News and deadlines
Upcoming dates to note (entry into force, application, transposition deadlines) and the documents added to the database week by week.
Upcoming deadlines
As of 3 November 2026. Dates without a day give the month or year of the deadline; the official source always prevails.
- The amendments made by Legislative Decree 191/2026 on managed security services apply
Legislative Decree 123/2022 – Cybersecurity certification · Italy - Deadline to bring infrastructure, policies and contingency plans into line and to send the CNC the disaster recovery plan compliance report, with the alternate site, an initial failover test and RTO/RPO values
CNC Provision 1/2026 – Contingency plans and backup sites · Argentina - Provisions on consent managers take effect (section 6(9) and section 27(1)(d))
Digital Personal Data Protection Act 2023 (DPDP) · India - Rule 4 on the registration and obligations of consent managers takes effect
Digital Personal Data Protection Rules 2025 (DPDP) · India - Deadline for adopting the new National Cybersecurity Strategy
Amendment to the Cybersecurity Act (2026) · Bulgaria - Deadline for the national minimum cybersecurity standards and for the regulations on incident management and reporting, classification of essential services and critical digital infrastructure, and ethical hacking
Organic Law for the Strengthening of Cybersecurity · Ecuador - The law starts to apply to municipalities (first-level local authorities), after a one-year postponement
Law 5160/2024 transposing NIS 2 · Greece - Deadline for comments on the draft of Revision 4
Guide to Operational Technology (OT) Security (NIST SP 800-82 Rev. 3) · United States - First key actions: structured access to advanced AI, testing platform, open source campaign, Grand Challenge
EU Action Plan on Cybersecurity and AI (2026) · European Union - New prohibitions under Regulation (EU) 2026/1744 and content marking for generative systems already on the market
AI Act (Regulation (EU) 2024/1689) · European Union - Within 180 days (Phase III): vulnerabilities remediated within the Table 1 timelines, continuous identification and tagging of externally reachable assets
BOD 26-04 – Security updates based on risk · United States - Member States strive to ensure a sufficient number of notified bodies
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - The law expires unless Congress extends or renews it again
Cybersecurity Information Sharing Act (CISA 2015) · United States - Deadline for risk-management measures by all essential and important entities and for aligning domain name registration databases
Information Security Act (ZInfV-1) · Slovenia - Deadline for the proposed amendment to the Federal Acquisition Regulation (FAR) requiring contractors to comply with FIPS, including the post-quantum standards, by 2030
Executive Order 14412 on post-quantum cryptography · United States - Each Member State must provide at least one European Digital Identity Wallet
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - Deadline for the Council of Ministers' implementing regulation (180 days after publication)
Law 13/2026 – Cybersecurity Law · Mozambique - No critical Huawei and ZTE components left in 5G core networks
Agreements on Huawei and ZTE components in 5G (Germany) · Germany - Exercise scenario template for entity and Member State exercises (then every three years)
Network code on electricity cybersecurity (NCCS) · European Union - First steps completed and national post-quantum cryptography roadmaps in all Member States
EU roadmap for post-quantum cryptography (2025) · European Union - End of the ban unless extended (extension to 2035 pending in Parliament)
Law 354/2022 on Russia-linked antivirus software (Romania) · Romania - End of the transitional period for operators already registered: security measures and audits under the previous rules and NBÚ review of their classification
Act No. 69/2018 Coll. on Cybersecurity · Slovakia - Last day for signature at United Nations Headquarters in New York
United Nations Convention against Cybercrime · United Nations - Deadline set by the strategy for decisions on the national cybersecurity architecture
Cybersecurity Strategy 2024-2030 "Cyber-conscious Estonia" · Estonia - EU evaluation capacity for AI models, including cybersecurity
EU Action Plan on Cybersecurity and AI (2026) · European Union - Deadline for adopting the implementing acts, including the national cybersecurity standard (12 months after entry into force)
Law HO-442-N on Cybersecurity · Armenia - Nuclear facility operators come within the scope of the act, supervised by STUK (Act 785/2026)
Cybersecurity Act · Finland - Entities added to the NIS list in 2026: the obligation to notify significant incidents starts (ACN Determination 127434/2026)
ACN Determination 379907/2025 – Basic NIS security measures and incident notification · Italy - The Information Security Office starts work and takes over the national CERT from RATEL
Law on Information Security (Serbia, 2025) · Serbia - Automated decision-making technology (ADMT) requirements for significant decisions apply
California Consumer Privacy Act of 2018 (CCPA) · United States - Browsers must let consumers send an opt-out preference signal against the sale and sharing of their data (section 1798.136, added by AB 566)
California Consumer Privacy Act of 2018 (CCPA) · United States - The FedRAMP Consolidated Rules for 2026 become mandatory for all stakeholders
FedRAMP Authorization Act (2022) · United States - Final deadline for the initial registration of essential and important entities
NISG 2026 (Austrian NIS 2 Act) · Austria - Deadline for the Council of Ministers to adopt the national risk assessment and the national strategy on the resilience of critical entities
Amendment to the Crisis Management Act (CER, 2026) · Poland - Date set by the order from which agencies must require the U.S. Cyber Trust Mark on the consumer IoT products they buy (through an amendment to the Federal Acquisition Regulation)
Executive Order 14306 on cybersecurity (2025) · United States - First biennial Commission report on implementation
Cybersecurity of EU institutions (2023/2841) · European Union - The regulation applies for the most part; Machinery Directive 2006/42/EC is repealed
Machinery Regulation (EU) 2023/1230 · European Union - 180-day deadline for removing Acronis products from agency information systems
DHS FASCSA order 2026-02 on Acronis · United States - First Commission evaluation of the regulation (then at least every four years)
Cyber Solidarity Act (Regulation (EU) 2025/38) · European Union - Within 12 months: decommissioning of listed devices already out of support and inventory of those reaching end of support in the following 12 months
BOD 26-02 – End-of-support edge devices · United States - Deadline for annual registration on the ACN platform (window opens 1 January); entities already listed with no changes do not file again
Legislative Decree 138/2024 – NIS 2 transposition · Italy - Online marketplaces with physical access to or title over a device must display its FCC ID
FCC Covered List (Secure Networks Act) · United States - Deadline for CISA guidance on the minimum elements of a cryptographic bill of materials (CBOM) and for the FAR proposal on vulnerability disclosure programmes
Executive Order 14412 on post-quantum cryptography · United States - Code of practice deadline for a set of security measures (Tier 1 and 2 providers)
Telecommunications (Security) Act 2021 · United Kingdom - Six-month deadline to declare important computer systems already in use at entry into force
Active Cyber Defense Act (2025) · Japan - Critical information infrastructure owners submit quantum-safe migration plans to the CSA
Singapore's Cybersecurity Strategy 2026 · Singapore - Deadline for operators to adopt the security act and the incident response plan (18 months)
Law on Information Security (Serbia, 2025) · Serbia - Article 45-5 and the related administrative fine introduced by Act No. 21500 take effect
Korea's Information and Communications Network Act · South Korea - Common procedural rules for cross-border cases apply (Regulation (EU) 2025/2518)
GDPR (Regulation (EU) 2016/679) · European Union - Deadline for the Chapter 3 obligations (security measures and incident handling) and for using the national S46 system
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - End of the 12 months during which entities may request exemption from fines for not yet having adapted to the new regime
DL 125/2025 – Legal framework for cybersecurity · Portugal - Deadline for the first identification of critical entities and their entry in the list
Amendment to the Crisis Management Act (CER, 2026) · Poland - First two-yearly update of the lists of essential and important entities and reporting of figures to the Commission
NIS 2 Directive (EU) 2022/2555 · European Union - Within 15 months: CISA report on agency progress to the Secretary of Homeland Security, OMB and the National Cyber Director
BOD 26-02 – End-of-support edge devices · United States - Substantive obligations apply: consent and notice, security safeguards, breach notification, data principals' rights and penalties
Digital Personal Data Protection Act 2023 (DPDP) · India - Rules 3, 5-16, 22 and 23 take effect: notice, security safeguards, 72-hour breach reporting, children, Significant Data Fiduciaries and transfers abroad
Digital Personal Data Protection Rules 2025 (DPDP) · India - Section 43A on compensation for failure to protect data is omitted and replaced by the Digital Personal Data Protection Act (section 44(2) of the DPDP Act)
India's Information Technology Act, 2000 · India - Deadline for the first National Catalogue of essential services and critical digital infrastructure, for setting up the national CSIRT and for the regulations on digital service providers and technical oversight
Organic Law for the Strengthening of Cybersecurity · Ecuador - Deadline for the annual update of information on the ACN platform (window opens 15 April)
ACN Determination 314287/2026 – NIS registration and platform · Italy - End of the 12-month grace period for the first enhanced requirements (additional material risks and part of the cyber and personnel requirements)
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - EU-CyCLONe agrees a common taxonomy of incident severity levels (within 24 months)
EU Cyber Blueprint for crisis management (2025) · European Union - Deadline for ISO/IEC 27001 certification of key entities (30 months)
Law on Information Security (Montenegro, 2024) · Montenegro - The twelve months given to critical infrastructure owners to comply with the Regulations expire
CII Designation Regulations 2026 (Mauritius) · Mauritius - Other online marketplaces must verify the FCC ID supplied by third-party sellers
FCC Covered List (Secure Networks Act) · United States - FedRAMP stops accepting applications for new Rev5 certifications
FedRAMP Authorization Act (2022) · United States - Critical entities in the public administration sector must meet their obligations
S.I. 559/2024 on critical entities (CER) · Ireland - Deadline for submitting the categorised list of activities and services (window opens 1 May)
ACN Determination 314287/2026 – NIS registration and platform · Italy - Service providers adopt internal security regulations, risk assessments and an incident prevention plan (18 months)
Law HO-442-N on Cybersecurity · Armenia - Two-year deadline to align the laws on trust services, electronic services, the population register, electronic communications and energy
NIS Law of North Macedonia (2025) · North Macedonia - End of the 12-month transition: information systems already classified must bring their protection measures up to the level required by the new law, and security products and services already in use must meet its conditions
Viet Nam's Law on Cybersecurity 2025 (116/2025/QH15) · Viet Nam - Amendments to Article 32-2(1) (data protection certification) and Article 75 introduced by Act No. 21445 take effect
Personal Information Protection Act (South Korea) · South Korea - Deadline for adopting the first national risk management plan
Amendment to the Crisis Management Act (CER, 2026) · Poland - Commission report on Member States' transposition measures
CER Directive (EU) 2022/2557 · European Union - Within one year: first review of the order by the Secretary of Homeland Security, then every year
DHS FASCSA order 2026-01 on DeepSeek · United States - Entities added to the NIS list in 2026: deadline to adopt the basic security measures (ACN Determination 127434/2026)
ACN Determination 379907/2025 – Basic NIS security measures and incident notification · Italy - Within one year: first review of the order by the Secretary of Homeland Security, then every year
DHS FASCSA order 2026-02 on Acronis · United States - 24-month deadline to bring cloud services already in use into line with the decree
Decree 2-24-921 on cloud services (Morocco) · Morocco - National AI regulatory sandboxes operational; compliance of general-purpose models placed on the market before August 2025
AI Act (Regulation (EU) 2024/1689) · European Union - Within 18 months: decommissioning of all identified end-of-support edge devices
BOD 26-02 – End-of-support edge devices · United States - Latest date for Chapters 3-7 on acquiring and analysing communications information to take effect (exact date set by Cabinet Order)
Active Cyber Defense Act (2025) · Japan - By end 2027 all home routers sold in Singapore must attain at least Level 2 of the Cybersecurity Labelling Scheme
Singapore's Cybersecurity Strategy 2026 · Singapore - High-risk systems under Annex III (date postponed by the Digital Omnibus)
AI Act (Regulation (EU) 2024/1689) · European Union - Conformity procedures for important and critical products apply as the CRA applies in full
CRA: important and critical products (Reg. 2025/2392) · European Union - Repealed by Delegated Regulation (EU) 2026/339: the Cyber Resilience Act takes over
RED Delegated Regulation (EU) 2022/30 · European Union - SZTFH market surveillance and the administrative fines for the CRA apply
Act CXXXV of 2025 (CRA implementation) · Hungary - Rules on market surveillance, the coordinating CSIRT, CE marking and administrative penalties apply
CRA implementing regulations (S.L. 591.06) · Malta - EU: mandatory for new L-category vehicle types (Delegated Regulation (EU) 2025/1455)
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - Review of the policy by the ATDT, due two years after entry into force
General Cybersecurity Policy for the APF (2025) · Mexico - Statutory sunset of sections 3607-3616 of Title 44 (unless extended)
FedRAMP Authorization Act (2022) · United States - The procurement and contracting bans on covered semiconductors apply
NDAA FY2023 § 5949 – SMIC, YMTC and CXMT chips · United States - Private relying parties required to use strong authentication must accept the wallet at the user's request
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - Deadline for bodies with permanent crisis tasks, including local authorities, to bring risk analyses and crisis plans into line with the new act
Crisis Situations and National Defence Act · Estonia - Last day to issue EUCC certificates based on earlier versions of the Common Criteria
EUCC certification scheme (Reg. 2024/482) · European Union - All Huawei equipment and services removed from 5G networks
Huawei Designated Vendor Direction (United Kingdom) · United Kingdom - Deadline to remove Huawei equipment from 5G networks (designated vendor direction)
Telecommunications (Security) Act 2021 · United Kingdom - Deadline to complete risk assessments for processing activities started before 2026 that are still ongoing
California Consumer Privacy Act of 2018 (CCPA) · United States - Completion of NIST's post-quantum migration pilot on its own systems
Executive Order 14412 on post-quantum cryptography · United States - End of Phase II (scaling cyber maturity, 2026-2028)
Papua New Guinea National Cyber Security Strategy 2024-2030 · Papua New Guinea - Critical information infrastructure operators and cybersecurity service providers submit proof of compliance with standards (24 months)
Law HO-442-N on Cybersecurity · Armenia - Critical information infrastructure owners factor quantum-safe considerations into the procurement and implementation of new systems
Singapore's Cybersecurity Strategy 2026 · Singapore - Exceptions for drones on the Blue UAS Cleared List and for domestic end products under Buy American expire
FCC Covered List (Secure Networks Act) · United States - Deadline for Tier 3 certification of the backup data centre
CNC Provision 1/2026 – Contingency plans and backup sites · Argentina - Within 24 months: continuous edge device discovery process and decommissioning by the end-of-support date
BOD 26-02 – End-of-support edge devices · United States - Minister's report to Parliament on the implementation review of the act
Cybersecurity Act (Cbw) · Netherlands - Deadline for the most complex measures and the first new measures of the revised code
Telecommunications (Security) Act 2021 · United Kingdom - First cybersecurity audit certifications (businesses with revenue above USD 100 million) and risk assessment attestations due
California Consumer Privacy Act of 2018 (CCPA) · United States - Deadline for the first audit of essential entities; financial penalties can be imposed from this date
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - End of the 24-month grace period for the other enhanced requirements: cyber and information security, credential compromise, lateral movement, personnel, supply chain and physical security
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Deadline for OMB guidance (including the revision of Circular A-130) on critical risks and modern architectures for federal systems
Executive Order 14306 on cybersecurity (2025) · United States - EU-type examination certificates issued on cybersecurity under other EU legislation expire
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Final deadline for notifying entities that they are high-impact or critical-impact entities
Network code on electricity cybersecurity (NCCS) · European Union - Obligations on cybersecurity measures (Articles 27-30 and 33 of the regime) and the related fines take effect
DL 125/2025 – Legal framework for cybersecurity · Portugal - The Legal Framework's obligations on cybersecurity measures and the related fines take effect, 24 months after the regulation's publication
CNCS Regulation 756/2026 (NIS 2 implementation) · Portugal - First report of the single points of contact on incident notifications (then every two years)
CER Directive (EU) 2022/2557 · European Union - First summary report by the single point of contact to the European Commission on notified incidents (then every two years)
Legislative Decree 134/2024 – CER transposition · Italy - First Commission evaluation and review report (then every four years)
Machinery Regulation (EU) 2023/1230 · European Union - High-risk systems under Annex I (date postponed by the Digital Omnibus)
AI Act (Regulation (EU) 2024/1689) · European Union - Deadline for the requirements on high-risk AI systems added by delegated acts to apply
Machinery Regulation (EU) 2023/1230 · European Union - Deadline for members of management bodies to have cybersecurity knowledge and skills
Cybersecurity Act (Cbw) · Netherlands - 01 series of amendments: Contracting Parties are no longer obliged to accept new approvals under the original version
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - Commission report on the effectiveness of the single reporting platform
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Deadline to deliver the 19 actions and 64 initiatives of Horizon 2
Australian cyber Horizon 2 Action Plan (2026-2028) · Australia - Deadline for a second set of new measures in the revised code of practice
Telecommunications (Security) Act 2021 · United Kingdom - Deadline for entities already in scope to comply with all requirements of the act and its implementing regulations (three years)
Amendment to the Cybersecurity Act (NIS 2, 2025) · Estonia - Expected entry into force of mandatory cybersecurity measures for maritime single windows (FAL Convention amendments)
Resolution MSC.428(98) – Maritime cyber risk management in safety… · International Maritime Organization (IMO) - OET waivers allowing permissive changes to covered drones and routers expire
FCC Covered List (Secure Networks Act) · United States - Commission evaluation of the functioning of the regulation
Cybersecurity of EU institutions (2023/2841) · European Union - Cybersecurity audit certifications due for businesses with revenue between USD 50 and 100 million
California Consumer Privacy Act of 2018 (CCPA) · United States - First review of the recommendation by the Commission (at least every four years)
EU Cyber Blueprint for crisis management (2025) · European Union - EU: mandatory also for existing L-category vehicle types
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - First Commission review report on the functioning of the Directive
CER Directive (EU) 2022/2557 · European Union - Next five-yearly Commission evaluation of ENISA and the certification framework
Cybersecurity Act (Regulation (EU) 2019/881) · European Union - EU: mandatory for the registration of new completed vehicles (built in several stages)
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - End of validity of documentation prepared under the previous version of the standard (three years after entry into force)
Estonian Information Security Standard (E-ITS) · Estonia - First five-yearly review of the strategy required under NIS 2 (indicative date)
Finland's Cyber Security Strategy 2024-2035 · Finland - Critical functions of Huawei and ZTE network management systems replaced in 5G access and transport networks
Agreements on Huawei and ZTE components in 5G (Germany) · Germany - First regional cybersecurity exercises (then every three years)
Network code on electricity cybersecurity (NCCS) · European Union - Deadline for the last set of new measures in the revised code of practice
Telecommunications (Security) Act 2021 · United Kingdom - Deadline for implementing technical information security measures (Art. 90)
Information Security Act (ISA) · Switzerland - Powers of federal ministries and Länder to set sector-specific minimum requirements take effect (§ 14(3)-(5))
KRITIS umbrella act (CER transposition) · Germany - Federal agencies must support Transport Layer Security 1.3 or a later version
Executive Order 14306 on cybersecurity (2025) · United States - Cybersecurity audit certifications due for businesses with revenue below USD 50 million
California Consumer Privacy Act of 2018 (CCPA) · United States - Minister's report to Parliament on the effectiveness and effects of the act
Critical Entities Resilience Act (Wwke) · Netherlands - 01 series of amendments: Contracting Parties are no longer obliged to accept approvals under the original version
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - First evaluation and review report on the regulation (then every four years)
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Transition completed for high-risk use cases
EU roadmap for post-quantum cryptography (2025) · European Union - High value assets and high-impact federal systems must use post-quantum cryptography for key establishment
Executive Order 14412 on post-quantum cryptography · United States - Quantum-vulnerable public-key algorithms (RSA, ECDSA, EdDSA, DH, ECDH and MQV) become deprecated under NIST standards
NIST IR 8547, transition to post-quantum cryptography · United States - Information security requirements extend to ground handling organisations (Delegated Regulation (EU) 2025/22)
Part-IS: aviation information security · European Union - Final deadline for the regional cybersecurity risk mitigation plans
Network code on electricity cybersecurity (NCCS) · European Union - Deadline for the minister's review of the Act, followed by a report to Parliament
Canada's cyber security act (former Bill C-8, 2026) · Canada - Deadline to complete quantum-safe migration of critical information infrastructure systems
Singapore's Cybersecurity Strategy 2026 · Singapore - High value assets and high-impact federal systems must use post-quantum cryptography for digital signatures
Executive Order 14412 on post-quantum cryptography · United States - Hague target: up to 1.5% of GDP a year, including for critical infrastructure and network defence
Cyber Defence Pledge · NATO - Transition completed for medium-risk use cases and as many systems as feasible
EU roadmap for post-quantum cryptography (2025) · European Union - The same algorithms are disallowed under NIST standards and guidelines
NIST IR 8547, transition to post-quantum cryptography · United States
No future deadline recorded.
Past deadlines (567)
- Late NIS declarations for 2026 can no longer be filed
ACN Determination 314287/2026 – NIS registration and platform · Italy - Part 3C on entities of special cybersecurity interest takes effect
Cybersecurity Act 2018 · Singapore - Legislative Decree 179/2026 adapting national law to the AI Act enters into force, giving ACN and AgID supervisory and sanctioning powers
Law 132/2025 – Artificial intelligence law · Italy - Deadline for federal agencies to submit their post-quantum migration plan to OMB and the National Cyber Director (M-26-15)
Executive Order 14412 on post-quantum cryptography · United States - National penalties apply and must be notified to the Commission by this date
Machinery Regulation (EU) 2023/1230 · European Union - Deadline for adopting and aligning the ordinances on security measures
Amendment to the Cybersecurity Act (2026) · Bulgaria - Amendment to the Cybersecurity Act enters into force, introducing reporting of near misses and security audits of essential entities
Amendment to the Cybersecurity Act (NIS 2, 2025) · Estonia - Third Report and Order (FCC 26-50) takes effect: logic-bearing components, recertification, online marketplaces
FCC Covered List (Secure Networks Act) · United States - Deadline for the Council of Ministers to adopt the national large-scale cyber crisis response plan and the Cybersecurity Strategy
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - End of the period, opened on 7 May 2026, for applications to enter the list of essential and important entities
Amendment to the National Cybersecurity System Act (NIS 2) · Poland - CISA's final rule is sent to OIRA (White House) for the review that precedes publication
CIRCIA (incident reporting, 2022) · United States - MCF regulations on security measures and management training (MCFFS 2026:11) and on security audits and scanning (MCFFS 2026:12) enter into force
Cybersecurity Act · Sweden - 24-hour incident reporting, user notification and the surcharge of up to 3% of turnover for repeated incidents take effect
Korea's Information and Communications Network Act · South Korea - Further amendments linked to the Active Cyber Defense Act take effect
Basic Act on Cybersecurity (2014) · Japan - Main entry into force: declaration of important computer systems and incident reporting for critical infrastructure operators
Active Cyber Defense Act (2025) · Japan - Deadline for adopting implementing regulations (12 months)
Law on Information Security (Serbia, 2025) · Serbia - Basic security measures set by ACN apply (entities listed in April 2025)
Legislative Decree 138/2024 – NIS 2 transposition · Italy - The Information Commission replaces the ICO as competent authority for digital service providers
The Network and Information Systems Regulations 2018 · United Kingdom - Deadline for the first designations of critical entities, the first national risk assessment and the first strategy
Critical Entities Resilience Act (Wwke) · Netherlands - National register of entities set up; digital service providers (DNS, cloud, data centres, managed services and online platforms) submit information for the ENISA register
Cybersecurity Act (Cbw) · Netherlands - Amendment takes effect (Act No. 21445): surcharges of up to 10% of turnover, notification of possible leaks, accountability of top management
