Home›Articles
When a standard changes, what it means for you.
Every other page on this site tells you what is true today. These tell you what changed, on what date, and whether it reaches you. Each one names its sources, and says plainly what we could not confirm.
Share
Show articles about7 articles
Tax preparers and the WISP: what the PTIN renewal asks, and what the law requiresForm W-12 asks every paid preparer to acknowledge that the law requires a written information security plan. The FTC Safeguards Rule sets out what that plan must contain, and since May 13, 2024 when a breach must be reported to the FTC.Read →
The HIPAA Security Rule overhaul: proposed in 2025, and where it stands nowHHS proposed the first major rewrite of the Security Rule in January 2025. On September 25, 2026 it is still a proposal, and the federal agenda now lists July 2027 for final action.Read →
California's new CCPA rules: what applies now and what starts in 2027California's rules on risk assessments, cybersecurity audits and automated decisionmaking took effect on January 1, 2026. Some duties already apply; the rest arrive between January 2027 and April 2030.Read →
NIST 800-171 Revision 3 is out. Defense contracts still hold you to Revision 2.NIST replaced Revision 2 with Revision 3 in May 2024. The Department of War still writes Revision 2 into its contract clause and its CMMC rule, and a planned switch has not been published.Read →
Three new state privacy laws took effect in 2026. Here is what starts next.Indiana, Kentucky and Rhode Island began on January 1, 2026, and a run of amendments followed. Oklahoma, Louisiana, Alabama and Vermont come next, from 2027.Read →
CMMC Phase 2 is suspended. Here is what still applies.The November 10, 2026 move to third-party CMMC certification is on hold. Self-assessments, NIST SP 800-171 and the affirmations in SPRS are not.Read →
ISO 9001:2026 is published. Here are the transition dates that matter.The new edition came out on September 16, 2026, and so did the rules for moving across. Most coverage is quoting 2029. The date that matters sooner is in 2028.Read →What a standard is, and how it works.
Longer guides that stay current rather than being pinned to a date. Each one names its author, cites the standards body or regulator for every fact, and shows the date its claims were last checked.
What is the NIST Cybersecurity Framework (CSF 2.0)? Explained simplyA customer, partner or bank has asked whether your organization follows the NIST Cybersecurity Framework, or someone has offered to certify you against it. This page explains what the framework is, what using it produces, and what it can and cannot prove.Read →What is PCI DSS? Explained simplyYour bank, payment provider or a customer has asked you to confirm PCI DSS compliance, or to send an Attestation of Compliance, and you want to know what that really involves. This page explains the standard, which questionnaire fits the way you take cards, and how to read and check the documents, from the PCI Security Standards Council's own materials.Read →What is HIPAA? Explained simplyYou handle patient information, or a customer has just sent you a business associate agreement to sign, and you need to know what HIPAA actually requires of you, what it does not, and what happens if you get it wrong.Read →What is CMMC? Explained simplyA defense contract or a prime contractor has asked for your CMMC status, and you want to know what that means for a small business right now. This page explains the program, the NIST standard underneath it, and what still applies since the Department of War suspended Phase 2 on July 13, 2026.Read →Does the GDPR apply to my business? Explained simplyYou run a US company, or a small business anywhere, and somebody has asked whether the GDPR reaches you. Or you are in the EU and want to know what the law actually asks of a company your size. This page answers both, from the text of the Regulation and the bodies that enforce it.Read →What is ISO 27001? Explained simplyA customer, a tender or your board has asked whether you are ISO 27001 certified, and you need to know what that involves before you answer. This page explains the standard, the audit, the certificate and how to check one, from the primary documents.Read →What is SOC 2? Explained simplyA customer has asked your company for a SOC 2 report, or a vendor has just sent you one and you have to decide what it proves. This page explains what the report is, what it takes to get one, and how to read it without being misled.Read →
Have something to teach from your own work? Write a guest article →
Ad from the publisher
Find
help
help
Consultants Assessors Quotes
Matched3 quotesone form
The Shortlist is Yoursfrom this directory
Compare the Modern WayFind the right firm
01
Listings sourced
A card shows a public register or the date we read the firm’s website
02
Published prices where they exist
“Quote only” where we confirmed it, “Not published” where we have not
03
Up to three quotes, one form
Firms don’t see you until you choose
House ad. This slot is open to firms listed for this page.
Get help →Advertise here →
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff