News and deadlines
Upcoming dates to note (entry into force, application, transposition deadlines) and the documents added to the database week by week.
Get the updates
- RSS feed of the weekly digest (every Sunday)
- RSS feed of new documents
- Deadline calendar (iCal):
https://www.cybersecuritydatabase.org/en/deadlines.ics
Add the calendar address to Google Calendar, Outlook or Apple Calendar as a subscribed calendar: new deadlines will appear on their own.
Upcoming deadlines
As of 30 October 2026. Dates without a day give the month or year of the deadline; the official source always prevails.
- Basic security measures set by ACN apply (entities listed in April 2025)
Legislative Decree 138/2024 – NIS 2 transposition · Italy - Deadline for adopting implementing regulations (12 months)
Law on Information Security (Serbia, 2025) · Serbia - Part 3C on entities of special cybersecurity interest takes effect
Cybersecurity Act 2018 · Singapore - Late NIS declarations for 2026 can no longer be filed
ACN Determination 314287/2026 – NIS registration and platform · Italy - The amendments made by Legislative Decree 191/2026 on managed security services apply
Legislative Decree 123/2022 – Cybersecurity certification · Italy - Deadline to bring infrastructure, policies and contingency plans into line and to send the CNC the disaster recovery plan compliance report, with the alternate site, an initial failover test and RTO/RPO values
CNC Provision 1/2026 – Contingency plans and backup sites · Argentina - Provisions on consent managers take effect (section 6(9) and section 27(1)(d))
Digital Personal Data Protection Act 2023 (DPDP) · India - Rule 4 on the registration and obligations of consent managers takes effect
Digital Personal Data Protection Rules 2025 (DPDP) · India - Deadline for adopting the new National Cybersecurity Strategy
Amendment to the Cybersecurity Act (2026) · Bulgaria - Deadline for the national minimum cybersecurity standards and for the regulations on incident management and reporting, classification of essential services and critical digital infrastructure, and ethical hacking
Organic Law for the Strengthening of Cybersecurity · Ecuador - The law starts to apply to municipalities (first-level local authorities), after a one-year postponement
Law 5160/2024 transposing NIS 2 · Greece - Deadline for comments on the draft of Revision 4
Guide to Operational Technology (OT) Security (NIST SP 800-82 Rev. 3) · United States - First key actions: structured access to advanced AI, testing platform, open source campaign, Grand Challenge
EU Action Plan on Cybersecurity and AI (2026) · European Union - New prohibitions under Regulation (EU) 2026/1744 and content marking for generative systems already on the market
AI Act (Regulation (EU) 2024/1689) · European Union - Member States strive to ensure a sufficient number of notified bodies
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - The law expires unless Congress extends or renews it again
Cybersecurity Information Sharing Act (CISA 2015) · United States - Deadline for risk-management measures by all essential and important entities and for aligning domain name registration databases
Information Security Act (ZInfV-1) · Slovenia - Deadline for the proposed amendment to the Federal Acquisition Regulation (FAR) requiring contractors to comply with FIPS, including the post-quantum standards, by 2030
Executive Order 14412 on post-quantum cryptography · United States - Each Member State must provide at least one European Digital Identity Wallet
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - Exercise scenario template for entity and Member State exercises (then every three years)
Network code on electricity cybersecurity (NCCS) · European Union - First steps completed and national post-quantum cryptography roadmaps in all Member States
EU roadmap for post-quantum cryptography (2025) · European Union - End of the transitional period for operators already registered: security measures and audits under the previous rules and NBÚ review of their classification
Act No. 69/2018 Coll. on Cybersecurity · Slovakia - Last day for signature at United Nations Headquarters in New York
United Nations Convention against Cybercrime · United Nations - Deadline set by the strategy for decisions on the national cybersecurity architecture
Cybersecurity Strategy 2024-2030 "Cyber-conscious Estonia" · Estonia - EU evaluation capacity for AI models, including cybersecurity
EU Action Plan on Cybersecurity and AI (2026) · European Union - Nuclear facility operators come within the scope of the act, supervised by STUK (Act 785/2026)
Cybersecurity Act · Finland - Entities added to the NIS list in 2026: the obligation to notify significant incidents starts (ACN Determination 127434/2026)
ACN Determination 379907/2025 – Basic NIS security measures and incident notification · Italy - The Information Security Office starts work and takes over the national CERT from RATEL
Law on Information Security (Serbia, 2025) · Serbia - Automated decision-making technology (ADMT) requirements for significant decisions apply
California Consumer Privacy Act of 2018 (CCPA) · United States - Browsers must let consumers send an opt-out preference signal against the sale and sharing of their data (section 1798.136, added by AB 566)
California Consumer Privacy Act of 2018 (CCPA) · United States - The FedRAMP Consolidated Rules for 2026 become mandatory for all stakeholders
FedRAMP Authorization Act (2022) · United States - Final deadline for the initial registration of essential and important entities
NISG 2026 (Austrian NIS 2 Act) · Austria - Deadline for the Council of Ministers to adopt the national risk assessment and the national strategy on the resilience of critical entities
Amendment to the Crisis Management Act (CER, 2026) · Poland - Date set by the order from which agencies must require the U.S. Cyber Trust Mark on the consumer IoT products they buy (through an amendment to the Federal Acquisition Regulation)
Executive Order 14306 on cybersecurity (2025) · United States - First biennial Commission report on implementation
Cybersecurity of EU institutions (2023/2841) · European Union - The regulation applies for the most part; Machinery Directive 2006/42/EC is repealed
Machinery Regulation (EU) 2023/1230 · European Union - First Commission evaluation of the regulation (then at least every four years)
Cyber Solidarity Act (Regulation (EU) 2025/38) · European Union - Deadline for annual registration on the ACN platform (window opens 1 January); entities already listed with no changes do not file again
Legislative Decree 138/2024 – NIS 2 transposition · Italy - Deadline for CISA guidance on the minimum elements of a cryptographic bill of materials (CBOM) and for the FAR proposal on vulnerability disclosure programmes
Executive Order 14412 on post-quantum cryptography · United States - Code of practice deadline for a set of security measures (Tier 1 and 2 providers)
Telecommunications (Security) Act 2021 · United Kingdom - Six-month deadline to declare important computer systems already in use at entry into force
Active Cyber Defense Act (2025) · Japan - Critical information infrastructure owners submit quantum-safe migration plans to the CSA
Singapore's Cybersecurity Strategy 2026 · Singapore - Deadline for operators to adopt the security act and the incident response plan (18 months)
Law on Information Security (Serbia, 2025) · Serbia - Article 45-5 and the related administrative fine introduced by Act No. 21500 take effect
Korea's Information and Communications Network Act · South Korea - Common procedural rules for cross-border cases apply (Regulation (EU) 2025/2518)
GDPR (Regulation (EU) 2016/679) · European Union - Deadline for the Chapter 3 obligations (security measures and incident handling) and for using the national S46 system
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - End of the 12 months during which entities may request exemption from fines for not yet having adapted to the new regime
DL 125/2025 – Legal framework for cybersecurity · Portugal - Deadline for the first identification of critical entities and their entry in the list
Amendment to the Crisis Management Act (CER, 2026) · Poland - First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission
NIS 2 Directive (EU) 2022/2555 · European Union - Substantive obligations apply: consent and notice, security safeguards, breach notification, data principals' rights and penalties
Digital Personal Data Protection Act 2023 (DPDP) · India - Rules 3, 5-16, 22 and 23 take effect: notice, security safeguards, 72-hour breach reporting, children, Significant Data Fiduciaries and transfers abroad
Digital Personal Data Protection Rules 2025 (DPDP) · India - Section 43A on compensation for failure to protect data is omitted and replaced by the Digital Personal Data Protection Act (section 44(2) of the DPDP Act)
India's Information Technology Act, 2000 · India - Deadline for the first National Catalogue of essential services and critical digital infrastructure, for setting up the national CSIRT and for the regulations on digital service providers and technical oversight
Organic Law for the Strengthening of Cybersecurity · Ecuador - Deadline for the annual update of information on the ACN platform (window opens 15 April)
ACN Determination 314287/2026 – NIS registration and platform · Italy - End of the 12-month grace period for the first enhanced requirements (additional material risks and part of the cyber and personnel requirements)
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - EU-CyCLONe agrees a common taxonomy of incident severity levels (within 24 months)
EU Cyber Blueprint for crisis management (2025) · European Union - Deadline for ISO/IEC 27001 certification of key entities (30 months)
Law on Information Security (Montenegro, 2024) · Montenegro - The twelve months given to critical infrastructure owners to comply with the Regulations expire
CII Designation Regulations 2026 (Mauritius) · Mauritius - FedRAMP stops accepting applications for new Rev5 certifications
FedRAMP Authorization Act (2022) · United States - Critical entities in the public administration sector must meet their obligations
S.I. 559/2024 on critical entities (CER) · Ireland - Deadline for submitting the categorised list of activities and services (window opens 1 May)
ACN Determination 314287/2026 – NIS registration and platform · Italy - Two-year deadline to align the laws on trust services, electronic services, the population register, electronic communications and energy
NIS Law of North Macedonia (2025) · North Macedonia - End of the 12-month transition: information systems already classified must bring their protection measures up to the level required by the new law, and security products and services already in use must meet its conditions
Viet Nam's Law on Cybersecurity 2025 (116/2025/QH15) · Viet Nam - Amendments to Article 32-2(1) (data protection certification) and Article 75 introduced by Act No. 21445 take effect
Personal Information Protection Act (South Korea) · South Korea - Deadline for adopting the first national risk management plan