Personal Information Protection Act (South Korea) · South Korea - Breaches of the CRA reporting obligations can be fined
Act 439/2026 on product cyber resilience (CRA) · Finland - Obligation to report actively exploited vulnerabilities and severe incidents through the ENISA single reporting platform
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Public Law 119-103 extends the law until 11 December 2026
Cybersecurity Information Sharing Act (CISA 2015) · United States - Deadline for the Council of Ministers to designate the competent authorities and adopt the methodology
Amendment to the Cybersecurity Act (2026) · Bulgaria - Within 60 days (Phase II): vulnerability management processes extended to the CVE database and the KEV Catalog; CISA publishes the data requirements for asset tagging
BOD 26-04 – Security updates based on risk · United States - Applications open for the new FedRAMP 20x Class A certifications (Classes B and C follow on 31 August 2026)
FedRAMP Authorization Act (2022) · United States - Most rules apply, including transparency obligations
AI Act (Regulation (EU) 2024/1689) · European Union - Deadline for the classified benchmarking process for the cyber capabilities of AI models, with the covered frontier model threshold, for the voluntary framework with developers and for expanding the hiring of cybersecurity specialists in the US Tech Force
Executive Order 14409 on AI innovation and security · United States - Updated CISA report on cross-agency status
ED 25-03 – Compromise of Cisco ASA devices · United States - Law 7590 transfers BTK duties and internet oversight to the Cyber Security Presidency
Türkiye's Cyber Security Law (Law No. 7545) · Türkiye - Foreign-produced power inverters and advanced robotic devices added
FCC Covered List (Secure Networks Act) · United States - Deadline for the first identification of critical entities; designations of critical infrastructure elements under the previous rules expire
Act 367/2024 on critical infrastructure (CER) · Slovakia - Deadline for the Government to designate critical entities and their critical infrastructure
Critical Infrastructure Act (ZKI-1) · Slovenia - Deadline to adopt, by an unpublished Prime Ministerial Decree, the list of critical entities; obligations apply ten months after each entity is notified
Legislative Decree 134/2024 – CER transposition · Italy - Deadline for competent authorities to identify critical entities
S.I. 559/2024 on critical entities (CER) · Ireland - Deadline to report the outcome of the designations to the European Commission
Act LXXXIV of 2024 on the resilience of critical entities · Hungary - Deadline for the first decisions designating critical entities
Act 310/2025 on critical infrastructure (CER) · Finland - Ban on importing and marketing previously authorised equipment added in 2024 or earlier takes effect (DA 26-635)
FCC Covered List (Secure Networks Act) · United States - Phase 2 (third-party certification, planned from 10 November 2026) and later phases suspended pending a programme review
CMMC Program (32 CFR Part 170) · United States - International services of Digitalsystem Technology Inc. (section 214) added
FCC Covered List (Secure Networks Act) · United States - EU: mandatory for the registration of all new complete vehicles
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - Deadline for the action plan against scam centres and cybercrime, including an operational cell within the National Coordination Center
Executive Order 14390 on cybercrime and fraud · United States - Deadline to prioritise the cyber defence of national security systems and Department of War systems, for CISA's Binding Operational Directives on federal civilian systems and for setting up the Treasury-led AI cybersecurity clearinghouse on software vulnerabilities
Executive Order 14409 on AI innovation and security · United States - MCF regulations on incident reporting and information obligations enter into force (MCFFS 2026:8)
Cybersecurity Act · Sweden - Indicative deadline for the national classification of digital security incidents and the first annual operations plan of the National Digital Security Centre
DS 126-2025-PCM – Digital Trust Framework regulation · Peru - Twelve-month deadline for the detailed lists of entities, the CSIRT for executive bodies and the national CSIRT network
NIS Law of North Macedonia (2025) · North Macedonia - Deadline for the first cybersecurity audit of entities operating before 2025
Act LXIX of 2024 on the cybersecurity of Hungary · Hungary - OMB issues memorandum M-26-15 on executing the migration to post-quantum cryptography
Executive Order 14412 on post-quantum cryptography · United States - Cybersecurity certification regulation: NSM becomes national certification authority
Act on Digital Security (Digital Security Act) · Norway - Deadline for risk-management measures by former operators of essential services, state administration bodies and electronic communications operators, and for adopting the cybersecurity strategy
Information Security Act (ZInfV-1) · Slovenia - Deadline for the ATDT to issue the technical guidelines, compliance criteria and official forms implementing the policy
General Cybersecurity Policy for the APF (2025) · Mexico - Royal assent; the amendments to the Telecommunications Act (Part 1) take effect
Canada's cyber security act (former Bill C-8, 2026) · Canada - ENTSO-E feasibility study on a common tool for sharing information with authorities
Network code on electricity cybersecurity (NCCS) · European Union - Rules on the SZTFH as notifying authority and on conformity assessment bodies apply
Act CXXXV of 2025 (CRA implementation) · Hungary - Rules on conformity assessment bodies apply
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Horizon 2 Action Plan (2026-2028) announced: 19 actions and 64 initiatives to be delivered by the end of 2028
2023-2030 Australian Cyber Security Strategy · Australia - Revoked and superseded by BOD 26-04
BOD 22-01 – Known exploited vulnerabilities (KEV) · United States - Revoked and superseded by BOD 26-04
BOD 19-02 – Vulnerability remediation for internet systems · United States - Enhanced risk management program requirements (F2026L00701) commence for broadcasting, DNS, electricity, energy market operator, freight, gas, liquid fuel and water assets
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Deadline for the Attorney General's recommendation on a Victims Restoration Program for victims of cyber-enabled fraud
Executive Order 14390 on cybercrime and fraud · United States - End of the 50% reduction of fines and penalties for infringements committed up to this date
Amendment to the Cybersecurity Act (2026) · Bulgaria - Indicative deadline for the Secretariat of Government and Digital Transformation to approve the protocols, channels and deadlines for reporting digital security incidents
DS 126-2025-PCM – Digital Trust Framework regulation · Peru - Publication in the Registro Oficial and entry into force; penalties apply at once in sectors with a specialised supervisory body, such as finance and telecommunications
Organic Law for the Strengthening of Cybersecurity · Ecuador - Entry into force
Prime Ministerial Decree of 22 April 2026 – National security crisis management · Italy - Commission review report on the application of the regulation
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - Deadline for the review of operational, technical, diplomatic and regulatory frameworks against transnational criminal organisations engaged in cyber-enabled crime
Executive Order 14390 on cybercrime and fraud · United States - Within 3 months: inventory of the devices on CISA's EOS Edge Device List
BOD 26-02 – End-of-support edge devices · United States - CISA report on implementation status to the Secretary of Homeland Security, the National Cyber Director and OMB
ED 26-03 – Cisco SD-WAN vulnerabilities · United States - Inventory of Firepower and Secure Firewall devices, with actions taken and results, submitted to CISA
ED 25-03 – Compromise of Cisco ASA devices · United States - Deadline for the Ministry of Defence report to the Cabinet on implementation, with proposals for the following years
Cybersecurity Strategy of Latvia 2023-2026 · Latvia - Entry into force
ACN Determination 155238/2026 – Categorisation of NIS activities and services · Italy - Hard reset of Firepower and Secure Firewall devices by unplugging the power supply
ED 25-03 – Compromise of Cisco ASA devices · United States - Core dumps and updates of public-facing Firepower and Secure Firewall devices (11:59 PM)
ED 25-03 – Compromise of Cisco ASA devices · United States - Version V1: extended to Firepower and Secure Firewall devices after the FIRESTARTER malware
ED 25-03 – Compromise of Cisco ASA devices · United States - The Cyber Communications Information Supervisory Commission is set up (Chapter 10, Section 1)
Active Cyber Defense Act (2025) · Japan - Deadline for entities already in scope to send RIA the information required for the list of entities (three months after entry into force)
Amendment to the Cybersecurity Act (NIS 2, 2025) · Estonia - The Office for IT and eGovernment takes over the new Office's tasks on an interim basis
Law on Information Security (Serbia, 2025) · Serbia - Twelve-month deadline for the initial designation order for critical information infrastructure and essential services
Marshall Islands Cybersecurity Act 2025 · Marshall Islands - Amendment promulgated (Act No. 21500) introducing 24-hour incident reporting and penalties for repeated incidents
Korea's Information and Communications Network Act · South Korea - Cisco SD-WAN syslog logs provided to CISA through the CLAW programme, with a report
ED 26-03 – Cisco SD-WAN vulnerabilities · United States - Version V1: new log requirements and an additional reporting deadline
ED 26-03 – Cisco SD-WAN vulnerabilities · United States - Deadline for entities to register with the BSI (three months after entry into force)
NIS2UmsuCG (German NIS 2 Act) · Germany - Detailed report on inventory, artefacts, updates and threat hunting
ED 26-03 – Cisco SD-WAN vulnerabilities · United States - The security standard for consumer smart devices applies (Cyber Security (Security Standards for Smart Devices) Rules 2025)
Cyber Security Act 2024 · Australia - CISA report on cross-agency implementation status
ED 26-01 – F5 device vulnerabilities · United States - Organisational session of the Global Mechanism, to be held by March 2026
UN OEWG on ICT security: final report (2025) · United Nations - Cisco updates applied for the listed vulnerabilities (5:00 PM ET)
ED 26-03 – Cisco SD-WAN vulnerabilities · United States - Deadline to complete national certifications started by 27 February 2025
EUCC certification scheme (Reg. 2024/482) · European Union - Inventory of Cisco SD-WAN systems, collection of forensic artefacts and first report to CISA (11:59 PM ET)
ED 26-03 – Cisco SD-WAN vulnerabilities · United States - Part-IS requirements apply to authorities and organisations
Part-IS: aviation information security · European Union - Deadline for federal agencies and entities to appoint their institutional cybersecurity officer and deputy and notify the ATDT
General Cybersecurity Policy for the APF (2025) · Mexico - Deadline for the government to adopt the medium-term strategic planning act on cybersecurity
Cybersecurity Act · Croatia - ENISA issues interoperability guidelines for Cross-Border Cyber Hubs
Cyber Solidarity Act (Regulation (EU) 2025/38) · European Union - Public Law 119-75 extends the law until 30 September 2026
Cybersecurity Information Sharing Act (CISA 2015) · United States - MCF regulations on the notification and identification of essential and important entities enter into force (MCFFS 2026:1)
Cybersecurity Act · Sweden - End of the 120-day suspension of enforcement ordered by Executive Order 14352
PAFACA – Foreign adversary controlled apps (TikTok) · United States - OMB rescinds memoranda M-22-18 and M-23-16 (memorandum M-26-05); agencies may choose whether to use the form
Secure software development attestation (CISA, 2024) · United States - Deadline for the Government to approve the strategy
Act 367/2024 on critical infrastructure (CER) · Slovakia - Deadline for the Government to adopt the strategy and the national risk assessment
Critical Infrastructure Act (ZKI-1) · Slovenia - Deadline for approving the national strategy and the national risk assessment
DL 22/2025 on critical entities (CER) · Portugal - Deadline for the sectoral competent authorities to identify critical entities and report them to the single point of contact
Legislative Decree 134/2024 – CER transposition · Italy - Deadline for the national strategy and the national risk assessment
S.I. 559/2024 on critical entities (CER) · Ireland - Government adoption of the strategy and of the national risk assessment
Act LXXXIV of 2024 on the resilience of critical entities · Hungary - Deadline for the government to adopt the strategic act on the resilience of critical entities and the national critical infrastructure risk assessment
Critical Infrastructure Act · Croatia - Deadline to approve the national plan for the resilience of critical entities and the national risk assessment
Act 310/2025 on critical infrastructure (CER) · Finland - Entry into force
ACN Determination 379907/2025 – Basic NIS security measures and incident notification · Italy - Directive retired by CISA because its objectives were achieved
ED 24-02 – Compromise of Microsoft corporate email · United States - Directive retired by CISA: requirements transferred to BOD 22-01 and the KEV Catalog
ED 22-03 – VMware vulnerabilities · United States - Directive retired by CISA: requirements transferred to BOD 22-01 and the KEV Catalog
ED 21-04 – Windows Print Spooler vulnerability · United States - Directive retired by CISA: requirements transferred to BOD 22-01 and the KEV Catalog
ED 21-03 – Pulse Connect Secure vulnerabilities · United States - Directive retired by CISA: requirements now covered by BOD 22-01 and the KEV Catalog
ED 21-02 – Microsoft Exchange on-premises vulnerabilities · United States - Directive retired by CISA because its objectives were achieved
