 with reporting duties from 11 September 2026. It said organizations would need to demonstrate their trustworthiness regularly, and regulators now ask for that, from DORA's direct oversight of critical ICT providers to the UK reporting regime of March 2027. Two other parts cannot be scored. The post expected cross-industry coalitions to standardize identity and consent for connected devices, and this review found no measure of whether that happened. It also said cybersecurity would move from barrier to enabler, which is too broad to test, and DigitalXForce would not phrase a prediction that way again.

In August 2025, the post on modernizing a TPRM program that is still stuck in 2015 cited Verizon's finding that nearly 30% of breaches involved a third party, double the year before. The trend continued, and Verizon's 2026 report puts the share at 48%.

In May 2026, DigitalXForce warned of an AI cyber tsunami in which attacks would increasingly operate at machine speed. Four months is too short to score that prediction. The evidence available at the time already pointed the same way, since Verizon's 2026 report had found exploitation of vulnerabilities to be the most common way into a breach.

The industry's expectations for 2026 carry a lesson of their own. The EU AI Act's high-risk rules were expected on 2 August 2026 and now apply from 2 December 2027. CMMC Phase II was due on 10 November 2026 and was suspended on 13 July 2026. CISA has not yet issued the final rule under CIRCIA, so its 72 hour reporting duty is not in force. On 8 July 2026, the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose NIS2. The dates slipped while the demand for evidence held, which is why the predictions on this page follow the evidence rather than a deadline.

Where these predictions stop

None of the 10 steps above needs a platform to start. Each one works with a spreadsheet, dated evidence and a named owner, and a small team with a few vendors can stop there. DigitalXForce is built for the point where evidence has to be collected continuously across many systems, vendors and frameworks. It does not replace an identity provider, a privileged access management tool or a cryptographic discovery tool, and it relies on them for the controls it tests.

Questions about the 2027 predictions

What are the cybersecurity predictions for 2027?

DigitalXForce predicts that in 2027 control evidence becomes continuous, vendor security answers get a shelf life and incident clocks shrink to hours. It also predicts that AI governance becomes an inventory, AI agents are governed as identities, boards ask for quantified trends and GRC and security posture share one control set. The last three predictions are that resilience joins the security review, encryption keys move into contracts and mid-sized suppliers meet enterprise expectations.

When do the EU AI Act rules for high-risk AI systems apply?

The rules for high-risk AI systems in Annex III areas, such as biometrics, critical infrastructure, education and employment, apply from 2 December 2027. The rules for high-risk AI embedded in regulated products apply from 2 August 2028. Both dates were set by Regulation (EU) 2026/1744, the Digital Omnibus on AI, which entered into force on 27 July 2026.

Which cybersecurity regulations take effect in 2027?

The main obligations of the EU Cyber Resilience Act apply from 11 December 2027, and the EU AI Act rules for high-risk AI in Annex III areas apply from 2 December 2027. The UK regime for operational incident and third-party reporting applies from 18 March 2027, and California's rules on automated decisionmaking technology apply from 1 January 2027. The calendar on this page lists each date with its source.

Will continuous control monitoring replace audits?

Audits will remain, and the evidence behind them will become continuous. Continuous Control Monitoring (CCM) monitors conditions, evidence and signals associated with controls. It is a capability within Continuous Control Assurance (CCA). ISACA's ITAF 5 guidance describes the same move from periodic reviews to continuous insight.

What share of data breaches involve a third party?

Verizon's 2026 Data Breach Investigations Report found third-party involvement in 48% of breaches, up 60% on the previous year's dataset. The report covers more than 22,000 confirmed breaches in 145 countries between October 2024 and November 2025.

How should boards receive cyber risk reports in 2027?

The NACD's 2026 guidance asks for cyber-risk reports at least quarterly, in financial and operational terms, with year-over-year trends that show improvement or deterioration. A board paper built that way states the exposure in money, the direction of travel and the decisions needed.

Which security domain do companies most often report a gap in?