Amendment to the Crisis Management Act (CER, 2026) · Poland - Commission report on Member States' transposition measures
CER Directive (EU) 2022/2557 · European Union - Entities added to the NIS list in 2026: deadline to adopt the basic security measures (ACN Determination 127434/2026)
ACN Determination 379907/2025 – Basic NIS security measures and incident notification · Italy - 24-month deadline to bring cloud services already in use into line with the decree
Decree 2-24-921 on cloud services (Morocco) · Morocco - National AI regulatory sandboxes operational; compliance of general-purpose models placed on the market before August 2025
AI Act (Regulation (EU) 2024/1689) · European Union - Latest date for Chapters 3-7 on acquiring and analysing communications information to take effect (exact date set by Cabinet Order)
Active Cyber Defense Act (2025) · Japan - By end 2027 all home routers sold in Singapore must attain at least Level 2 of the Cybersecurity Labelling Scheme
Singapore's Cybersecurity Strategy 2026 · Singapore - High-risk systems under Annex III (date postponed by the Digital Omnibus)
AI Act (Regulation (EU) 2024/1689) · European Union - Conformity procedures for important and critical products apply as the CRA applies in full
CRA: important and critical products (Reg. 2025/2392) · European Union - Repealed by Delegated Regulation (EU) 2026/339: the Cyber Resilience Act takes over
RED Delegated Regulation (EU) 2022/30 · European Union - SZTFH market surveillance and the administrative fines for the CRA apply
Act CXXXV of 2025 (CRA implementation) · Hungary - Rules on market surveillance, the coordinating CSIRT, CE marking and administrative penalties apply
CRA implementing regulations (S.L. 591.06) · Malta - EU: mandatory for new L-category vehicle types (Delegated Regulation (EU) 2025/1455)
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - Review of the policy by the ATDT, due two years after entry into force
General Cybersecurity Policy for the APF (2025) · Mexico - Statutory sunset of sections 3607-3616 of Title 44 (unless extended)
FedRAMP Authorization Act (2022) · United States - Private relying parties required to use strong authentication must accept the wallet at the user's request
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - Deadline for bodies with permanent crisis tasks, including local authorities, to bring risk analyses and crisis plans into line with the new act
Crisis Situations and National Defence Act · Estonia - Last day to issue EUCC certificates based on earlier versions of the Common Criteria
EUCC certification scheme (Reg. 2024/482) · European Union - Deadline to remove Huawei equipment from 5G networks (designated vendor direction)
Telecommunications (Security) Act 2021 · United Kingdom - Deadline to complete risk assessments for processing activities started before 2026 that are still ongoing
California Consumer Privacy Act of 2018 (CCPA) · United States - Completion of NIST's post-quantum migration pilot on its own systems
Executive Order 14412 on post-quantum cryptography · United States - Critical information infrastructure owners factor quantum-safe considerations into the procurement and implementation of new systems
Singapore's Cybersecurity Strategy 2026 · Singapore - Deadline for Tier 3 certification of the backup data centre
CNC Provision 1/2026 – Contingency plans and backup sites · Argentina - Minister's report to Parliament on the implementation review of the act
Cybersecurity Act (Cbw) · Netherlands - Deadline for the most complex measures and the first new measures of the revised code
Telecommunications (Security) Act 2021 · United Kingdom - First cybersecurity audit certifications (businesses with revenue above USD 100 million) and risk assessment attestations due
California Consumer Privacy Act of 2018 (CCPA) · United States - Deadline for the first audit of essential entities; financial penalties can be imposed from this date
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - End of the 24-month grace period for the other enhanced requirements: cyber and information security, credential compromise, lateral movement, personnel, supply chain and physical security
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Deadline for OMB guidance (including the revision of Circular A-130) on critical risks and modern architectures for federal systems
Executive Order 14306 on cybersecurity (2025) · United States - EU-type examination certificates issued on cybersecurity under other EU legislation expire
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Final deadline for notifying entities that they are high-impact or critical-impact entities
Network code on electricity cybersecurity (NCCS) · European Union - Obligations on cybersecurity measures (Articles 27-30 and 33 of the regime) and the related fines take effect
DL 125/2025 – Legal framework for cybersecurity · Portugal - The Legal Framework's obligations on cybersecurity measures and the related fines take effect, 24 months after the regulation's publication
CNCS Regulation 756/2026 (NIS 2 implementation) · Portugal - First report of the single points of contact on incident notifications (then every two years)
CER Directive (EU) 2022/2557 · European Union - First summary report by the single point of contact to the European Commission on notified incidents (then every two years)
Legislative Decree 134/2024 – CER transposition · Italy - First Commission evaluation and review report (then every four years)
Machinery Regulation (EU) 2023/1230 · European Union - High-risk systems under Annex I (date postponed by the Digital Omnibus)
AI Act (Regulation (EU) 2024/1689) · European Union - Deadline for the requirements on high-risk AI systems added by delegated acts to apply
Machinery Regulation (EU) 2023/1230 · European Union - Deadline for members of management bodies to have cybersecurity knowledge and skills
Cybersecurity Act (Cbw) · Netherlands - 01 series of amendments: Contracting Parties are no longer obliged to accept new approvals under the original version
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - Commission report on the effectiveness of the single reporting platform
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Deadline to deliver the 19 actions and 64 initiatives of Horizon 2
Australian cyber Horizon 2 Action Plan (2026-2028) · Australia - Deadline for a second set of new measures in the revised code of practice
Telecommunications (Security) Act 2021 · United Kingdom - Deadline for entities already in scope to comply with all requirements of the act and its implementing regulations (three years)
Amendment to the Cybersecurity Act (NIS 2, 2025) · Estonia - Expected entry into force of mandatory cybersecurity measures for maritime single windows (FAL Convention amendments)
Resolution MSC.428(98) – Maritime cyber risk management in safety… · International Maritime Organization (IMO) - Commission evaluation of the functioning of the regulation
Cybersecurity of EU institutions (2023/2841) · European Union - Cybersecurity audit certifications due for businesses with revenue between USD 50 and 100 million
California Consumer Privacy Act of 2018 (CCPA) · United States - First review of the recommendation by the Commission (at least every four years)
EU Cyber Blueprint for crisis management (2025) · European Union - EU: mandatory also for existing L-category vehicle types
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - First Commission review report on the functioning of the Directive
CER Directive (EU) 2022/2557 · European Union - Next five-yearly Commission evaluation of ENISA and the certification framework
Cybersecurity Act (Regulation (EU) 2019/881) · European Union - EU: mandatory for the registration of new completed vehicles (built in several stages)
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - End of validity of documentation prepared under the previous version of the standard (three years after entry into force)
Estonian Information Security Standard (E-ITS) · Estonia - First five-yearly review of the strategy required under NIS 2 (indicative date)
Finland's Cyber Security Strategy 2024-2035 · Finland - First regional cybersecurity exercises (then every three years)
Network code on electricity cybersecurity (NCCS) · European Union - Deadline for the last set of new measures in the revised code of practice
Telecommunications (Security) Act 2021 · United Kingdom - Deadline for implementing technical information security measures (Art. 90)
Information Security Act (ISA) · Switzerland - Powers of federal ministries and Länder to set sector-specific minimum requirements take effect (§ 14(3)-(5))
KRITIS umbrella act (CER transposition) · Germany - Federal agencies must support Transport Layer Security 1.3 or a later version
Executive Order 14306 on cybersecurity (2025) · United States - Cybersecurity audit certifications due for businesses with revenue below USD 50 million
California Consumer Privacy Act of 2018 (CCPA) · United States - Minister's report to Parliament on the effectiveness and effects of the act
Critical Entities Resilience Act (Wwke) · Netherlands - 01 series of amendments: Contracting Parties are no longer obliged to accept approvals under the original version
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - First evaluation and review report on the regulation (then every four years)
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Transition completed for high-risk use cases
EU roadmap for post-quantum cryptography (2025) · European Union - High value assets and high-impact federal systems must use post-quantum cryptography for key establishment
Executive Order 14412 on post-quantum cryptography · United States - Quantum-vulnerable public-key algorithms (RSA, ECDSA, EdDSA, DH, ECDH and MQV) become deprecated under NIST standards
NIST IR 8547, transition to post-quantum cryptography · United States - Information security requirements extend to ground handling organisations (Delegated Regulation (EU) 2025/22)
Part-IS: aviation information security · European Union - Final deadline for the regional cybersecurity risk mitigation plans
Network code on electricity cybersecurity (NCCS) · European Union - Deadline for the minister's review of the Act, followed by a report to Parliament
Canada's cyber security act (former Bill C-8, 2026) · Canada - Deadline to complete quantum-safe migration of critical information infrastructure systems
Singapore's Cybersecurity Strategy 2026 · Singapore - High value assets and high-impact federal systems must use post-quantum cryptography for digital signatures
Executive Order 14412 on post-quantum cryptography · United States - Hague target: up to 1.5% of GDP a year, including for critical infrastructure and network defence
Cyber Defence Pledge · NATO - Transition completed for medium-risk use cases and as many systems as feasible
EU roadmap for post-quantum cryptography (2025) · European Union - The same algorithms are disallowed under NIST standards and guidelines
NIST IR 8547, transition to post-quantum cryptography · United States
No future deadline recorded.