ED 21-01 – SolarWinds Orion code compromise · United States - Directive retired by CISA: requirements transferred to BOD 22-01 and the KEV Catalog
ED 20-04 – Netlogon vulnerability · United States - Directive retired by CISA: requirements transferred to BOD 22-01 and the KEV Catalog
ED 20-03 – Windows DNS Server vulnerability · United States - Directive retired by CISA: requirements transferred to BOD 22-01 and the KEV Catalog
ED 20-02 – Windows vulnerabilities, January 2020 · United States - Directive retired by CISA because its objectives were achieved
ED 19-01 – DNS infrastructure tampering · United States - Deadline for approving the cybersecurity plan
Cybersecurity of EU institutions (2023/2841) · European Union - Regulations on cybersecurity audits, risk assessments and automated decision-making take effect
California Consumer Privacy Act of 2018 (CCPA) · United States - The NBÚ becomes the market surveillance authority for products with digital elements (CRA, Act No. 318/2025)
Act No. 69/2018 Coll. on Cybersecurity · Slovakia - The Law starts to apply, except for the sectors deferred until EU accession
NIS Law of North Macedonia (2025) · North Macedonia - Part-IS applies to the EGNOS air navigation service provider
Part-IS: aviation information security · European Union - The amendment takes effect: AI provisions, higher penalties and measures against foreign entities
Cybersecurity Law of the People's Republic of China · China - Deadline for classifying the Confederation's IT resources (Art. 90)
Information Security Act (ISA) · Switzerland - Basic incident notification obligations set by ACN apply
Legislative Decree 138/2024 – NIS 2 transposition · Italy - End of the transitional regime: the 2016 law's duties for designated operators cease
Law on Information Security (Serbia, 2025) · Serbia - Huawei high data rate transmission equipment removed from core networks
Huawei Designated Vendor Direction (United Kingdom) · United Kingdom - Deadline for the FAR Council's implementing regulations
NDAA FY2023 § 5949 – SMIC, YMTC and CXMT chips · United States - Foreign-produced drones (UAS) and their critical components, and DJI and Autel equipment, added
FCC Covered List (Secure Networks Act) · United States - Deadline for the first registration of entities through the self-registration system
Information Security Act (ZInfV-1) · Slovenia - Within one year: CISA report on agency progress to the Secretary of Homeland Security, OMB and the National Cyber Director
BOD 25-01 – Secure practices for cloud services · United States - Deadline for the implementing act on important and critical product categories (adopted as Regulation 2025/2392)
Cyber Resilience Act (Regulation (EU) 2024/2847) · European Union - Deemed compliance for products certified under JC-STAR (Japan) or CLS (Singapore)
PSTI Act 2022 (connected product security) · United Kingdom - Detailed inventory of all in-scope F5 product instances submitted to CISA
ED 26-01 – F5 device vulnerabilities · United States - Deadline for the preliminary update of NIST's Secure Software Development Framework (SSDF) and for CISA's list of product categories supporting post-quantum cryptography
Executive Order 14306 on cybersecurity (2025) · United States - CISA report on cross-agency status
ED 25-02 – Microsoft Exchange hybrid vulnerability · United States - The General Assembly endorses the report (resolution 80/16)
UN OEWG on ICT security: final report (2025) · United Nations - The full revision of the Act (35 articles) promulgated on 24 September 2025 takes effect
Taiwan's Cyber Security Management Act (2018) · Taiwan - The European Supervisory Authorities designate the first 19 critical ICT third-party providers
DORA (Regulation (EU) 2022/2554) · European Union - First provisions take effect, including those on the Data Protection Board, which is established (notifications G.S.R. 843(E) and 844(E))
Digital Personal Data Protection Act 2023 (DPDP) · India - The continuing appropriations act (Public Law 119-37) restores the law until 30 January 2026
Cybersecurity Information Sharing Act (CISA 2015) · United States - The DFARS rule (48 CFR) takes effect and Phase 1 begins (self-assessment for Levels 1 and 2)
CMMC Program (32 CFR Part 170) · United States - Amendment Act No. 17 of 2025 comes into force: the NC4 may direct that unlawful websites and applications be made inaccessible
Computer Misuse and Cybercrimes Act 2018 · Kenya - Latest software patch and F5 hardening guidance applied to the other F5 devices
ED 26-01 – F5 device vulnerabilities · United States - Most of the 2024 amendment takes effect: critical infrastructure located abroad, third-party-owned critical infrastructure (Part 3A), systems of temporary cybersecurity concern (Part 3B), codes of practice and standards (notification S 677/2025)
Cybersecurity Act 2018 · Singapore - Summary of in-scope F5 products submitted to CISA (11:59 PM ET)
ED 26-01 – F5 device vulnerabilities · United States - The NPC Standing Committee adopts the decision amending the law
Cybersecurity Law of the People's Republic of China · China - F5OS, TMOS, BIG-IQ and BNK/CNF updated to the vendor's latest release
ED 26-01 – F5 device vulnerabilities · United States - Delegated Regulation (EU) 2022/1645 applies (aerodromes and design and production organisations)
Part-IS: aviation information security · European Union - Complete inventory of in-scope products, with actions taken and results, submitted to CISA
ED 25-03 – Compromise of Cisco ASA devices · United States - The Act and its implementing regulation (digitalsikkerhetsforskriften) enter into force
Act on Digital Security (Digital Security Act) · Norway - Penalties for failing to comply with BACS decisions apply (up to CHF 100,000)
Information Security Act (ISA) · Switzerland - The last provision, deferred by six months, enters into force
Law No. 4336-IX on cyber protection (Ukraine, 2025) · Ukraine - Permanent disconnection of ASA hardware reaching end of support by this date
ED 25-03 – Compromise of Cisco ASA devices · United States - The law's original sunset date passes; its protections lapse during the federal funding gap
Cybersecurity Information Sharing Act (CISA 2015) · United States - Extended deadline for essential and important entities to register on the National Cybersecurity Authority platform
Law 5160/2024 transposing NIS 2 · Greece - Core dumps of public-facing ASA devices submitted to CISA and updates applied (11:59 PM)
ED 25-03 – Compromise of Cisco ASA devices · United States - Deadline for taking cybersecurity risk-management measures
Cybersecurity of EU institutions (2023/2841) · European Union - Deadline for entities operating before 2025 to sign an agreement with a registered auditor
Act LXIX of 2024 on the cybersecurity of Hungary · Hungary - Release 5.2.0, with new controls on software updates and patches
Security and Privacy Controls for Information Systems and… · United States - Inventory of Exchange servers, disconnection of end-of-life servers and updates for hybrid environments (9:00 AM EDT); report to CISA by 5:00 PM EDT
ED 25-02 – Microsoft Exchange hybrid vulnerability · United States - General-purpose AI models, governance and penalties
AI Act (Regulation (EU) 2024/1689) · European Union - Cybersecurity requirements for radio equipment apply
RED Delegated Regulation (EU) 2022/30 · European Union - Law 25-11 amending the Law is published: mandatory data protection officer and records of processing
Law 18-07 on personal data · Algeria - First cybersecurity maturity assessment (then at least every two years)
Cybersecurity of EU institutions (2023/2841) · European Union - The Cybersecurity Strategic Headquarters comes under the Prime Minister's leadership; the National Cybersecurity Office replaces the NISC
Basic Act on Cybersecurity (2014) · Japan - The general provisions (Chapter 1) and Articles 76-78 take effect
Active Cyber Defense Act (2025) · Japan - Deadline for the Government to adopt implementing acts (three months)
Law No. 4336-IX on cyber protection (Ukraine, 2025) · Ukraine - Mandatory SCuBA policies in effect at issuance implemented
BOD 25-01 – Secure practices for cloud services · United States - Within 2 years: CISA review of the directive and of its guidance on management interfaces
BOD 23-02 – Internet-exposed management interfaces · United States - Cyber-attack classification scale methodology and ACER guidelines on information sharing
Network code on electricity cybersecurity (NCCS) · European Union - Deadline for adopting implementing regulations (six months after entry into force)
Law on Information Security (Montenegro, 2024) · Montenegro - Part 3, with the duty to report ransomware payments within 72 hours, and Part 5 on the Cyber Incident Review Board commence
Cyber Security Act 2024 · Australia - Start of the first designation procedures for critical entities
Act LXXXIV of 2024 on the resilience of critical entities · Hungary - SCuBA assessment tools deployed and continuous reporting to CISA started
BOD 25-01 – Secure practices for cloud services · United States - Member States establish the list of essential and important entities
NIS 2 Directive (EU) 2022/2555 · European Union - Each Union entity establishes its internal risk-management, governance and control framework
Cybersecurity of EU institutions (2023/2841) · European Union - Telecommunications security obligations move from the Telecommunications Act 1997 into this Act
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - Critical infrastructure operators must report cyberattacks within 24 hours
Information Security Act (ISA) · Switzerland - Deadline for entities to remove Kaspersky products and web services, prevent their installation and report completion
PSPF Direction 002-2025 on Kaspersky (Australia) · Australia - Transmission system operators submit the risk assessment methodologies; provisional list of high-impact and critical-impact entities notified
Network code on electricity cybersecurity (NCCS) · European Union - With the grace period over (28 February 2025), providers of managed SOC monitoring and penetration testing services must hold a licence
Malaysia's Cyber Security Act 2024 (Act 854) · Malaysia - Registration deadline for existing essential and important entities (four weeks)
Cyber Security Act (CSG) of 5 December 2024 (Liechtenstein) · Liechtenstein - Articles 5, 8 and 9 and Title VII take effect, including the duty to report incidents to the national CSIRT and the penalty regime
Chile's Cybersecurity Framework Law (Law 21.663) · Chile - The regulation applies; national schemes covered by EUCC cease to produce effects
EUCC certification scheme (Reg. 2024/482) · European Union - Inventory of in-scope cloud tenants (tenant name and owning agency), to be updated annually in the first quarter
BOD 25-01 – Secure practices for cloud services · United States - Deadline for the first categorisation of essential and important entities and for setting up the special register of entities
Cybersecurity Act · Croatia - Public comment period on the draft update closes
NCIRP – National Cyber Incident Response Plan (2016) · United States - The Executive Yuan meeting sets the rules: ban in principle, exceptions only with approval and control measures
DeepSeek ban in government agencies (Taiwan, 2025) · Taiwan - Premier Cho Jung-tai orders a full ban on DeepSeek AI services in government agencies
DeepSeek ban in government agencies (Taiwan, 2025) · Taiwan - The Cyber Security (Exemption) Order 2025 (P.U.(A) 47/2025) takes effect, exempting nine companies of the Amazon Web Services, Google and Microsoft groups and Pearl Computing from the whole Act
Malaysia's Cyber Security Act 2024 (Act 854) · Malaysia - The Act and its implementing ordinance (CSV) enter into force
Cyber Security Act (CSG) of 5 December 2024 (Liechtenstein) · Liechtenstein - The bans on distributing, maintaining and updating TikTok and other ByteDance applications apply
PAFACA – Foreign adversary controlled apps (TikTok) · United States - Incident reporting duties extend to municipalities with over 100,000 inhabitants and regional capitals, public transport companies, local health authorities and in-house companies (180th day after entry into force)
Law 90/2024 – National cybersecurity and computer crimes · Italy - Proposed revision to strengthen cybersecurity published (90 FR 898)
HIPAA Security Rule · United States - The reform transposing NIS 2 enters into force (Act No. 366/2024)
Act No. 69/2018 Coll. on Cybersecurity · Slovakia - Deadline to phase out Huawei and ZTE products from central functions used in the 3.5 and 2.3 GHz bands
PTS conditions on Huawei and ZTE in 5G networks (Sweden) · Sweden - End of Phase I (foundational strengthening, 2024-2025)
Papua New Guinea National Cyber Security Strategy 2024-2030 · Papua New Guinea - The first implementing regulations on European Digital Identity Wallets enter into force
eIDAS 2 (Regulation (EU) 2024/1183) · European Union - The 2024 amendments take effect (Act No. 100, 2024): data storage systems holding business critical data, directions to manage the consequences of incidents, use of protected information and directions to vary risk management programs
Security of Critical Infrastructure Act 2018 (SOCI) · Australia - CISA publishes the draft update of the plan for public comment
NCIRP – National Cyber Incident Response Plan (2016) · United States - Deadline for each Member State to designate its competent authority
Network code on electricity cybersecurity (NCCS) · European Union - End of signature and codebase updates, the KSN network and resale, integration and licensing of Kaspersky software
ICTS ban on Kaspersky (US Commerce, 2024) · United States - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 24-02 – Compromise of Microsoft corporate email · United States - Administrative Instruction No. 03/2024 on incident notification is published: initial notification within 24 hours, then interim and final reports
Kosovo's Law No. 08/L-173 on Cyber Security · Kosovo - OMB publishes memorandum M-24-15 implementing the programme
FedRAMP Authorization Act (2022) · United States - Kaspersky may no longer enter into new agreements with US persons for the products concerned