Data Protection and Encryption. DigitalXForce measures security posture across twelve domains using the CSA STAR Registry. In the DigitalXForce Security Posture Benchmark 2026, 54.9% of 2,112 companies reported at least one control in that domain not in place on 26 August 2026.

What is TRiSCM?

TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance. The page What is TRiSCM explains it in full.

Sources

Every source below was read at its publisher's own page on 25 September 2026. Vendor and consultancy research is marked as such.

1. Verizon's 2026 Data Breach Investigations Report, Executive Summary (2026, vendor research) is the source of the third-party, vulnerability and AI use figures.
2. IBM and the Ponemon Institute published the Cost of a Data Breach Report 2026 (2026, vendor research), the source of the $4.99 million average breach cost.
3. IBM's article What data leaders need to know from the Cost of a Data Breach Report 2025 (12 November 2025, vendor research) is the source of the AI governance and AI access control figures.
4. The World Economic Forum published the Global Cybersecurity Outlook 2026 with Accenture in January 2026.
5. Stanford HAI published The 2026 AI Index Report in April 2026, and its Economy and Responsible AI chapters carry the adoption, incident and framework figures.
6. Chapter 8 of the AI Index, Policy and Governance (April 2026), records the AI content labeling rules and the 150 US state AI laws of 2025.
7. The MIT AI Risk Initiative reported its classification of more than 1,000 AI governance documents in an April 2026 update.
8. UC Berkeley's Center for Long-Term Cybersecurity published AIxCyber Threat Scenarios: 2027-2029 by Nada Madkour in May 2026.
9. The UK National Cyber Security Centre published Impact of AI on cyber threat from now to 2027 on 7 May 2025.
10. Forrester published GRC Platforms Enter Their Grad School Era on 2 December 2025 (analyst research).
11. ISACA published Why ITAF 5 Matters: Six Big Shifts Transforming IT Audit and Assurance by Mary Carmichael on 26 February 2026.
12. The NACD published Guide Cybersecurity Risk Measurement and Reporting, Principle 5 of its Director's Handbook on Cyber-Risk Oversight, in April 2026.
13. KPMG published The 2026 KPMG Global Third-Party Risk Management Survey of 851 organizations in 2026 (consultancy research).
14. The European Commission's AI Act page and the AI Act Service Desk's implementation timeline give the AI Act dates as amended.
15. EUR-Lex publishes Regulation (EU) 2026/1744 of 8 July 2026, the Digital Omnibus on AI.
16. The European Commission's Cyber Resilience Act page and its news item Safer and more secure digital products of 11 September 2026 give the CRA dates and reporting clocks.
17. The European Commission's NIS2 Directive page and NIS2 questions and answers give the 2026 amendments, the referrals and the 2027 review date.
18. The European Banking Authority announced that the European Supervisory Authorities designate critical ICT third-party providers under DORA on 18 November 2025.
19. The Bank of England published PS7/26, Operational resilience: operational incident and third-party reporting on 18 March 2026, alongside the FCA's PS26/2.
20. The California Privacy Protection Agency publishes the approved regulations on cybersecurity audits, risk assessments and automated decisionmaking technology, approved on 22 September 2025 and effective from 1 January 2026.
21. The Press Information Bureau of the Government of India announced that the DPDP Rules, 2025 were notified on 14 November 2025.
22. The US Small Business Administration published SBA Commends U.S. Department of War's Suspension of CMMC Phase II for Small Defense Contractors on 13 July 2026.
23. CISA's CIRCIA page gives the status of the final rule.
24. NIST published IR 8547 (Initial Public Draft), Transition to Post-Quantum Cryptography Standards on 12 November 2024.
25. DigitalXForce published the DigitalXForce Security Posture Benchmark 2026 on 15 October 2026, from CSA STAR Registry data retrieved on 26 August 2026.

This page was last reviewed against every source above on 25 September 2026. DigitalXForce reviews it again in January 2027 and whenever a date in the calendar moves.

Benchmark your own posture

The figures on this page are population statistics. To see where your organization or your vendors sit against them, domain by domain, DigitalXForce runs the same scoring on your own evidence. The walkthrough takes 30 minutes and uses your data, not sample data.

Request a demo