Past deadlines (351)
- Legislative Decree 179/2026 adapting national law to the AI Act enters into force, giving ACN and AgID supervisory and sanctioning powers
Law 132/2025 – Artificial intelligence law · Italy - Deadline for federal agencies to submit their post-quantum migration plan to OMB and the National Cyber Director (M-26-15)
Executive Order 14412 on post-quantum cryptography · United States - National penalties apply and must be notified to the Commission by this date
Machinery Regulation (EU) 2023/1230 · European Union - Deadline for adopting and aligning the ordinances on security measures
Amendment to the Cybersecurity Act (2026) · Bulgaria - Amendment to the Cybersecurity Act enters into force, introducing reporting of near misses and security audits of essential entities
Amendment to the Cybersecurity Act (NIS 2, 2025) · Estonia - Deadline for the Council of Ministers to adopt the national large-scale cyber crisis response plan and the Cybersecurity Strategy
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - End of the period, opened on 7 May 2026, for applications to enter the list of essential and important entities
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - CISA's final rule is sent to OIRA (White House) for the review that precedes publication
CIRCIA (incident reporting, 2022) · United States - MCF regulations on security measures and management training (MCFFS 2026:11) and on security audits and scanning (MCFFS 2026:12) enter into force
Cybersecurity Act · Sweden - 24-hour incident reporting, user notification and the surcharge of up to 3% of turnover for repeated incidents take effect
Korea's Information and Communications Network Act · South Korea - Further amendments linked to the Active Cyber Defense Act take effect
Basic Act on Cybersecurity (2014) · Japan - Main entry into force: declaration of important computer systems and incident reporting for critical infrastructure operators
Active Cyber Defense Act (2025) · Japan - The Information Commission replaces the ICO as competent authority for digital service providers
The Network and Information Systems Regulations 2018 · United Kingdom - Deadline for the first designations of critical entities, the first national risk assessment and the first strategy
Critical Entities Resilience Act (Wwke) · Netherlands - National register of entities set up; digital service providers (DNS, cloud, data centres, managed services and online platforms) submit information for the ENISA register
Cybersecurity Act (Cbw) · Netherlands - Amendment takes effect (Act No. 21445): surcharges of up to 10% of turnover, notification of possible leaks, accountability of top management
Personal Information Protection Act (South Korea) · South Korea - Breaches of the CRA reporting obligations can be fined
Act 439/2026 on product cyber resilience (CRA) · Finland - Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Public Law 119-103 extends the law until 11 December 2026
Cybersecurity Information Sharing Act (CISA 2015) · United States - Deadline for the Council of Ministers to designate the competent authorities and adopt the methodology
Amendment to the Cybersecurity Act (2026) · Bulgaria - Applications open for the new FedRAMP 20x Class A certifications (Classes B and C follow on 31 August 2026)
FedRAMP Authorization Act (2022) · United States - Most rules apply, including transparency obligations
AI Act (Regulation (EU) 2024/1689) · European Union - Deadline for the classified benchmarking process for the cyber capabilities of AI models, with the covered frontier model threshold, for the voluntary framework with developers and for expanding the hiring of cybersecurity specialists in the US Tech Force
Executive Order 14409 on AI innovation and security · United States - Law 7590 transfers BTK duties and internet oversight to the Cyber Security Presidency
Türkiye's Cyber Security Law (Law No. 7545) · Türkiye - Deadline for the first identification of critical entities; designations of critical infrastructure elements under the previous rules expire
Act 367/2024 on critical infrastructure (CER) · Slovakia - Deadline for the Government to designate critical entities and their critical infrastructure
Critical Infrastructure Act (ZKI-1) · Slovenia - Deadline to adopt, by an unpublished Prime Ministerial Decree, the list of critical entities; obligations apply ten months after each entity is notified
Legislative Decree 134/2024 – CER transposition · Italy - Deadline for competent authorities to identify critical entities
S.I. 559/2024 on critical entities (CER) · Ireland - Deadline to report the outcome of the designations to the European Commission
Act LXXXIV of 2024 on the resilience of critical entities · Hungary - Deadline for the first decisions designating critical entities
Act 310/2025 on critical infrastructure (CER) · Finland - Phase 2 (third-party certification, planned from 10 November 2026) and later phases suspended pending a programme review
CMMC Program (32 CFR Part 170) · United States - EU: mandatory for the registration of all new complete vehicles
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - Deadline for the action plan against scam centres and cybercrime, including an operational cell within the National Coordination Center
Executive Order 14390 on cybercrime and fraud · United States - Deadline to prioritise the cyber defence of national security systems and Department of War systems, for CISA's Binding Operational Directives on federal civilian systems and for setting up the Treasury-led AI cybersecurity clearinghouse on software vulnerabilities
Executive Order 14409 on AI innovation and security · United States - MCF regulations on incident reporting and information obligations enter into force (MCFFS 2026:8)
Cybersecurity Act · Sweden - Indicative deadline for the national classification of digital security incidents and the first annual operations plan of the National Digital Security Centre
DS 126-2025-PCM – Digital Trust Framework regulation · Peru - Twelve-month deadline for the detailed lists of entities, the CSIRT for executive bodies and the national CSIRT network
NIS Law of North Macedonia (2025) · North Macedonia - Deadline for the first cybersecurity audit of entities operating before 2025
Act LXIX of 2024 on the cybersecurity of Hungary · Hungary - OMB issues memorandum M-26-15 on executing the migration to post-quantum cryptography
Executive Order 14412 on post-quantum cryptography · United States - Cybersecurity certification regulation: NSM becomes national certification authority
Act on Digital Security (Digital Security Act) · Norway - Deadline for risk-management measures by former operators of essential services, state administration bodies and electronic communications operators, and for adopting the cybersecurity strategy
Information Security Act (ZInfV-1) · Slovenia - Deadline for the ATDT to issue the technical guidelines, compliance criteria and official forms implementing the policy
General Cybersecurity Policy for the APF (2025) · Mexico - Royal assent; the amendments to the Telecommunications Act (Part 1) take effect
Canada's cyber security act (former Bill C-8, 2026) · Canada - ENTSO-E feasibility study on a common tool for sharing information with authorities
Network code on electricity cybersecurity (NCCS) · European Union - Rules on the SZTFH as notifying authority and on conformity assessment bodies apply
Act CXXXV of 2025 (CRA implementation) · Hungary - Rules on conformity assessment bodies apply
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Horizon 2 Action Plan (2026-2028) announced: 19 actions and 64 initiatives to be delivered by the end of 2028
2023-2030 Australian Cyber Security Strategy · Australia - Enhanced risk management program requirements (F2026L00701) commence for broadcasting, DNS, electricity, energy market operator, freight, gas, liquid fuel and water assets
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Deadline for the Attorney General's recommendation on a Victims Restoration Program for victims of cyber-enabled fraud
Executive Order 14390 on cybercrime and fraud · United States - End of the 50% reduction of fines and penalties for infringements committed up to this date