ICTS ban on Kaspersky (US Commerce, 2024) · United States - EU: mandatory for all new vehicle types and for the registration of new vehicles whose software the manufacturer updates
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - EU: mandatory for the registration of all new vehicles of categories M and N
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - Deadline for comments on the CIRCIA proposed rule
CIRCIA – Proposed reporting rule (2024) · United States - The Form 8-K Item 1.05 requirement also applies to smaller reporting companies
SEC cybersecurity disclosure rules (2023) · United States - CISA report on cross-agency status
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - Status update submitted to CISA (11:59 PM)
ED 24-02 – Compromise of Microsoft corporate email · United States - Credentials in associated applications reset, logs reviewed and cybersecurity impact analysis of the exfiltrated correspondence
ED 24-02 – Compromise of Microsoft corporate email · United States - The connectable product security regime (Part 1) applies
PSTI Act 2022 (connected product security) · United Kingdom - Report to CISA on the status of all required actions (11:59 PM)
ED 24-02 – Compromise of Microsoft corporate email · United States - CISA publishes the proposed implementing rule (89 FR 23644, 6 CFR Part 226)
CIRCIA (incident reporting, 2022) · United States - At 18 months: progress report and CISA review of the directive
BOD 23-01 – Asset visibility and vulnerability detection · United States - On-premises passwords reset twice, Kerberos tickets and cloud tokens revoked, with a report to CISA
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - The 2024 Amendment Act is signed into law: reporting of attacks within 72 hours and a 0.5% cybersecurity levy
Cybercrimes Act 2015 · Nigeria - Update for CVE-2024-22024 applied to products already returned to service (11:59 PM)
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - Supplemental Direction V2: vulnerability CVE-2024-22024 added
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - All affected Ivanti products disconnected from agency networks (11:59 PM)
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - Supplemental Direction V1: affected products disconnected and rebuilt before returning to service
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - Within one week: inventory of affected instances reported to CISA
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - Ivanti mitigation XML file imported, followed immediately by the external Integrity Checker Tool (11:59 PM EST)
ED 24-01 – Ivanti Connect Secure and Policy Secure · United States - Huawei removed from core network functions
Huawei Designated Vendor Direction (United Kingdom) · United Kingdom - Duty to disclose material incidents on Form 8-K (Item 1.05) applies to all companies except smaller reporting companies
SEC cybersecurity disclosure rules (2023) · United States - Annual reports for fiscal years ending on or after this date must describe cybersecurity risk management, strategy and governance (Regulation S-K Item 106)
SEC cybersecurity disclosure rules (2023) · United States - Within 6 months (then yearly): CISA report on compliance to the Secretary of Homeland Security and OMB
BOD 23-02 – Internet-exposed management interfaces · United States - Huawei share of full-fibre (FTTP) networks capped at 35%
Huawei Designated Vendor Direction (United Kingdom) · United Kingdom - At 12 months: progress report through CyberScope or the CDM review
BOD 23-01 – Asset visibility and vulnerability detection · United States - Huawei share of 5G access networks capped at 35%
Huawei Designated Vendor Direction (United Kingdom) · United Kingdom - Vilnius Summit: the pledge is restated and enhanced with new national goals
Cyber Defence Pledge · NATO - Within 120 days: the prohibition is included in solicitations and contract extensions
No TikTok on Government Devices Act (2022) · United States - Within 90 days: no new contracts requiring the use of TikTok
No TikTok on Government Devices Act (2022) · United States - Automated asset discovery every 7 days and vulnerability enumeration every 14 days begin, with results sent to the CDM Dashboard; first progress report
BOD 23-01 – Asset visibility and vulnerability detection · United States - Within 30 days of the memorandum: agencies remove TikTok and block its installation and traffic
No TikTok on Government Devices Act (2022) · United States - Deadline for OMB standards, issued the same day in memorandum M-23-13
No TikTok on Government Devices Act (2022) · United States - Ban on Huawei equipment at sites significant to national security
Huawei Designated Vendor Direction (United Kingdom) · United Kingdom - The California Privacy Rights Act (Proposition 24) amendments apply
California Consumer Privacy Act of 2018 (CCPA) · United States - Agencies not yet reporting through CDM update their status in CyberScope every two weeks
BOD 22-01 – Known exploited vulnerabilities (KEV) · United States - Within 2 years: all internet-accessible systems and services in scope of the policy
BOD 20-01 – Vulnerability disclosure policy · United States - EU: mandatory for the type approval of new vehicle types whose software the manufacturer updates after registration
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - EU: mandatory for the type approval of new vehicle types of categories M and N
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - Status of all instances reported in CyberScope (12:00 pm EDT)
ED 22-03 – VMware vulnerabilities · United States - Inventory of affected VMware products, updates or removal, and internet-accessible instances disconnected for threat hunting (5 pm EDT)
ED 22-03 – VMware vulnerabilities · United States - Directive closed by CISA: requirements transferred to BOD 22-01
ED 22-02 – Apache Log4j vulnerability · United States - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 22-02 – Apache Log4j vulnerability · United States - Within 60 days: internal vulnerability management procedures reviewed and updated
BOD 22-01 – Known exploited vulnerabilities (KEV) · United States - Report to CISA on each affected application and the action taken (5 pm EST)
ED 22-02 – Apache Log4j vulnerability · United States - Internet-facing solution stacks with vulnerable Log4j identified and patched, mitigated or removed (5 pm EST)
ED 22-02 – Apache Log4j vulnerability · United States - The General Assembly calls on States to be guided by the report (resolution 76/19)
Report of the Group of Governmental Experts on Advancing Responsible… · United Nations - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 21-04 – Windows Print Spooler vulnerability · United States - CIO-attested completion report to CISA (12:00 pm EDT)
ED 21-04 – Windows Print Spooler vulnerability · United States - July 2021 cumulative updates on all Windows Servers and workstations and measures on the other hosts (11:59 PM EDT)
ED 21-04 – Windows Print Spooler vulnerability · United States - Supplemental Direction V4: pre-eviction and eviction instructions for networks with follow-on activity (noon EDT)
ED 21-01 – SolarWinds Orion code compromise · United States - Print Spooler service stopped and disabled on all Active Directory domain controllers (11:59 PM EDT)
ED 21-04 – Windows Print Spooler vulnerability · United States - Hardening measures for Exchange servers (firewall, updates within 48 hours, logs kept 180 days, anti-malware) and report to CISA
ED 21-02 – Microsoft Exchange on-premises vulnerabilities · United States - Within 270 days: policy scope extended to at least one more system, then every 90 days; quarterly metrics in CyberScope begin
BOD 20-01 – Vulnerability disclosure policy · United States - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 21-03 – Pulse Connect Secure vulnerabilities · United States - Inventory of Pulse Connect Secure appliances, Integrity Tool run on every instance and CIO-attested report to CISA (5 pm EDT)
ED 21-03 – Pulse Connect Secure vulnerabilities · United States - Microsoft updates of 13 April 2021 deployed to all affected Exchange servers, or servers removed, with a report to CISA
ED 21-02 – Microsoft Exchange on-premises vulnerabilities · United States - Status report submitted to CISA, attested by the department-level CIO (noon EST)
ED 21-02 – Microsoft Exchange on-premises vulnerabilities · United States - Within 180 days: vulnerability disclosure policy published on the primary .gov website, with report handling procedures
BOD 20-01 – Vulnerability disclosure policy · United States - Entry into force
UN R156 – Vehicle software updates · United Nations Economic Commission for Europe (UNECE) - Entry into force
UN R155 – Vehicle cybersecurity · United Nations Economic Commission for Europe (UNECE) - Supplemental Guidance V3: network categories, forensic analysis and 12 conditions for continuing to run Orion
ED 21-01 – SolarWinds Orion code compromise · United States - Cyber risks to be addressed in ships’ safety management systems (first annual DOC verification)
Resolution MSC.428(98) – Maritime cyber risk management in safety… · International Maritime Organization (IMO) - Indicators of compromise reported to CISA and status report submitted, attesting that affected products were disconnected (12 pm EST)
ED 21-01 – SolarWinds Orion code compromise · United States - Update with errata (Release 5.1)
Security and Privacy Controls for Information Systems and… · United States - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 20-04 – Netlogon vulnerability · United States - Within 30 days: security contact and Organization field updated for each .gov domain
BOD 20-01 – Vulnerability disclosure policy · United States - CIO-attested completion report to CISA (11:59 PM EDT)
ED 20-04 – Netlogon vulnerability · United States - August 2020 update applied to all Active Directory domain controllers, or controllers removed from the network (11:59 PM EDT)
ED 20-04 – Netlogon vulnerability · United States - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 20-03 – Windows DNS Server vulnerability · United States - Part B (no contracts with entities that use covered equipment) and the ban on loan and grant funds apply
NDAA FY2019 § 889 – Huawei, ZTE and video surveillance · United States - July 2020 update on all Windows Servers, registry workaround removed and CIO-attested completion report
ED 20-03 – Windows DNS Server vulnerability · United States - July 2020 security update or registry workaround applied to all Windows Servers running the DNS role (2 pm EDT)
ED 20-03 – Windows DNS Server vulnerability · United States - CISA report on cross-agency status to the Secretary of Homeland Security and OMB
ED 20-02 – Windows vulnerabilities, January 2020 · United States - Within 10 business days: January 2020 security updates on all affected endpoints and completion report (5 pm EST)
ED 20-02 – Windows vulnerabilities, January 2020 · United States - Within 3 business days: initial status report submitted to CISA (5 pm EST)
ED 20-02 – Windows vulnerabilities, January 2020 · United States - Part A applies: federal agencies may not procure covered equipment or services
NDAA FY2019 § 889 – Huawei, ZTE and video surveillance · United States - CISA report on agency status to the Secretary of Homeland Security and OMB
ED 19-01 – DNS infrastructure tampering · United States - Within 10 business days: DNS records audited, passwords changed, multi-factor authentication added and completion report to CISA
ED 19-01 – DNS infrastructure tampering · United States - Within one year: DMARC policy of p=reject for all second-level domains and mail-sending hosts
BOD 18-01 – Email and web security · United States - The ban on federal use of Kaspersky products and services takes effect
NDAA FY2018 § 1634 – Ban on Kaspersky products · United States - Deadline for the Secretary of Defense's report to Congress on procedures for removing suspect products from federal networks
NDAA FY2018 § 1634 – Ban on Kaspersky products · United States - Within 30 days: current, prioritised list of high value assets across the agency submitted through HSIN
BOD 18-02 – High value assets · United States - Within 7 days: lead point of contact for high value assets and at least one backup designated and reported to DHS
BOD 18-02 – High value assets · United States - Within 120 days: HTTPS-only with HSTS for federal websites and SSLv2, SSLv3, 3DES and RC4 disabled
BOD 18-01 – Email and web security · United States - Within 90 days: STARTTLS on mail servers and valid SPF/DMARC records (at least p=none) for all second-level domains
BOD 18-01 – Email and web security · United States - At 90 days: removal begins, with a status report to DHS every 30 days until it is complete
BOD 17-01 – Removal of Kaspersky products · United States - Within 30 days: Agency Plan of Action for BOD 18-01 submitted to DHS
BOD 18-01 – Email and web security · United States - Within 60 days: detailed plan of action to discontinue use of Kaspersky products
BOD 17-01 – Removal of Kaspersky products · United States - Within 30 days: agencies report to DHS the Kaspersky products found on their systems
BOD 17-01 – Removal of Kaspersky products · United States - Within 45 days: actions in the AR-16-20173 Technical Annexes performed and full mitigation or a plan of action reported to DHS, then reports every 30 days
BOD 16-02 – Threat to network infrastructure devices · United States - FY2016 CIO, Inspector General and Senior Agency Official for Privacy FISMA metrics submitted to OMB and DHS through CyberScope
BOD 16-03 – 2016 agency cybersecurity reporting · United States - Transposition deadline for Member States
Directive 2013/40/EU on attacks against information systems · European Union - The HITECH Omnibus Rule takes effect, extending the obligations to business associates
HIPAA Security Rule · United States - Within one year: National Plan for Critical Infrastructure and Key Resources Protection produced by the Secretary of Homeland Security
HSPD-7 – Critical infrastructure protection · United States
No past deadline recorded.
News week by week
Week from 2 November 2026 to 8 November 2026
149 new documents, 11 updated records
New documents (149)
- National Cybersecurity Strategy of the Principality of Andorra 2024-2027 · Andorra
- National Cyber Security Strategy of Afghanistan (2014) · Afghanistan
- Law No. 25/2024 on Cybersecurity (Albania) · Albania
- National Cybersecurity Strategy 2025-2030 and Action Plan 2025-2027 (Albania) · Albania
- Law of the Republic of Armenia on Cybersecurity (HO-442-N) · Armenia
- Restriction of the use of TikTok in the public administration · Austria
- PSPF Direction 001-2025 – DeepSeek Products, Applications and Web Services · Australia
- PSPF Direction 002-2025 – Kaspersky Lab, Inc. Products and Web Services · Australia
- PSPF Direction 001-2023 – Direction on the TikTok application · Australia
- Strategy of the Republic of Azerbaijan on Information Security and Cybersecurity for 2023-2027 · Azerbaijan
- Computer Misuse Act (Barbados, Cap. 124B) · Barbados
- Circular No 716 – Temporary ban on the use of the TikTok application · Belgium
- Law No. 014-2024/ALT of 9 July 2024 on the security of information systems in Burkina Faso · Burkina Faso
- Benin National Digital Security Strategy 2023-2026 · Benin
- Brunei Cybersecurity Act (Chapter 272, formerly Cybersecurity Order 2023) · Brunei
- Brunei Darussalam National Cyber Security Strategy 2023-2027 · Brunei
- National Cybersecurity Strategy of Bhutan 2024-2029 · Bhutan
- Information Security Concept of the Republic of Belarus (2019) · Belarus
- Order under the Investment Canada Act - Wind-up (Hikvision Canada Inc.) · Canada
- Statement by Minister Fortier announcing a ban on the use of TikTok on government mobile devices · Canada
- Minister Anand announces a ban on the use of WeChat and Kaspersky suite of applications on government mobile devices · Canada
- Ordinance-Law No. 23/010 of 13 March 2023 on the Digital Code (DR Congo) · Democratic Republic of the Congo
- Law No. 26-2020 of 5 June 2020 on Cybersecurity (Republic of the Congo) · Republic of the Congo
- Micron products sold in China fail the cybersecurity review · China
- Decree-Law No. 9/2021 of 29 January 2021 approving the legal framework for cybersecurity (Cabo Verde) · Cabo Verde
- Warning against certain products of the company DeepSeek · Czechia
- NÚKIB warning against the use of software and hardware of Huawei Technologies Co., Ltd. and ZTE Corporation · Czechia
- Warning in connection with the TikTok application · Czechia
- Resolution of the Government of the Czech Republic of 9 July 2025 No. 537 on the DeepSeek language model: problematic data collection, low level of security and censorship · Czechia
- Public-law contracts between the Federal Government and Telekom, Vodafone and Telefónica on critical Huawei and ZTE components in 5G networks · Germany
- Law No. 195/AN/25/9ème L establishing the National Cybersecurity Authority (Djibouti) · Djibouti
- National Cybersecurity Policy of Ethiopia (2024) · Ethiopia
- Communication from the Commission – Implementation of the 5G cybersecurity Toolbox · European Union
- Commission strengthens cybersecurity and suspends the use of TikTok on its corporate devices · European Union
- Fiji National Cybersecurity and Resilience Strategy 2026-2031 · Fiji
- Law No. 027/2023 regulating cybersecurity and the fight against cybercrime in the Gabonese Republic · Gabon
- Designated Vendor Direction under section 105Z1 of the Communications Act 2003 (Huawei) · United Kingdom
- TikTok banned on UK government devices as part of wider app review · United Kingdom
- Electronic Crimes Act 2013 (Grenada) · Grenada
- Guinea National Cybersecurity Policy and Strategy 2022-2027 · Guinea
- Government Blocks 118 Mobile Apps Which are Prejudicial to Sovereignty and Integrity of India, Defence of India, Security of State and Public Order · India
- Government of India blocks 43 mobile apps from accessing by users in India · India
- Government Bans 59 mobile apps which are prejudicial to sovereignty and integrity of India, defence of India, security of state and public order · India
- Circular of 14 November 2025 – Implementation of Article 29(3) of Decree-Law No. 21 of 21 March 2022. Diversification of cybersecurity technology products and services · Italy
- Law No. 121 of 17 July 2024 on Cybersecurity (Kyrgyzstan) · Kyrgyzstan
- Cybersecurity Act 2026 (Kiribati) · Kiribati
- Electronic Crimes Act (Saint Kitts and Nevis, Cap. 4.41) · Saint Kitts and Nevis
- Amiri Decree No. 37 of 2022 establishing the National Cyber Security Center (Kuwait) · Kuwait
- Computer Misuse Act (Act No. 12 of 2011) · Saint Lucia
- Liberia "Whole of Government" National Digital Strategy (2025-2029) · Liberia
- Law No. 5 of 2022 on Combating Cybercrime (Libya) · Libya
- National Cybersecurity Strategy of Libya (2022) · Libya
- National Cybersecurity Programme 2026-2030 (Moldova) · Moldova
- Law No. 2014-006 on combating cybercrime (Madagascar) · Madagascar
- Marshall Islands Cybersecurity Act 2025 · Marshall Islands
- Mauritania National Digital Security Strategy 2022-2025 · Mauritania
- National Cyber Security Strategy of the Maldives 2024-2029 · Maldives
- Law No. 13/2026 of 1 July 2026 approving the Cybersecurity Law (Mozambique) · Mozambique
- Mozambique Cybersecurity Policy and Implementation Strategy (2021) · Mozambique
- Namibia National Cybersecurity Strategy & Awareness Raising Plan 2022 - 2027 · Namibia
- Law No. 2019-33 of 3 July 2019 on the suppression of cybercrime in Niger · Niger
- Precautionary measure on the use of Kaspersky antivirus software · Netherlands
- Papua New Guinea National Cyber Security Strategy 2024-2030 · Papua New Guinea
- National Cyber Security Policy of Pakistan 2021 · Pakistan
- Law No 354 of 13 December 2022 on the protection of the IT systems of public authorities and institutions in the context of the invasion launched by the Russian Federation against Ukraine · Romania
- Information Security Doctrine of the Russian Federation (2016) · Russia
- Federal Law No. 187-FZ of 2017 on the Security of Critical Information Infrastructure (Russia) · Russia
- Solomon Islands Government Digital - Data, People, Technology and Cyber Strategy 2026-2030 · Solomon Islands
- Seychelles National Cybersecurity Strategy 2019-2024 · Seychelles
- Decision on conditions of importance for Sweden's security in the 3.5 GHz and 2.3 GHz bands · Sweden
- Sierra Leone National Cybersecurity Strategy 2021 · Sierra Leone
- Law No. 114 of 23 August 2016 on Computer Crimes (San Marino) · San Marino
- Eswatini National Cybersecurity Strategy 2022-2027 · Eswatini
- Law No. 009/PR/2015 on cybersecurity and the fight against cybercrime (Chad) · Chad
- Law No. 2018-026 of 7 December 2018 on Cybersecurity and Combating Cybercrime (Togo) · Togo
- Togo National Cybersecurity Strategy 2024-2028 · Togo
- National Cyber Security Strategy of Trinidad and Tobago (2012) · Trinidad and Tobago
- DeepSeek Prohibited in Government Agencies to Prevent Cybersecurity Risk · Taiwan
- Reminder to the public to choose apps with a high cybersecurity risk with care · Taiwan
- Tanzania Government Cyber Security Strategy 2022-2027 · Tanzania
- Binding Operational Directive 16-02: Threat to Network Infrastructure Devices · United States
- BOD 16-03: 2016 Agency Cybersecurity Reporting Requirements · United States
- Binding Operational Directive BOD-17-01: Removal of Kaspersky-Branded Products · United States
- Binding Operational Directive 18-01: Enhance Email and Web Security · United States
- BOD 18-02: Securing High Value Assets · United States
- BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems · United States
- BOD 20-01: Develop and Publish a Vulnerability Disclosure Policy · United States
- Binding Operational Directive 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities · United States
- Binding Operational Directive 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks · United States
- BOD 23-02: Mitigating the Risk from Internet-Exposed Management Interfaces · United States
- BOD 25-01: Implementing Secure Practices for Cloud Services · United States
- BOD 26-02: Mitigating Risk From End-of-Support Edge Devices · United States
- BOD 26-04: Prioritizing Security Updates Based on Risk · United States
- Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements (Notice of Proposed Rulemaking) · United States
- CISA 2030: Defend, Harden, Prevail · United States
- Cloud Security Technical Reference Architecture, Version 2.0 · United States
- Cybersecurity Incident & Vulnerability Response Playbooks: Operational Procedures for Planning and Conducting Cybersecurity Incident and Vulnerability Response Activities in FCEB Information Systems · United States
- 2026 Minimum Elements for a Software Bill of Materials (SBOM) · United States
- Secure Cloud Business Applications (SCuBA) Secure Configuration Baselines for Microsoft 365 and Google Workspace · United States
- Secure by Design: Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software · United States
- Secure Software Development Attestation Form · United States
- Trusted Internet Connections (TIC) 3.0 Core Guidance Documents · United States
- ED 19-01: Mitigate DNS Infrastructure Tampering · United States
- ED 20-02: Mitigate Windows Vulnerabilities from January 2020 Patch Tuesday · United States
- ED 20-03: Mitigate Windows DNS Server Remote Code Execution Vulnerability from July 2020 Patch Tuesday · United States
- ED 20-04: Mitigate Netlogon Elevation of Privilege Vulnerability from August 2020 Patch Tuesday · United States
- ED 21-01: Mitigate SolarWinds Orion Code Compromise · United States
- ED 21-02: Mitigate Microsoft Exchange On-Premises Product Vulnerabilities · United States
- ED 21-03: Mitigate Pulse Connect Secure Product Vulnerabilities · United States
- ED 21-04: Mitigate Windows Print Spooler Service Vulnerability · United States
- ED 22-02: Mitigate Apache Log4j Vulnerability · United States
- ED 22-03: Mitigate VMware Vulnerabilities · United States
- Emergency Directive 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities · United States
- ED 24-02: Mitigating the Significant Risk from Nation-State Compromise of Microsoft Corporate Email System · United States
- ED 25-02: Mitigate Microsoft Exchange Vulnerability · United States
- ED 25-03: Identify and Mitigate Potential Compromise of Cisco Devices · United States
- ED 26-01: Mitigate Vulnerabilities in F5 Devices · United States
- ED 26-03: Mitigate Vulnerabilities in Cisco SD-WAN Systems · United States
- Exclusion and Removal Order #2026-02: Federal Acquisition Supply Chain Security Act Exclusion and Removal of Acronis Products and Services from Federal Civilian Executive Branch Information Technology Systems · United States
- Exclusion and Removal Order #2026-01: Federal Acquisition Supply Chain Security Act Exclusion and Removal of DeepSeek Products and Services from Federal Civilian Executive Branch Information Technology Systems · United States
- Department of Defense FASCSA Order on Acronis AG and Acronis SCS Inc. · United States
- Department of Defense FASCSA Exclusion Order on DeepSeek AI Models and Applications · United States
- Director of National Intelligence FASCSA Exclusion and Removal Order on Acronis AG · United States
- Director of National Intelligence FASCSA Exclusion and Removal Order on DeepSeek · United States
- China Telecom (Americas) Corporation – Order on Revocation and Termination · United States
- China Unicom (Americas) Operations Limited – Order on Revocation · United States
- List of Equipment and Services Covered By Section 2 of The Secure Networks Act · United States
- Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs – Huawei Designation (Order) · United States
- Pacific Networks Corp. and ComNet (USA) LLC – Order on Revocation and Termination · United States
- Protecting Against National Security Threats to the Communications Supply Chain Through FCC Programs – ZTE Designation (Order) · United States
- Homeland Security Presidential Directive 7: Critical Infrastructure Identification, Prioritization, and Protection · United States
- Final Determination: Case No. ICTS-2021-002, Kaspersky Lab, Inc. · United States
- National Cyber Incident Response Plan · United States
- Prohibition on Use of Products and Services Developed or Provided by Kaspersky Lab (Section 1634 of the National Defense Authorization Act for Fiscal Year 2018) · United States
- Prohibition on Certain Telecommunications and Video Surveillance Services or Equipment (Section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019) · United States
- Prohibition on Certain Semiconductor Products and Services (Section 5949 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023) · United States
- Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) (NIST SP 800-122) · United States
- Engineering Trustworthy Secure Systems (NIST SP 800-160 Vol. 1 Rev. 1) · United States
- Developing Cyber-Resilient Systems: A Systems Security Engineering Approach (NIST SP 800-160 Vol. 2 Rev. 1) · United States
- Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST SP 800-161 Rev. 1) · United States
- Zero Trust Architecture (NIST SP 800-207) · United States
- Assessing Security and Privacy Controls in Information Systems and Organizations (NIST SP 800-53A Rev. 5) · United States
- Incident Response Recommendations and Considerations for Cybersecurity Risk Management: A CSF 2.0 Community Profile (NIST SP 800-61 Rev. 3) · United States
- Digital Identity Guidelines (NIST SP 800-63-4) · United States
- No TikTok on Government Devices Act (Division R of the Consolidated Appropriations Act, 2023) · United States
- Protecting Americans from Foreign Adversary Controlled Applications Act (Division H of Public Law 118-50) · United States
- Law on Cybersecurity No. ZRU-764 of 2022 (Uzbekistan) · Uzbekistan
- Special Law against Computer Crimes · Venezuela
- Cyber and Data Protection Act, 2021 (Act No. 5 of 2021) · Zimbabwe
Updated records (11)
- Ordinance of the Cybersecurity Authority on detailed requirements for cybersecurity risk-management measures and further criteria for significant incidents (NISV 2026) · Austria
- Principles of operational technology cyber security · Australia
- Cybersecurity Strategy Belgium 2.0 (2021-2025) · Belgium
- Act of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security · Belgium
- Law of 19 December 2025 on the resilience of critical entities · Belgium
- Convention on Cybercrime (Budapest Convention) · Council of Europe
- A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography · European Union