Amendment to the Cybersecurity Act (2026) · Bulgaria - Indicative deadline for the Secretariat of Government and Digital Transformation to approve the protocols, channels and deadlines for reporting digital security incidents
DS 126-2025-PCM – Digital Trust Framework regulation · Peru - Publication in the Registro Oficial and entry into force; penalties apply at once in sectors with a specialised supervisory body, such as finance and telecommunications
Organic Law for the Strengthening of Cybersecurity · Ecuador - Entry into force
Prime Ministerial Decree of 22 April 2026 – National security crisis management · Italy - Commission review report on the application of the regulation
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - Deadline for the review of operational, technical, diplomatic and regulatory frameworks against transnational criminal organisations engaged in cyber-enabled crime
Executive Order 14390 on cybercrime and fraud · United States - Deadline for the Ministry of Defence report to the Cabinet on implementation, with proposals for the following years
Cybersecurity Strategy of Latvia 2023-2026 · Latvia - Entry into force
ACN Determination 155238/2026 – Categorisation of NIS activities and services · Italy - The Cyber Communications Information Supervisory Commission is set up (Chapter 10, Section 1)
Active Cyber Defense Act (2025) · Japan - Deadline for entities already in scope to send RIA the information required for the list of entities (three months after entry into force)
Amendment to the Cybersecurity Act (NIS 2, 2025) · Estonia - The Office for IT and eGovernment takes over the new Office's tasks on an interim basis
Law on Information Security (Serbia, 2025) · Serbia - Amendment promulgated (Act No. 21500) introducing 24-hour incident reporting and penalties for repeated incidents
Korea's Information and Communications Network Act · South Korea - Deadline for entities to register with the BSI (three months after entry into force)
NIS2UmsuCG (German NIS 2 Act) · Germany - The security standard for consumer smart devices applies (Cyber Security (Security Standards for Smart Devices) Rules 2025)
Cyber Security Act 2024 · Australia - Organisational session of the Global Mechanism, to be held by March 2026
UN OEWG on ICT security: final report (2025) · United Nations - Deadline to complete national certifications started by 27 February 2025
EUCC certification scheme (Reg. 2024/482) · European Union - Part-IS requirements apply to authorities and organisations
Part-IS: aviation information security · European Union - Deadline for federal agencies and entities to appoint their institutional cybersecurity officer and deputy and notify the ATDT
General Cybersecurity Policy for the APF (2025) · Mexico - Deadline for the government to adopt the medium-term strategic planning act on cybersecurity
Cybersecurity Act · Croatia - ENISA issues interoperability guidelines for Cross-Border Cyber Hubs
Cyber Solidarity Act (Regulation (EU) 2025/38) · European Union - Public Law 119-75 extends the law until 30 September 2026
Cybersecurity Information Sharing Act (CISA 2015) · United States - MCF regulations on the notification and identification of essential and important entities enter into force (MCFFS 2026:1)
Cybersecurity Act · Sweden - Deadline for the Government to approve the strategy
Act 367/2024 on critical infrastructure (CER) · Slovakia - Deadline for the Government to adopt the strategy and the national risk assessment
Critical Infrastructure Act (ZKI-1) · Slovenia - Deadline for approving the national strategy and the national risk assessment
DL 22/2025 on critical entities (CER) · Portugal - Deadline for the sectoral competent authorities to identify critical entities and report them to the single point of contact
Legislative Decree 134/2024 – CER transposition · Italy - Deadline for the national strategy and the national risk assessment
S.I. 559/2024 on critical entities (CER) · Ireland - Government adoption of the strategy and of the national risk assessment
Act LXXXIV of 2024 on the resilience of critical entities · Hungary - Deadline for the government to adopt the strategic act on the resilience of critical entities and the national critical infrastructure risk assessment
Critical Infrastructure Act · Croatia - Deadline to approve the national plan for the resilience of critical entities and the national risk assessment
Act 310/2025 on critical infrastructure (CER) · Finland - Entry into force
ACN Determination 379907/2025 – Basic NIS security measures and incident notification · Italy - Deadline for approving the cybersecurity plan
Cybersecurity of EU institutions (2023/2841) · European Union - Regulations on cybersecurity audits, risk assessments and automated decision-making take effect
California Consumer Privacy Act of 2018 (CCPA) · United States - The NBÚ becomes the market surveillance authority for products with digital elements (CRA, Act No. 318/2025)
Act No. 69/2018 Coll. on Cybersecurity · Slovakia - The Law starts to apply, except for the sectors deferred until EU accession
NIS Law of North Macedonia (2025) · North Macedonia - Part-IS applies to the EGNOS air navigation service provider
Part-IS: aviation information security · European Union - The amendment takes effect: AI provisions, higher penalties and measures against foreign entities
Cybersecurity Law of the People's Republic of China · China - Deadline for classifying the Confederation's IT resources (Art. 90)
Information Security Act (ISA) · Switzerland - Basic incident notification obligations set by ACN apply
Legislative Decree 138/2024 – NIS 2 transposition · Italy - End of the transitional regime: the 2016 law's duties for designated operators cease
Law on Information Security (Serbia, 2025) · Serbia - Deadline for the first registration of entities through the self-registration system
Information Security Act (ZInfV-1) · Slovenia - Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392)
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Deemed compliance for products certified under JC-STAR (Japan) or CLS (Singapore)
PSTI Act 2022 (connected product security) · United Kingdom - Deadline for the preliminary update of NIST's Secure Software Development Framework (SSDF) and for CISA's list of product categories supporting post-quantum cryptography
Executive Order 14306 on cybersecurity (2025) · United States - The General Assembly endorses the report (resolution 80/16)
UN OEWG on ICT security: final report (2025) · United Nations - The full revision of the Act (35 articles) promulgated on 24 September 2025 takes effect
Taiwan's Cyber Security Management Act (2018) · Taiwan - The European Supervisory Authorities designate the first 19 critical ICT third-party providers
DORA (Regulation (EU) 2022/2554) · European Union - First provisions take effect, including those on the Data Protection Board, which is established (notifications G.S.R. 843(E) and 844(E))
Digital Personal Data Protection Act 2023 (DPDP) · India - The continuing appropriations act (Public Law 119-37) restores the law until 30 January 2026
Cybersecurity Information Sharing Act (CISA 2015) · United States - The DFARS rule (48 CFR) takes effect and Phase 1 begins (self-assessment for Levels 1 and 2)
CMMC Program (32 CFR Part 170) · United States - Amendment Act No. 17 of 2025 comes into force: the NC4 may direct that unlawful websites and applications be made inaccessible
Computer Misuse and Cybercrimes Act 2018 · Kenya - Most of the 2024 amendment takes effect: critical infrastructure located abroad, third-party-owned critical infrastructure (Part 3A), systems of temporary cybersecurity concern (Part 3B), codes of practice and standards (notification S 677/2025)
Cybersecurity Act 2018 · Singapore - The NPC Standing Committee adopts the decision amending the law
Cybersecurity Law of the People's Republic of China · China - Delegated Regulation (EU) 2022/1645 applies (aerodromes and design and production organisations)
Part-IS: aviation information security · European Union - The Act and its implementing regulation (digitalsikkerhetsforskriften) enter into force
Act on Digital Security (Digital Security Act) · Norway - Penalties for failing to comply with BACS decisions apply (up to CHF 100,000)
Information Security Act (ISA) · Switzerland - The last provision, deferred by six months, enters into force