- Israel's National Cyber Security Strategy (2025) · Israel
- Kenya's Computer Misuse and Cybercrimes Act, 2018 · Kenya
- Executive Order 14412 – Securing the Nation Against Advanced Cryptographic Attacks · United States
- Transition to Post-Quantum Cryptography Standards (NIST IR 8547) · United States
Week from 26 October 2026 to 1 November 2026 · database launch
326 records published at launch
New documents (326)
- United Arab Emirates National Cybersecurity Strategy (2019) · United Arab Emirates
- National Cybersecurity Strategy of the UAE 2025-2031 · United Arab Emirates
- Electronic Crimes Act, 2013 (No. 14 of 2013) · Antigua and Barbuda
- CNC Provision 1/2026 – Technical regulation on contingency planning policies, contingency plans and backup data processing centres · Argentina
- Decree of Necessity and Urgency 941/2025 amending the National Intelligence Law and creating the National Cybersecurity Centre · Argentina
- Argentina's Second National Cybersecurity Strategy (2023) · Argentina
- Network and Information Systems Security Act 2026 (NISG 2026) · Austria
- Ordinance of the Cybersecurity Authority on detailed requirements for cybersecurity risk-management measures and further criteria for significant incidents (NISV 2026) · Austria
- Critical Entities Resilience Act (RKEG) · Austria
- Austrian Strategy for Cybersecurity 2021 · Austria
- Austrian Strategy for the Resilience of Critical Entities (ÖSRKE 2026) · Austria
- Principles of operational technology cyber security · Australia
- Cyber Security Act 2024 · Australia
- 2023-2030 Australian Cyber Security Strategy · Australia
- 2023-2030 Australian Cyber Security Strategy - Horizon 2 Action Plan · Australia
- Security of Critical Infrastructure Act 2018 · Australia
- Bangladesh Cyber Security Act 2026 (Act No. 81 of 2026) · Bangladesh
- Cybersecurity Strategy Belgium 2.0 (2021-2025) · Belgium
- Act of 26 April 2024 establishing a framework for the cybersecurity of network and information systems of general interest for public security · Belgium
- Law of 19 December 2025 on the resilience of critical entities · Belgium
- Updated National Cybersecurity Strategy "Cyber-Resilient Bulgaria 2023" · Bulgaria
- Act amending and supplementing the Cybersecurity Act · Bulgaria
- Bahrain's National Cyber Security Strategy 2025-2028 · Bahrain
- Brazil's National Cybersecurity Strategy (E-Ciber, 2025) · Brazil
- Decree 11.856/2023 establishing the National Cybersecurity Policy and the National Cybersecurity Committee · Brazil
- Decree 12.572/2025 establishing the National Information Security Policy and its governance in the federal public administration · Brazil
- Cybercrime and Computer Related Crimes Act, 2018 (No. 18 of 2018) · Botswana
- Botswana National Cybersecurity Strategy (2020) · Botswana
- National Cybersecurity Strategy of Belize: Towards a Secure Cyberspace 2020-2023 · Belize
- An Act respecting cyber security, amending the Telecommunications Act and making consequential amendments to other Acts (S.C. 2026, c. 9) · Canada
- National Cyber Security Strategy: Canada's Vision for Security and Prosperity in the Digital Age · Canada
- Canada's National Cyber Security Strategy: Securing Canada's Digital Future · Canada
- Ordinance on Cybersecurity (Cybersecurity Ordinance, CSO) · Switzerland
- Federal Act on Information Security in the Federal Administration (Information Security Act, ISA) · Switzerland
- National Cyberstrategy (NCS) 2023 · Switzerland
- Chile's Cybersecurity Framework Law (Law 21.663) · Chile
- Chile's National Cybersecurity Policy 2023-2028 · Chile
- Law No. 2010/012 of 21 December 2010 relating to Cybersecurity and Cybercriminality in Cameroon · Cameroon
- Regulations on the Security Protection of Critical Information Infrastructure · China
- Administrative Measures for National Cybersecurity Incident Reporting · China
- Cybersecurity Law of the People's Republic of China · China
- Data Security Law of the People's Republic of China · China
- China's National Cyberspace Security Strategy (2016) · China
- Regulations on Network Data Security Management · China
- Measures for Network Data Security Risk Assessment · China
- Personal Information Protection Law of the People's Republic of China (PIPL) · China
- Colombia's National Digital Security Strategy 2025-2027 · Colombia
- Convention on Cybercrime (Budapest Convention) · Council of Europe
- Costa Rica's National Cybersecurity Strategy 2023-2027 · Costa Rica
- Cybersecurity Strategy of the Republic of Cyprus 2020 · Cyprus
- Civil Defence (Resilience of Critical Entities) Regulations of 2025 · Cyprus
- Security of Networks and Information Systems (Amendment) Law of 2025 · Cyprus
- National Cyber Security Strategy of Czechia 2026-2030 · Czechia
- Cybersecurity Act · Czechia
- Critical Infrastructure Act · Czechia
- ICS Security Compendium · Germany
- Cyber Security Strategy for Germany 2016 · Germany
- Cyber Security Strategy for Germany 2021 · Germany
- Act implementing Directive (EU) 2022/2557 and strengthening the resilience of critical facilities (KRITIS umbrella act) · Germany
- Act implementing the NIS 2 Directive and regulating essential features of information security management in the federal administration (NIS2UmsuCG) · Germany
- Act on the resilience of critical entities · Denmark
- Act on measures to ensure a high level of cybersecurity (NIS 2 Act) · Denmark
- Agreement on the Cyber and Information Security Strategy 2026-2029 · Denmark
- Dominican Republic National Cybersecurity Strategy 2030 · Dominican Republic
- Presidential Decree No. 20-05 of 20 January 2020 establishing a national information systems security framework · Algeria
- Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data · Algeria
- Algeria's National Information Systems Security Strategy 2025-2029 · Algeria
- Organic Law for the Strengthening of Cybersecurity · Ecuador
- Estonian Information Security Standard (E-ITS) · Estonia
- Act amending the Emergency Act and other related acts · Estonia
- Crisis Situations and National Defence Act · Estonia
- Act amending the Cybersecurity Act and other acts (transposition of the NIS 2 Directive) · Estonia
- Cybersecurity Strategy 2024-2030 "Cyber-conscious Estonia" · Estonia
- Egypt's National Cybersecurity Strategy 2023-2027 · Egypt
- National Cybersecurity Strategy 2019 · Spain
- Royal Decree 311/2022 of 3 May regulating the National Security Framework (ENS) · Spain
- Royal Decree-Law 12/2018 of 7 September on the security of network and information systems · Spain
- Action Plan on Cybersecurity and Artificial Intelligence · European Union
- European action plan on the cybersecurity of hospitals and healthcare providers · European Union
- Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (Artificial Intelligence Act) · European Union
- Directive (EU) 2022/2557 on the resilience of critical entities (CER Directive) · European Union
- Commission Implementing Regulation (EU) 2025/2392 on the technical description of the categories of important and critical products with digital elements pursuant to Regulation (EU) 2024/2847 · European Union
- Regulation (EU) 2025/37 amending Regulation (EU) 2019/881 as regards managed security services · European Union
- Council Recommendation of 6 June 2025 on an EU blueprint for cyber crisis management · European Union
- Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act) · European Union
- Regulation (EU) 2025/38 laying down measures to strengthen solidarity and capacities in the Union to detect, prepare for and respond to cyber threats and incidents (Cyber Solidarity Act) · European Union
- Regulation (EU) 2019/881 on ENISA and on information and communications technology cybersecurity certification (Cybersecurity Act) · European Union
- The EU's Cybersecurity Strategy for the Digital Decade · European Union
- Directive 2013/40/EU on attacks against information systems · European Union
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA) · European Union
- Regulation (EU) 2021/887 establishing the European Cybersecurity Industrial, Technology and Research Competence Centre and the Network of National Coordination Centres · European Union
- Regulation (EU) 2024/1183 amending Regulation (EU) No 910/2014 as regards establishing the European Digital Identity Framework (eIDAS 2) · European Union
- Commission Implementing Regulation (EU) 2024/482 laying down rules for the application of Regulation (EU) 2019/881 as regards the adoption of the European Common Criteria-based cybersecurity certification scheme (EUCC) · European Union
- Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (General Data Protection Regulation, GDPR) · European Union
- Regulation (EU, Euratom) 2023/2841 laying down measures for a high common level of cybersecurity at the institutions, bodies, offices and agencies of the Union · European Union
- Regulation (EU) 2023/1230 on machinery (Machinery Regulation) · European Union
- MDCG 2019-16 Rev.1 – Guidance on Cybersecurity for medical devices · European Union
- Commission Delegated Regulation (EU) 2024/1366 establishing a network code on sector-specific rules for cybersecurity aspects of cross-border electricity flows (NCCS) · European Union
- Directive (EU) 2016/1148 concerning measures for a high common level of security of network and information systems across the Union (NIS Directive) · European Union
- Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS 2 Directive) · European Union
- Commission Implementing Regulation (EU) 2024/2690 laying down rules for the application of Directive (EU) 2022/2555 as regards technical and methodological requirements of cybersecurity risk-management measures and significant incidents · European Union
- Commission Implementing Regulation (EU) 2023/203 laying down rules for the application of Regulation (EU) 2018/1139 as regards requirements for the management of information security risks with a potential impact on aviation safety (Part-IS) · European Union
- A Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography · European Union
- ProtectEU: a European Internal Security Strategy · European Union
- Directive 2014/53/EU on the harmonisation of the laws of the Member States relating to the making available on the market of radio equipment (Radio Equipment Directive, RED) · European Union
- Commission Delegated Regulation (EU) 2022/30 supplementing Directive 2014/53/EU (Radio Equipment Directive) with regard to the essential requirements of Article 3(3)(d), (e) and (f) · European Union
- Cybersecurity Act · Finland
- Finland's Cyber Security Strategy 2024-2035 · Finland
- Act on the protection of society's critical infrastructure and the improvement of its resilience · Finland
- Act on the cyber resilience of certain products and on cybersecurity certification · Finland
- Cybersecurity of Industrial Control Systems – Classification Method · France
- Law No. 2018-133 of 26 February 2018 on various provisions adapting to EU law in the field of security · France
- National Cybersecurity Strategy of France 2026-2030 · France
- French National Digital Security Strategy · France
- Computer Misuse Act 1990 · United Kingdom
- Government Cyber Action Plan · United Kingdom
- National Cyber Security Strategy 2016 to 2021 · United Kingdom
- National Cyber Strategy 2022 · United Kingdom
- Secure connectivity principles for operational technology (OT) · United Kingdom
- The Network and Information Systems Regulations 2018 · United Kingdom
- Product Security and Telecommunications Infrastructure Act 2022 · United Kingdom
- Telecommunications (Security) Act 2021 · United Kingdom
- Georgia's National Cybersecurity Strategy 2021-2024 · Georgia
- Ghana's Directive for the Protection of Critical Information Infrastructure · Ghana
- Ghana's Cybersecurity Act, 2020 (Act 1038) · Ghana
- Ghana's National Cybersecurity Policy and Strategy (2024) · Ghana
- National Cybersecurity Strategy of Greece 2026-2030 · Greece
- Law 5160/2024 – Transposition of Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union · Greece
- Law 5236/2025 on the resilience of critical entities · Greece
- Cybercrime Act 2018 (Act No. 16 of 2018) · Guyana
- Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) · Hong Kong
- National Cyber Security Strategy and Action Plan for its implementation · Croatia
- Cybersecurity Act · Croatia
- Critical Infrastructure Act · Croatia
- Act LXIX of 2024 on the cybersecurity of Hungary · Hungary
- Act LXXXIV of 2024 on the resilience of critical entities · Hungary
- Act CXXXV of 2025 on the implementation in Hungary of the European Union regulation on cyber resilience and on the amendment of certain cybersecurity provisions · Hungary
- Government Decision 1089/2025 on Hungary's Cybersecurity Strategy · Hungary
- Indonesia's National Cyber Security Strategy and Cyber Crisis Management (Presidential Regulation 47/2023) · Indonesia
- Criminal Justice (Offences Relating to Information Systems) Act 2017 · Ireland
- National Cyber Security Strategy 2030 · Ireland
- European Union (Measures for a High Common Level of Security of Network and Information Systems) Regulations 2018 · Ireland
- European Union (Resilience of Critical Entities) Regulations 2024 · Ireland
- Israel's National Cyber Security Strategy (2025) · Israel
- Resolution MSC.428(98) – Maritime cyber risk management in safety management systems · International Maritime Organization (IMO)
- The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) · India
- Digital Personal Data Protection Rules, 2025 · India
- India's Information Technology Act, 2000 · India
- India's National Cyber Security Policy (2013) · India
- Icelandic National Cybersecurity Strategy 2022-2037 · Iceland
- Determination of the Director General of the National Cybersecurity Agency of 9 February 2026 – Taxonomy of incidents under Article 1(1) of Law No. 90 of 28 June 2024 · Italy
- Determination No. 155238/2026 of the Director General of the National Cybersecurity Agency – Relevance categories and criteria for listing and categorising activities and services · Italy
- Determination No. 314287/2026 of the Director General of the National Cybersecurity Agency on the terms, procedures and use of the NIS digital platform · Italy
- Determination No. 379907/2025 of the Director General of the National Cybersecurity Agency – Basic specifications for the obligations under Articles 23, 24, 25, 29 and 32 of the NIS Decree · Italy
- National Coordinated Vulnerability Disclosure (CVD) Policy · Italy
- Decree-Law No. 105 of 21 September 2019 on the national cybersecurity perimeter · Italy
- Decree-Law No. 82 of 14 June 2021 on urgent cybersecurity provisions and establishing the National Cybersecurity Agency · Italy