Law No. 4336-IX on cyber protection (Ukraine, 2025) · Ukraine - The law's original sunset date passes; its protections lapse during the federal funding gap
Cybersecurity Information Sharing Act (CISA 2015) · United States - Extended deadline for essential and important entities to register on the National Cybersecurity Authority platform
Law 5160/2024 transposing NIS 2 · Greece - Deadline for taking cybersecurity risk-management measures
Cybersecurity of EU institutions (2023/2841) · European Union - Deadline for entities operating before 2025 to sign an agreement with a registered auditor
Act LXIX of 2024 on the cybersecurity of Hungary · Hungary - Release 5.2.0, with new controls on software updates and patches
Security and Privacy Controls for Information Systems and… · United States - General-purpose AI models, governance and penalties
AI Act (Regulation (EU) 2024/1689) · European Union - Cybersecurity requirements for radio equipment apply
RED Delegated Regulation (EU) 2022/30 · European Union - Law 25-11 amending the Law is published: mandatory data protection officer and records of processing
Law 18-07 on personal data · Algeria - First cybersecurity maturity assessment (then at least every two years)
Cybersecurity of EU institutions (2023/2841) · European Union - The Cybersecurity Strategic Headquarters comes under the Prime Minister's leadership; the National Cybersecurity Office replaces the NISC
Basic Act on Cybersecurity (2014) · Japan - The general provisions (Chapter 1) and Articles 76-78 take effect
Active Cyber Defense Act (2025) · Japan - Deadline for the Government to adopt implementing acts (three months)
Law No. 4336-IX on cyber protection (Ukraine, 2025) · Ukraine - Cyber-attack classification scale methodology and ACER guidelines on information sharing
Network code on electricity cybersecurity (NCCS) · European Union - Deadline for adopting implementing regulations (six months after entry into force)
Law on Information Security (Montenegro, 2024) · Montenegro - Part 3, with the duty to report ransomware payments within 72 hours, and Part 5 on the Cyber Incident Review Board commence
Cyber Security Act 2024 · Australia - Start of the first designation procedures for critical entities
Act LXXXIV of 2024 on the resilience of critical entities · Hungary - Member States establish the list of essential and important entities
NIS 2 Directive (EU) 2022/2555 · European Union - Each Union entity establishes its internal risk-management, governance and control framework
Cybersecurity of EU institutions (2023/2841) · European Union - Telecommunications security obligations move from the Telecommunications Act 1997 into this Act
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Critical infrastructure operators must report cyberattacks within 24 hours
Information Security Act (ISA) · Switzerland - Transmission system operators submit the risk assessment methodologies; provisional list of high-impact and critical-impact entities notified
Network code on electricity cybersecurity (NCCS) · European Union - With the grace period over (28 February 2025), providers of managed SOC monitoring and penetration testing services must hold a licence
Malaysia's Cyber Security Act 2024 (Act 854) · Malaysia - Registration deadline for existing essential and important entities (four weeks)
Cyber Security Act (CSG) of 5 December 2024 (Liechtenstein) · Liechtenstein - Articles 5, 8 and 9 and Title VII take effect, including the duty to report incidents to the national CSIRT and the penalty regime
Chile's Cybersecurity Framework Law (Law 21.663) · Chile - The regulation applies; national schemes covered by EUCC cease to produce effects
EUCC certification scheme (Reg. 2024/482) · European Union - Deadline for the first categorisation of essential and important entities and for setting up the special register of entities
Cybersecurity Act · Croatia - The Cyber Security (Exemption) Order 2025 (P.U.(A) 47/2025) takes effect, exempting nine companies of the Amazon Web Services, Google and Microsoft groups and Pearl Computing from the whole Act
Malaysia's Cyber Security Act 2024 (Act 854) · Malaysia - The Act and its implementing ordinance (CSV) enter into force
Cyber Security Act (CSG) of 5 December 2024 (Liechtenstein) · Liechtenstein - Incident reporting duties extend to municipalities with over 100,000 inhabitants and regional capitals, public transport companies, local health authorities and in-house companies (180th day after entry into force)
Law 90/2024 – National cybersecurity and computer crimes · Italy - Proposed revision to strengthen cybersecurity published (90 FR 898)
HIPAA Security Rule · United States - The reform transposing NIS 2 enters into force (Act No. 366/2024)
Act No. 69/2018 Coll. on Cybersecurity · Slovakia - The first implementing regulations on European Digital Identity Wallets enter into force
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - The 2024 amendments take effect (Act No. 100, 2024): data storage systems holding business critical data, directions to manage the consequences of incidents, use of protected information and directions to vary risk management programs
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Deadline for each Member State to designate its competent authority
Network code on electricity cybersecurity (NCCS) · European Union - Administrative Instruction No. 03/2024 on incident notification is published: initial notification within 24 hours, then interim and final reports
Kosovo's Law No. 08/L-173 on Cyber Security · Kosovo - OMB publishes memorandum M-24-15 implementing the programme
FedRAMP Authorization Act (2022) · United States - EU: mandatory for all new vehicle types and for the registration of new vehicles whose software the manufacturer updates
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - EU: mandatory for the registration of all new vehicles of categories M and N
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - The Form 8-K Item 1.05 requirement also applies to smaller reporting companies
SEC cybersecurity disclosure rules (2023) · United States - The connectable product security regime (Part 1) applies
PSTI Act 2022 (connected product security) · United Kingdom - CISA publishes the proposed implementing rule (89 FR 23644, 6 CFR Part 226)
CIRCIA (incident reporting, 2022) · United States - The 2024 Amendment Act is signed into law: reporting of attacks within 72 hours and a 0.5% cybersecurity levy
Cybercrimes Act 2015 · Nigeria - Duty to disclose material incidents on Form 8-K (Item 1.05) applies to all companies except smaller reporting companies
SEC cybersecurity disclosure rules (2023) · United States - Annual reports for fiscal years ending on or after this date must describe cybersecurity risk management, strategy and governance (Regulation S-K Item 106)
SEC cybersecurity disclosure rules (2023) · United States - Vilnius Summit: the pledge is restated and enhanced with new national goals
Cyber Defence Pledge · NATO - The California Privacy Rights Act (Proposition 24) amendments apply
California Consumer Privacy Act of 2018 (CCPA) · United States - EU: mandatory for the type approval of new vehicle types whose software the manufacturer updates after registration
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - EU: mandatory for the type approval of new vehicle types of categories M and N
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - The General Assembly calls on States to be guided by the report (resolution 76/19)
Report of the Group of Governmental Experts on Advancing Responsible… · United Nations - Entry into force
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - Entry into force
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - Cyber risks to be addressed in ships’ safety management systems (first annual DOC verification)
Resolution MSC.428(98) – Maritime cyber risk management in safety… · International Maritime Organization (IMO) - Update with errata (Release 5.1)
Security and Privacy Controls for Information Systems and… · United States - Transposition deadline for Member States
Directive 2013/40/EU on attacks against information systems · European Union - The HITECH Omnibus Rule takes effect, extending the obligations to business associates
HIPAA Security Rule · United States
No past deadline recorded.