- Legislative Decree No. 123 of 3 August 2022 adapting national law to Title III (cybersecurity certification framework) of Regulation (EU) 2019/881 (Cybersecurity Act) · Italy
- Legislative Decree No. 134 of 4 September 2024 implementing Directive (EU) 2022/2557 on the resilience of critical entities · Italy
- Legislative Decree No. 138 of 4 September 2024 transposing Directive (EU) 2022/2555 (NIS 2) · Italy
- Legislative Decree No. 191 of 1 October 2026 adapting national law to Regulation (EU) 2025/37 amending Regulation (EU) 2019/881 as regards managed security services · Italy
- Legislative Decree No. 65 of 18 May 2018 implementing Directive (EU) 2016/1148 (NIS) · Italy
- Prime Ministerial Decree of 22 April 2026 – Regulation implementing Article 7-bis(5) of Decree-Law No. 174 of 30 October 2015 on the management of crises involving national security · Italy
- Prime Ministerial Decree of 30 April 2025 governing contracts for ICT goods and services used in a context linked to the protection of strategic national interests and national security · Italy
- Prime Ministerial Decree No. 81 of 14 April 2021 – Regulation on the notification of incidents affecting the networks, information systems and IT services referred to in Article 1(2)(b) of Decree-Law No. 105 of 21 September 2019, and on measures to ensure high levels of security · Italy
- Law No. 132 of 23 September 2025 laying down provisions and delegating powers to the Government on artificial intelligence · Italy
- Law No. 90 of 28 June 2024 on strengthening national cybersecurity and on computer crimes · Italy
- Implementation Plan of the National Cybersecurity Strategy 2022-2026 · Italy
- National Cybersecurity Strategy 2022-2026 · Italy
- National Strategy for the Resilience of Critical Entities · Italy
- Guide to Developing a National Cybersecurity Strategy – 2nd Edition 2021 · International Telecommunication Union (ITU)
- Guide to Developing a National Cybersecurity Strategy – 3rd Edition 2025 · International Telecommunication Union (ITU)
- The Cybercrimes Act, 2015 (No. 31 of 2015) · Jamaica
- Jordan's National Cyber Security Strategy 2025-2028 · Jordan
- Act on the Prevention of Damage Caused by Unauthorized Acts against Important Computers (Active Cyber Defense Act) · Japan
- Basic Act on Cybersecurity (Act No. 104 of 2014) · Japan
- Cybersecurity Strategy of Japan (2021) · Japan
- Cybersecurity Strategy of Japan (2025) · Japan
- Kenya's Computer Misuse and Cybercrimes Act, 2018 · Kenya
- Kenya's National Cybersecurity Strategy 2022 · Kenya
- Act on Promotion of Information and Communications Network Utilization and Information Protection · South Korea
- South Korea's National Cybersecurity Strategy (2024) · South Korea
- Personal Information Protection Act (South Korea) · South Korea
- Law on Prevention and Combating Cyber Crime (No. 61/NA) · Laos
- Cyber Security Act (CSG) of 5 December 2024 (Liechtenstein) · Liechtenstein
- National Strategy for Protection Against Cyber Risks (2025 revision) of Liechtenstein · Liechtenstein
- Sri Lanka's Information and Cyber Security Strategy 2019-2023 · Sri Lanka
- National Cyber Security Strategy of Sri Lanka 2025-2029 · Sri Lanka
- Law amending Cybersecurity Law No XII-1428 · Lithuania
- Act amending the Crisis Management and Civil Protection Act No VIII-971 · Lithuania
- National Cyber Security Strategy of Lithuania · Lithuania
- Law of 5 May 2026 on the resilience of critical entities · Luxembourg
- Act of 5 May 2026 on measures to ensure a high level of cybersecurity · Luxembourg
- National Cybersecurity Strategy IV (Luxembourg) · Luxembourg
- Amendments to the National Security Law · Latvia
- Cybersecurity Strategy of Latvia 2023-2026 · Latvia
- National Cybersecurity Law · Latvia
- Decree No. 2-24-921 of 22 October 2024 on the use of cloud service providers by entities and critical infrastructure with sensitive information systems or data · Morocco
- Morocco's Law No. 05-20 on Cybersecurity (2020) · Morocco
- Morocco's National Cybersecurity Strategy 2030 · Morocco
- Cyber Security Strategy of Montenegro 2022-2026 · Montenegro
- Law on Information Security (Montenegro, 2024) · Montenegro
- North Macedonia's Law on Security of Network and Information Systems · North Macedonia
- Law No. 2019-056 of 5 December 2019 on the Suppression of Cybercrime · Mali
- Law on Cyber Security · Mongolia
- National Cyber Security Strategy · Mongolia
- Malta National Cybersecurity Strategy 2023-2026 · Malta
- Measures for a High Common Level of Cybersecurity across the European Union (Malta) Order, 2025 (S.L. 460.41) · Malta
- Resilience of Critical Entities and Infrastructures (Identification, Designation and Protection) Order, 2026 · Malta
- Cyber Resilience Regulations, 2026 (S.L. 591.06) · Malta
- Mauritius' Cybersecurity and Cybercrime (Critical Information Infrastructure Designation) Regulations 2026 · Mauritius
- Mauritius' Cybersecurity and Cybercrime Act 2021 · Mauritius
- Mexico's National Cybersecurity Plan 2025-2030 · Mexico
- Agreement issuing the General Cybersecurity Policy for the Federal Public Administration · Mexico
- Malaysia's Cyber Security Act 2024 (Act 854) · Malaysia
- Malaysia Cyber Security Strategy (MCSS) 2025-2030 · Malaysia
- Cyber Defence Pledge · NATO
- Nigeria's Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 · Nigeria
- Nigeria's National Cybersecurity Policy and Strategy (2021) · Nigeria
- Law No. 1042, Special Law on Cybercrimes · Nicaragua
- Decree of 8 July 2026 laying down rules implementing the Cybersecurity Act and setting the date of its entry into force (Cyberbeveiligingsbesluit) · Netherlands
- Cybersecurity Act (Cbw) · Netherlands
- Netherlands Cybersecurity Strategy 2022-2028 · Netherlands
- Critical Entities Resilience Act (Wwke) · Netherlands
- Act on Digital Security (Digital Security Act) · Norway
- National Cyber Security Strategy for Norway · Norway
- Cybercrime Act 2015 (No. 14 of 2015) · Nauru
- New Zealand's Cyber Security Strategy 2026–2030 · New Zealand
- National Cybersecurity Strategy 2021-2024 · Panama
- Law No. 30096 on Computer Crimes · Peru
- Law No. 30999 on Cyber Defence · Peru
- Supreme Decree 126-2025-PCM approving the Regulation of Emergency Decree 007-2020 on the Digital Trust Framework · Peru
- Philippines National Cybersecurity Plan 2023-2028 · Philippines
- Cybersecurity Strategy of the Republic of Poland 2025-2029 · Poland
- Act of 23 January 2026 amending the Act on the National Cybersecurity System and certain other acts · Poland
- Act of 29 May 2026 amending the Crisis Management Act and certain other acts · Poland
- Decree-Law No 125/2025 – Legal framework for cybersecurity · Portugal
- Decree-Law No 22/2025 on the resilience of critical entities · Portugal
- National Cyberspace Security Strategy 2019-2023 (Portugal) · Portugal
- Regulation No 756/2026 implementing the Legal Framework for Cybersecurity approved by Decree-Law No 125/2025 · Portugal
- Qatar's National Cyber Security Strategy 2024-2030 · Qatar
- Law No 294/2024 on the resilience of critical entities · Romania
- Government Emergency Ordinance No 155/2024 establishing a framework for the cybersecurity of networks and information systems in the national civilian cyberspace · Romania
- Cybersecurity Strategy of Romania 2022-2027 · Romania
- Serbia's Strategy for the Development of the Information Society and Information Security 2021-2026 · Serbia
- Law on Information Security (Serbia, 2025) · Serbia
- Rwanda's Law No. 60/2018 on prevention and punishment of cyber crimes · Rwanda
- Rwanda's National Cybersecurity Strategy 2024-2029 · Rwanda
- Legal Powers of the National Cybersecurity Authority (Royal Decree No. M/117) · Saudi Arabia
- Saudi Arabia's National Cybersecurity Strategy (2020) · Saudi Arabia
- Cybersecurity Act · Sweden
- National Strategy for Cybersecurity 2025-2029 (Sweden) · Sweden
- Cybersecurity Act 2018 · Singapore
- The Singapore Cybersecurity Strategy 2021 · Singapore
- Singapore's Cybersecurity Strategy 2026 · Singapore
- Digital Slovenia 2030 – Overarching Strategy for Slovenia's Digital Transformation · Slovenia
- Information Security Act (ZInfV-1) · Slovenia
- Critical Infrastructure Act (ZKI-1) · Slovenia
- National Cybersecurity Strategy of Slovakia 2026-2030 · Slovakia
- Act on critical infrastructure and amending certain acts · Slovakia
- Act No. 69/2018 Coll. on Cybersecurity · Slovakia
- Senegal's National Cybersecurity Strategy (SNC2022) · Senegal
- Law No. 15/2017 on Cybercrime · São Tomé and Príncipe
- Cybersecurity and Information Security Law (Legislative Decree No. 143) · El Salvador
- Special Law against Computer and Related Crimes (Legislative Decree No. 260) · El Salvador
- Thailand's Cybersecurity Act B.E. 2562 (2019) · Thailand
- Decree-Law No. 2023-17 of 11 March 2023 on cybersecurity (Tunisia) · Tunisia
- Tunisia's National Cybersecurity Strategy 2026-2030 · Tunisia
- Computer Crimes Act (Act 14 of 2003, CAP. 10.06) · Tonga
- Türkiye's Cyber Security Law (Law No. 7545) · Türkiye
- Türkiye's National Cyber Security Strategy and Action Plan 2024-2028 · Türkiye
- Taiwan's Cyber Security Management Act (2018) · Taiwan
- Taiwan's Phase Seven National Cyber Security Development Program (2025-2028) · Taiwan
- Cybersecurity Strategy of Ukraine (2021) · Ukraine
- Law amending certain laws of Ukraine on information protection and cyber protection of state information resources and critical information infrastructure objects · Ukraine
- Uganda's National Cybersecurity Strategy 2022-2026 · Uganda
- United Nations Convention against Cybercrime · United Nations
- Report of the Group of Governmental Experts on Advancing Responsible State Behaviour in Cyberspace in the Context of International Security · United Nations
- Final report of the open-ended working group on security of and in the use of information and communications technologies 2021–2025 · United Nations
- UN Regulation No. 155 – Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system · United Nations Economic Commission for Europe (UNECE)
- UN Regulation No. 156 – Uniform provisions concerning the approval of vehicles with regards to software update and software updates management system · United Nations Economic Commission for Europe (UNECE)
- California Consumer Privacy Act of 2018 (CCPA) · United States
- Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) · United States
- Cybersecurity and Infrastructure Security Agency Act of 2018 · United States
- Foundations for OT Cybersecurity: Asset Inventory Guidance for Owners and Operators · United States
- Cybersecurity Maturity Model Certification (CMMC) Program (32 CFR Part 170) · United States
- President Trump's Cyber Strategy for America · United States
- Cybersecurity Information Sharing Act of 2015 (CISA 2015) · United States
- Executive Order 14028 – Improving the Nation's Cybersecurity · United States
- Executive Order 14306 – Sustaining Select Efforts To Strengthen the Nation's Cybersecurity and Amending Executive Order 13694 and Executive Order 14144 · United States
- Executive Order 14390 – Combating Cybercrime, Fraud, and Predatory Schemes Against American Citizens · United States
- Executive Order 14409 – Promoting Advanced Artificial Intelligence Innovation and Security · United States
- Executive Order 14412 – Securing the Nation Against Advanced Cryptographic Attacks · United States
- Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions · United States
- FedRAMP Authorization Act (Section 5921 of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023) · United States
- Federal Information Security Modernization Act of 2014 (FISMA) · United States
- HIPAA Security Rule: Health Insurance Reform; Security Standards (45 CFR Parts 160 and 164, Subparts A and C) · United States
- National Cybersecurity Strategy · United States
- National Cybersecurity Strategy Implementation Plan · United States
- The NIST Cybersecurity Framework (CSF) 2.0 · United States
- Cybersecurity Framework Version 1.1 Manufacturing Profile (NIST IR 8183 Rev. 1) · United States
- Foundational Cybersecurity Activities for IoT Device Manufacturers (NIST IR 8259) · United States
- Foundational Cybersecurity Activities for IoT Product Manufacturers (NIST IR 8259 Rev. 1) · United States
- Cybersecurity Framework Profile for Electric Vehicle Extreme Fast Charging Infrastructure (NIST IR 8473) · United States
- Transition to Post-Quantum Cryptography Standards (NIST IR 8547) · United States
- OT Backup Quick Start Guide (NIST SP 1339) · United States
- Protecting Information and System Integrity in Industrial Control System Environments: Cybersecurity for the Manufacturing Sector (NIST SP 1800-10) · United States
- Cybersecurity for the Water and Wastewater Sector: Build Architecture (Operational Technology Remote Access) (NIST SP 1800-45) · United States
- Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations (NIST SP 800-171 Rev. 3) · United States
- IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements (NIST SP 800-213) · United States
- Security and Privacy Controls for Information Systems and Organizations (NIST SP 800-53 Rev. 5) · United States
- Guide to Operational Technology (OT) Security (NIST SP 800-82 Rev. 3) · United States
- National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems · United States
- Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (SEC Release No. 33-11216) · United States
- Uruguay's National Cybersecurity Strategy 2024-2030 · Uruguay
- Viet Nam's National Cyber Safety and Security Strategy to 2025, with a vision to 2030 · Viet Nam
- Viet Nam's Law on Cybersecurity 2025 (116/2025/QH15) · Viet Nam
- Decree No. 333/2026/ND-CP detailing certain articles of and measures to implement Viet Nam's Law on Cybersecurity · Viet Nam
- Vanuatu National Cyber Security Strategy 2030 · Vanuatu
- Samoa National Cybersecurity Strategy 2016-2021 · Samoa
- Samoa National Cybersecurity Strategy 2025/26 - 2030/31 · Samoa
- Kosovo's Law No. 08/L-173 on Cyber Security · Kosovo
- Cybercrimes Act 19 of 2020 · South Africa
- South Africa's National Cybersecurity Policy Framework (2015) · South Africa
- Protection of Personal Information Act 4 of 2013 (POPIA) · South Africa
- Zambia's Cyber Security Act, 2025 · Zambia
No news for this country in recent weeks.
Get the updates
- RSS feed of the weekly digest (every Sunday)
- RSS feed of new documents
- Deadline calendar (iCal):
https://www.cybersecuritydatabase.org/en/deadlines.ics
Add the calendar address to Google Calendar, Outlook or Apple Calendar as a subscribed calendar: new deadlines will appear on their own.