News week by week
Week from 26 October 2026 to 1 November 2026 · database launch
326 records published at launch
New documents (326)
- United Arab Emirates National Cybersecurity Strategy (2019) · United Arab Emirates
- National Cybersecurity Strategy of the UAE 2025-2031 · United Arab Emirates
- Electronic Crimes Act, 2013 (No. 14 of 2013) · Antigua and Barbuda
- CNC Provision 1/2026 – Technical regulation on contingency planning policies, contingency plans and backup data processing centres · Argentina
- Decree of Necessity and Urgency 941/2025 amending the National Intelligence Law and creating the National Cybersecurity Centre · Argentina
- Argentina's Second National Cybersecurity Strategy (2023) · Argentina
- Network and Information Systems Security Act 2026 (NISG 2026) · Austria
- Ordinance of the Cybersecurity Authority on detailed requirements for cybersecurity risk-management measures and further criteria for significant incidents (NISV 2026) · Austria
- Critical Entities Resilience Act (RKEG) · Austria
- Austrian Strategy for Cybersecurity 2021 · Austria
- Austrian Strategy for the Resilience of Critical Entities (ÖSRKE 2026) · Austria
- Principles of operational technology cyber security · Australia
- Cyber Security Act 2024 · Australia
- 2023-2030 Australian Cyber Security Strategy · Australia
- 2023-2030 Australian Cyber Security Strategy - Horizon 2 Action Plan · Australia
- Security of Critical Infrastructure Act 2018 · Australia
- Bangladesh Cyber Security Act 2026 (Act No. 81 of 2026) · Bangladesh
- Cybersecurity Strategy Belgium 2.0 (2021-2025) · Belgium
- Act of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security · Belgium
- Law of 19 December 2025 on the resilience of critical entities · Belgium
- Updated National Cybersecurity Strategy "Cyber-Resilient Bulgaria 2023" · Bulgaria
- Act amending and supplementing the Cybersecurity Act · Bulgaria
- Bahrain's National Cyber Security Strategy 2025-2028 · Bahrain
- Brazil's National Cybersecurity Strategy (E-Ciber, 2025) · Brazil
- Decree 11.856/2023 establishing the National Cybersecurity Policy and the National Cybersecurity Committee · Brazil
- Decree 12.572/2025 establishing the National Information Security Policy and its governance in the federal public administration · Brazil
- Cybercrime and Computer Related Crimes Act, 2018 (No. 18 of 2018) · Botswana
- Botswana National Cybersecurity Strategy (2020) · Botswana
- National Cybersecurity Strategy of Belize: Towards a Secure Cyberspace 2020-2023 · Belize
- An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts (S.C. 2026, c. 9) · Canada
- National Cyber Security Strategy: Canada's Vision for Security and Prosperity in the Digital Age · Canada
- Canada's National Cyber Security Strategy: Securing Canada's Digital Future · Canada
- Ordinance on Cybersecurity (Cybersecurity Ordinance, CSO) · Switzerland
- Federal Act on Information Security in the Federal Administration (Information Security Act, ISA) · Switzerland
- National Cyberstrategy (NCS) 2023 · Switzerland
- Chile's Cybersecurity Framework Law (Law 21.663) · Chile
- Chile's National Cybersecurity Policy 2023-2028 · Chile
- Law No. 2010/012 of 21 December 2010 relating to Cybersecurity and Cybercriminality in Cameroon · Cameroon
- Regulations on the Security Protection of Critical Information Infrastructure · China
- Administrative Measures for National Cybersecurity Incident Reporting · China
- Cybersecurity Law of the People's Republic of China · China
- Data Security Law of the People's Republic of China · China
- China's National Cyberspace Security Strategy (2016) · China
- Regulations on Network Data Security Management · China
- Measures for Network Data Security Risk Assessment · China
- Personal Information Protection Law of the People's Republic of China (PIPL) · China
- Colombia's National Digital Security Strategy 2025-2027 · Colombia
- Convention on Cybercrime (Budapest Convention) · Council of Europe
- Costa Rica's National Cybersecurity Strategy 2023-2027 · Costa Rica
- Cybersecurity Strategy of the Republic of Cyprus 2020 · Cyprus
- Civil Defence (Resilience of Critical Entities) Regulations of 2025 · Cyprus
- Security of Networks and Information Systems (Amendment) Law of 2025 · Cyprus
- National Cyber Security Strategy of Czechia 2026-2030 · Czechia
- Cybersecurity Act · Czechia
- Critical Infrastructure Act · Czechia
- ICS Security Compendium · Germany
- Cyber Security Strategy for Germany 2016 · Germany
- Cyber Security Strategy for Germany 2021 · Germany
- Act implementing Directive (EU) 2022/2557 and strengthening the resilience of critical facilities (KRITIS umbrella act) · Germany
- Act implementing the NIS 2 Directive and regulating essential features of information security management in the federal administration (NIS2UmsuCG) · Germany
- Act on the resilience of critical entities · Denmark
- Act on measures to ensure a high level of cybersecurity (NIS 2 Act) · Denmark
- Agreement on the Cyber and Information Security Strategy 2026-2029 · Denmark
- Dominican Republic National Cybersecurity Strategy 2030 · Dominican Republic
- Presidential Decree No. 20-05 of 20 January 2020 establishing a national information systems security framework · Algeria
- Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data · Algeria
- Algeria's National Information Systems Security Strategy 2025-2029 · Algeria
- Organic Law for the Strengthening of Cybersecurity · Ecuador
- Estonian Information Security Standard (E-ITS) · Estonia
- Act amending the Emergency Act and other related acts · Estonia
- Crisis Situations and National Defence Act · Estonia
- Act amending the Cybersecurity Act and other acts (transposition of the NIS 2 Directive) · Estonia
- Cybersecurity Strategy 2024-2030 "Cyber-conscious Estonia" · Estonia
- Egypt's National Cybersecurity Strategy 2023-2027 · Egypt
- National Cybersecurity Strategy 2019 · Spain
- Royal Decree 311/2022 of 3 May regulating the National Security Framework (ENS) · Spain
- Royal Decree-Law 12/2018 of 7 September on the security of network and information systems · Spain
- Action Plan on Cybersecurity and Artificial Intelligence · European Union
- European action plan on the cybersecurity of hospitals and healthcare providers · European Union
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) · European Union
- Directive (EU) 2022/2557 on the resilience of critical entities (CER Directive) · European Union
- Commission Implementing Regulation (EU) 2025/2392 on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 · European Union
- Regulation (EU) 2025/37 amending Regulation (EU) 2019/881 as regards managed security services · European Union
- Council Recommendation of 6 June 2025 on an EU blueprint for cyber crisis management · European Union
- Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act) · European Union
- Regulation (EU) 2025/38 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents (Cyber Solidarity Act) · European Union
- Regulation (EU) 2019/881 on ENISA and on information and communications technology cybersecurity certification (Cybersecurity Act) · European Union
- The EU's Cybersecurity Strategy for the Digital Decade · European Union
- Directive 2013/40/EU on attacks against information systems · European Union
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) · European Union
- Regulation (EU) 2021/887 establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres · European Union
- Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2) · European Union
- Commission Implementing Regulation (EU) 2024/482 laying down rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC) · European Union
- Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, GDPR) · European Union
- Regulation (EU, Euratom) 2023/2841 laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union · European Union
- Regulation (EU) 2023/1230 on machinery (Machinery Regulation) · European Union
- MDCG 2019-16 Rev.1 – Guidance on Cybersecurity for medical devices · European Union
- Commission Delegated Regulation (EU) 2024/1366 establishing a network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows (NCCS) · European Union
- Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive) · European Union
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive) · European Union
- Commission Implementing Regulation (EU) 2024/2690 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and significant incidents · European Union
- Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS) · European Union
- A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography · European Union
- ProtectEU: a European Internal Security Strategy · European Union
- Directive 2014/53/EU on the harmonisation of the laws of the Member States relating to the making available on the market of radio equipment (Radio Equipment Directive, RED) · European Union
- Commission Delegated Regulation (EU) 2022/30 supplementing Directive 2014/53/EU (Radio Equipment Directive) with regard to the essential requirements of Article 3(3)(d), (e) and (f) · European Union
- Cybersecurity Act · Finland
- Finland's Cyber Security Strategy 2024-2035 · Finland
- Act on the protection of society's critical infrastructure and the improvement of its resilience · Finland
- Act on the cyber resilience of certain products and on cybersecurity certification · Finland
- Cybersecurity of Industrial Control Systems – Classification Method · France
- Law No. 2018-133 of 26 February 2018 on various provisions adapting to EU law in the field of security · France
- National Cybersecurity Strategy of France 2026-2030 · France
- French National Digital Security Strategy · France
- Computer Misuse Act 1990 · United Kingdom
- Government Cyber Action Plan · United Kingdom
- National Cyber Security Strategy 2016 to 2021 · United Kingdom
- National Cyber Strategy 2022 · United Kingdom
- Secure connectivity principles for operational technology (OT) · United Kingdom
- The Network and Information Systems Regulations 2018 · United Kingdom
- Product Security and Telecommunications Infrastructure Act 2022 · United Kingdom
- Telecommunications (Security) Act 2021 · United Kingdom
- Georgia's National Cybersecurity Strategy 2021-2024 · Georgia
- Ghana's Directive for the Protection of Critical Information Infrastructure · Ghana
- Ghana's Cybersecurity Act, 2020 (Act 1038) · Ghana
- Ghana's National Cybersecurity Policy and Strategy (2024) · Ghana
- National Cybersecurity Strategy of Greece 2026-2030 · Greece
- Law 5160/2024 – Transposition of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union · Greece
- Law 5236/2025 on the resilience of critical entities · Greece
- Cybercrime Act 2018 (Act No. 16 of 2018) · Guyana
- Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) · Hong Kong
- National Cyber Security Strategy and Action Plan for its implementation · Croatia
- Cybersecurity Act · Croatia
- Critical Infrastructure Act · Croatia
- Act LXIX of 2024 on the cybersecurity of Hungary · Hungary
- Act LXXXIV of 2024 on the resilience of critical entities · Hungary
- Act CXXXV of 2025 on the implementation in Hungary of the European Union regulation on cyber resilience and on the amendment of certain cybersecurity provisions · Hungary
- Government Decision 1089/2025 on Hungary's Cybersecurity Strategy · Hungary
- Indonesia's National Cyber Security Strategy and Cyber Crisis Management (Presidential Regulation 47/2023) · Indonesia
- Criminal Justice (Offences Relating to Information Systems) Act 2017 · Ireland
- National Cyber Security Strategy 2030 · Ireland
- European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 · Ireland
- European Union (Resilience of Critical Entities) Regulations 2024 · Ireland
- Israel's National Cyber Security Strategy (2025) · Israel
- Resolution MSC.428(98) – Maritime cyber risk management in safety management systems · International Maritime Organization (IMO)
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) · India
- Digital Personal Data Protection Rules, 2025 · India
- India's Information Technology Act, 2000 · India
- India's National Cyber Security Policy (2013) · India
- Icelandic National Cybersecurity Strategy 2022-2037 · Iceland
- Determination of the Director General of the National Cybersecurity Agency of 9 February 2026 – Taxonomy of incidents under Article 1(1) of Law No. 90 of 28 June 2024 · Italy
- Determination No. 155238/2026 of the Director General of the National Cybersecurity Agency – Relevance categories and criteria for listing and categorising activities and services · Italy
- Determination No. 314287/2026 of the Director General of the National Cybersecurity Agency on the terms, procedures and use of the NIS digital platform · Italy
- Determination No. 379907/2025 of the Director General of the National Cybersecurity Agency – Basic specifications for the obligations under Articles 23, 24, 25, 29 and 32 of the NIS Decree · Italy
- National Coordinated Vulnerability Disclosure (CVD) Policy · Italy
- Decree-Law No. 105 of 21 September 2019 on the national cybersecurity perimeter · Italy
- Decree-Law No. 82 of 14 June 2021 on urgent cybersecurity provisions and establishing the National Cybersecurity Agency · Italy
- Legislative Decree No. 123 of 3 August 2022 adapting national law to Title III (cybersecurity certification framework) of Regulation (EU) 2019/881 (Cybersecurity Act) · Italy
- Legislative Decree No. 134 of 4 September 2024 implementing Directive (EU) 2022/2557 on the resilience of critical entities · Italy
- Legislative Decree No. 138 of 4 September 2024 transposing Directive (EU) 2022/2555 (NIS 2) · Italy
- Legislative Decree No. 191 of 1 October 2026 adapting national law to Regulation (EU) 2025/37 amending Regulation (EU) 2019/881 as regards managed security services · Italy
- Legislative Decree No. 65 of 18 May 2018 implementing Directive (EU) 2016/1148 (NIS) · Italy
- Prime Ministerial Decree of 22 April 2026 – Regulation implementing Article 7-bis(5) of Decree-Law No. 174 of 30 October 2015 on the management of crises involving national security · Italy
- Prime Ministerial Decree of 30 April 2025 governing contracts for ICT goods and services used in a context linked to the protection of strategic national interests and national security · Italy
- Prime Ministerial Decree No. 81 of 14 April 2021 – Regulation on the notification of incidents affecting the networks, information systems and IT services referred to in Article 1(2)(b) of Decree-Law No. 105 of 21 September 2019, and on measures to ensure high levels of security · Italy
- Law No. 132 of 23 September 2025 laying down provisions and delegating powers to the Government on artificial intelligence · Italy
- Law No. 90 of 28 June 2024 on strengthening national cybersecurity and on computer crimes · Italy
- Implementation Plan of the National Cybersecurity Strategy 2022-2026 · Italy
- National Cybersecurity Strategy 2022-2026 · Italy
- National Strategy for the Resilience of Critical Entities · Italy
- Guide to Developing a National Cybersecurity Strategy – 2nd Edition 2021 · International Telecommunication Union (ITU)
- Guide to Developing a National Cybersecurity Strategy – 3rd Edition 2025 · International Telecommunication Union (ITU)
- The Cybercrimes Act, 2015 (No. 31 of 2015) · Jamaica
- Jordan's National Cyber Security Strategy 2025-2028 · Jordan
- Act on the Prevention of Damage Caused by Unauthorized Acts against Important Computers (Active Cyber Defense Act) · Japan
- Basic Act on Cybersecurity (Act No. 104 of 2014) · Japan
- Cybersecurity Strategy of Japan (2021) · Japan
- Cybersecurity Strategy of Japan (2025) · Japan
- Kenya's Computer Misuse and Cybercrimes Act, 2018 · Kenya
- Kenya's National Cybersecurity Strategy 2022 · Kenya
- Act on Promotion of Information and Communications Network Utilization and Information Protection · South Korea
- South Korea's National Cybersecurity Strategy (2024) · South Korea
- Personal Information Protection Act (South Korea) · South Korea
- Law on Prevention and Combating Cyber Crime (No. 61/NA) · Laos
- Cyber Security Act (CSG) of 5 December 2024 (Liechtenstein) · Liechtenstein
- National Strategy for Protection Against Cyber Risks (2025 revision) of Liechtenstein · Liechtenstein
- Sri Lanka's Information and Cyber Security Strategy 2019-2023 · Sri Lanka
- National Cyber Security Strategy of Sri Lanka 2025-2029 · Sri Lanka
- Law amending Cybersecurity Law No XII-1428 · Lithuania
- Act amending the Crisis Management and Civil Protection Act No VIII-971 · Lithuania
- National Cyber Security Strategy of Lithuania · Lithuania
- Law of 5 May 2026 on the resilience of critical entities · Luxembourg
- Act of 5 May 2026 on measures to ensure a high level of cybersecurity · Luxembourg
- National Cybersecurity Strategy IV (Luxembourg) · Luxembourg
- Amendments to the National Security Law · Latvia
- Cybersecurity Strategy of Latvia 2023-2026 · Latvia
- National Cybersecurity Law · Latvia
- Decree No. 2-24-921 of 22 October 2024 on the use of cloud service providers by entities and critical infrastructure with sensitive information systems or data · Morocco
- Morocco's Law No. 05-20 on Cybersecurity (2020) · Morocco
- Morocco's National Cybersecurity Strategy 2030 · Morocco
- Cyber Security Strategy of Montenegro 2022-2026 · Montenegro
- Law on Information Security (Montenegro, 2024) · Montenegro
- North Macedonia's Law on Security of Network and Information Systems · North Macedonia
- Law No. 2019-056 of 5 December 2019 on the Suppression of Cybercrime · Mali
- Law on Cyber Security · Mongolia
- National Cyber Security Strategy · Mongolia
- Malta National Cybersecurity Strategy 2023-2026 · Malta
- Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41) · Malta
- Resilience of Critical Entities and Infrastructures (Identification, Designation and Protection) Order, 2026 · Malta
- Cyber Resilience Regulations, 2026 (S.L. 591.06) · Malta
- Mauritius' Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 · Mauritius
- Mauritius' Cybersecurity and Cybercrime Act 2021 · Mauritius
- Mexico's National Cybersecurity Plan 2025-2030 · Mexico
- Agreement issuing the General Cybersecurity Policy for the Federal Public Administration · Mexico
- Malaysia's Cyber Security Act 2024 (Act 854) · Malaysia
- Malaysia Cyber Security Strategy (MCSS) 2025-2030 · Malaysia
- Cyber Defence Pledge · NATO
- Nigeria's Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 · Nigeria
- Nigeria's National Cybersecurity Policy and Strategy (2021) · Nigeria
- Law No. 1042, Special Law on Cybercrimes · Nicaragua
- Decree of 8 July 2026 laying down rules implementing the Cybersecurity Act and setting the date of its entry into force (Cyberbeveiligingsbesluit) · Netherlands
- Cybersecurity Act (Cbw) · Netherlands
- Netherlands Cybersecurity Strategy 2022-2028 · Netherlands
- Critical Entities Resilience Act (Wwke) · Netherlands
- Act on Digital Security (Digital Security Act) · Norway
- National Cyber Security Strategy for Norway · Norway
- Cybercrime Act 2015 (No. 14 of 2015) · Nauru
- New Zealand's Cyber Security Strategy 2026–2030 · New Zealand
- National Cybersecurity Strategy 2021-2024 · Panama
- Law No. 30096 on Computer Crimes · Peru
- Law No. 30999 on Cyber Defence · Peru
- Supreme Decree 126-2025-PCM approving the Regulation of Emergency Decree 007-2020 on the Digital Trust Framework · Peru
- Philippines National Cybersecurity Plan 2023-2028 · Philippines
- Cybersecurity Strategy of the Republic of Poland 2025-2029 · Poland
- Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts · Poland
- Act of 29 May 2026 amending the Crisis Management Act and certain other acts · Poland
- Decree-Law No 125/2025 – Legal framework for cybersecurity · Portugal
- Decree-Law No 22/2025 on the resilience of critical entities · Portugal
- National Cyberspace Security Strategy 2019-2023 (Portugal) · Portugal
- Regulation No 756/2026 implementing the Legal Framework for Cybersecurity approved by Decree-Law No 125/2025 · Portugal
- Qatar's National Cyber Security Strategy 2024-2030 · Qatar
- Law No 294/2024 on the resilience of critical entities · Romania
- Government Emergency Ordinance No 155/2024 establishing a framework for the cybersecurity of networks and information systems in the national civilian cyberspace · Romania
- Cybersecurity Strategy of Romania 2022-2027 · Romania
- Serbia's Strategy for the Development of the Information Society and Information Security 2021-2026 · Serbia
- Law on Information Security (Serbia, 2025) · Serbia
- Rwanda's Law No. 60/2018 on prevention and punishment of cyber crimes · Rwanda
- Rwanda's National Cybersecurity Strategy 2024-2029 · Rwanda
- Legal Powers of the National Cybersecurity Authority (Royal Decree No. M/117) · Saudi Arabia
- Saudi Arabia's National Cybersecurity Strategy (2020) · Saudi Arabia
- Cybersecurity Act · Sweden
- National Strategy for Cybersecurity 2025-2029 (Sweden) · Sweden
- Cybersecurity Act 2018 · Singapore
- The Singapore Cybersecurity Strategy 2021 · Singapore
- Singapore's Cybersecurity Strategy 2026 · Singapore
- Digital Slovenia 2030 – Overarching Strategy for Slovenia's Digital Transformation · Slovenia
- Information Security Act (ZInfV-1) · Slovenia
- Critical Infrastructure Act (ZKI-1) · Slovenia
- National Cybersecurity Strategy of Slovakia 2026-2030 · Slovakia
- Act on critical infrastructure and amending certain acts · Slovakia
- Act No. 69/2018 Coll. on Cybersecurity · Slovakia
- Senegal's National Cybersecurity Strategy (SNC2022) · Senegal
- Law No. 15/2017 on Cybercrime · São Tomé and Príncipe
- Cybersecurity and Information Security Law (Legislative Decree No. 143) · El Salvador
- Special Law against Computer and Related Crimes (Legislative Decree No. 260) · El Salvador
- Thailand's Cybersecurity Act B.E. 2562 (2019) · Thailand
- Decree-Law No. 2023-17 of 11 March 2023 on cybersecurity (Tunisia) · Tunisia
- Tunisia's National Cybersecurity Strategy 2026-2030 · Tunisia
- Computer Crimes Act (Act 14 of 2003, CAP. 10.06) · Tonga
- Türkiye's Cyber Security Law (Law No. 7545) · Türkiye
- Türkiye's National Cyber Security Strategy and Action Plan 2024-2028 · Türkiye
- Taiwan's Cyber Security Management Act (2018) · Taiwan
- Taiwan's Phase Seven National Cyber Security Development Program (2025-2028) · Taiwan
- Cybersecurity Strategy of Ukraine (2021) · Ukraine
- Law amending certain laws of Ukraine on information protection and cyber protection of state information resources and critical information infrastructure objects · Ukraine
- Uganda's National Cybersecurity Strategy 2022-2026 · Uganda
- United Nations Convention against Cybercrime · United Nations
- Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security · United Nations
- Final report of the open-ended working group on security of and in the use of information and communications technologies 2021–2025 · United Nations
- UN Regulation No. 155 – Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system · United Nations Economic Commission for Europe (UNECE)
- UN Regulation No. 156 – Uniform provisions concerning the approval of vehicles with regards to software update and software updates management system · United Nations Economic Commission for Europe (UNECE)
- California Consumer Privacy Act of 2018 (CCPA) · United States
- Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) · United States
- Cybersecurity and Infrastructure Security Agency Act of 2018 · United States
- Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators · United States
- Cybersecurity Maturity Model Certification (CMMC) Program (32 CFR Part 170) · United States
- President Trump's Cyber Strategy for America · United States
- Cybersecurity Information Sharing Act of 2015 (CISA 2015) · United States
- Executive Order 14028 – Improving the Nation's Cybersecurity · United States
- Executive Order 14306 – Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144 · United States
- Executive Order 14390 – Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens · United States
- Executive Order 14409 – Promoting Advanced Artificial Intelligence Innovation and Security · United States
- Executive Order 14412 – Securing the Nation Against Advanced Cryptographic Attacks · United States
- Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions · United States
- FedRAMP Authorization Act (Section 5921 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023) · United States
- Federal Information Security Modernization Act of 2014 (FISMA) · United States
- HIPAA Security Rule: Health Insurance Reform; Security Standards (45 CFR Parts 160 and 164, Subparts A and C) · United States
- National Cybersecurity Strategy · United States
- National Cybersecurity Strategy Implementation Plan · United States
- The NIST Cybersecurity Framework (CSF) 2.0 · United States
- Cybersecurity Framework Version 1.1 Manufacturing Profile (NIST IR 8183 Rev. 1) · United States
- Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST IR 8259) · United States
- Foundational Cybersecurity Activities for IoT Product Manufacturers (NIST IR 8259 Rev. 1) · United States
- Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure (NIST IR 8473) · United States
- Transition to Post-Quantum Cryptography Standards (NIST IR 8547) · United States
- OT Backup Quick Start Guide (NIST SP 1339) · United States
- Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector (NIST SP 1800-10) · United States
- Cybersecurity for the Water and Wastewater Sector: Build Architecture (Operational Technology Remote Access) (NIST SP 1800-45) · United States
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171 Rev. 3) · United States
- IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements (NIST SP 800-213) · United States
- Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5) · United States
- Guide to Operational Technology (OT) Security (NIST SP 800-82 Rev. 3) · United States
- National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems · United States
- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (SEC Release No. 33-11216) · United States
- Uruguay's National Cybersecurity Strategy 2024-2030 · Uruguay
- Viet Nam's National Cyber Safety and Security Strategy to 2025, with a vision to 2030 · Viet Nam
- Viet Nam's Law on Cybersecurity 2025 (116/2025/QH15) · Viet Nam
- Decree No. 333/2026/ND-CP detailing certain articles of and measures to implement Viet Nam's Law on Cybersecurity · Viet Nam
- Vanuatu National Cyber Security Strategy 2030 · Vanuatu
- Samoa National Cybersecurity Strategy 2016-2021 · Samoa
- Samoa National Cybersecurity Strategy 2025/26 - 2030/31 · Samoa
- Kosovo's Law No. 08/L-173 on Cyber Security · Kosovo
- Cybercrimes Act 19 of 2020 · South Africa
- South Africa's National Cybersecurity Policy Framework (2015) · South Africa
- Protection of Personal Information Act 4 of 2013 (POPIA) · South Africa
- Zambia's Cyber Security Act, 2025 · Zambia
No news for this country in recent weeks.