Begin SOC 2 Type II audit observation period. Most organizations run a 12-month observation window.

SOC 2 Type II Audit Period Start

Annual update of privacy policy to comply with CCPA/CPRA requirements.

California Attorney General CCPA

CCPA Annual Privacy Policy Update

Indiana's comprehensive consumer data privacy law takes effect. Controllers must provide privacy notices, honor consumer rights (access, correction, deletion, data portability, opt-out), conduct data protection assessments, and implement reasonable security measures.

Indiana Consumer Data Protection Act Takes Effect

Kentucky's comprehensive consumer data privacy law takes effect. Includes standard consumer rights (access, correction, deletion, portability, opt-out of targeted advertising, sale of data, and profiling). Controllers must obtain consent for processing sensitive data.

Kentucky Consumer Data Protection Act Takes Effect

Rhode Island's comprehensive privacy law takes effect. Uniquely, it applies to all entities doing business in the state regardless of size/revenue thresholds for some provisions. Includes consumer rights, privacy notice requirements, and restrictions on processing sensitive data.

Rhode Island Data Privacy Protection Act Takes Effect

California Privacy Protection Agency (CPPA) cybersecurity audit regulations took effect January 1, 2026. Businesses meeting thresholds must conduct cybersecurity audits assessing their security posture. This is the first-of-its-kind among state data privacy laws. Audit certifications must be filed with CPPA on staggered deadlines.

CCPA Cybersecurity Audit Regulations Take Effect

Businesses subject to CCPA risk assessment requirements must begin compliance with new regulations for privacy risk assessments. These assessments must evaluate the benefits and risks of processing personal information for specified purposes, including automated decision-making technology.

CCPA Risk Assessment Requirements Take Effect

China's amended Cybersecurity Law took effect January 1, 2026, with significantly increased penalties: maximum fines increased fivefold for general violations, with a new severe violations category carrying fines up to RMB 10 million. The CSL now has expanded extraterritorial reach covering overseas organizations harming China's cybersecurity.

China Amended Cybersecurity Law - In Effect

Multiple Oregon Consumer Privacy Act amendments take effect: (1) Prohibition on selling precise geolocation data; (2) Ban on processing children's data for targeted advertising, selling, or profiling regardless of consent; (3) Mandatory universal opt-out mechanism recognition; (4) Cure period expires -- Attorney General can proceed directly to enforcement without notice.

Oregon Consumer Privacy Act - Enhanced Enforcement

Alaska's provisions of the NAIC Insurance Data Security Model Law (#668) take effect in 2026. Insurance companies, agents, and other entities licensed by the state department of insurance must develop, implement, and maintain information security programs, investigate cybersecurity events, and notify the state insurance commissioner within 3 days.

NAIC Insurance Data Security Model Law - Alaska

As of 2026, Global Privacy Control (GPC) is effectively mandatory in California, Colorado, Connecticut, Oregon, and additional states. Businesses must recognize and honor Universal Opt-Out Mechanism signals from browsers and extensions. Failure to honor GPC signals constitutes a violation in these states.

CCPA Universal Opt-Out Mechanism - Multi-State Mandate

New formal FedRAMP Security Inbox Requirements apply to all cloud service providers (both 20x and Rev5) beginning January 5, 2026. CSPs must maintain a monitored security inbox for communications from FedRAMP, agencies, and other stakeholders.

FedRAMP Security Inbox Requirements

Sweden's national implementation of NIS2 enters into force on January 15, 2026. Entities must register promptly and comply with all obligations including incident reporting within 24 hours (early warning) and 72 hours (full notification), risk management measures, supply chain security requirements, and business continuity management.

Sweden NIS2 Cybersecurity Act Takes Effect

By January 17, 2026, the European Commission shall carry out a review of DORA requirements and submit a report to the European Parliament and the Council on the appropriateness of strengthened requirements for statutory auditors and audit firms. National competent authorities are expected to carry out audits and supervisory reviews in early 2026.

DORA European Commission Supervisory Review

Monthly Continuous Monitoring deliverables submission to FedRAMP PMO.

FedRAMP Monthly ConMon Submission - Jan

The Minnesota Consumer Data Privacy Act's 30-day cure period sunsets on January 31, 2026. After this date, the Attorney General is no longer required to provide notice and a 30-day cure window before bringing enforcement actions. Full enforcement begins immediately upon identification of violations.

Minnesota Consumer Data Privacy Act - Full Enforcement

The FDA's Quality Management System Regulation (QMSR) replaces the existing Quality System Regulation (QSR) under 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. All medical device manufacturers marketing devices in the US must comply. Risk-based thinking must be embedded in all operations.

FDA QMSR - Quality Management System Regulation

FDA published updated guidance on cybersecurity in medical devices. Under Section 524B, cyber device manufacturers must submit cybersecurity plans for postmarket vulnerability monitoring, demonstrate secure design practices, and provide Software Bill of Materials (SBOM) with all premarket submissions (510(k), PMA, De Novo, HDE).

FDA Cybersecurity Guidance - Premarket Requirements

Key reforms from the UK Data (Use and Access) Act 2025 took effect on February 5, 2026. Changes include: automated decision-making is now permitted subject to safeguards; new recognised legitimate interests lawful basis for processing; e-privacy penalty alignment with UK GDPR; and new complaint handling requirements for controllers.

UK Data Use and Access Act - Core Reforms

Annual NIS2 entity registration window closes February 28, 2026. Essential and important entities must register with national authorities. The registration must include entity details, sector classification, and contact information for cybersecurity coordination.

NIS2 - Entity Registration Deadline

Updated national standards governing cross-border data transfers take effect on March 1, 2026. Data processors in China must satisfy at least one compliance pathway: passing CAC security assessment or obtaining personal information protection certification.

China Cross-Border Data Transfer Certification Rules

Large accelerated filers with December 31, 2025 fiscal year-end must file Form 10-K including mandatory cybersecurity disclosures under Item 106 of Regulation S-K. Must include cybersecurity risk management processes, board oversight description, management role in cybersecurity, and whether risks have materially affected the company.

SEC Annual 10-K Cybersecurity Disclosure (FY2025)

All PCI DSS 4.0.1 requirements become mandatory. Organizations must be fully compliant with all new requirements that were previously best practices.

PCI SSC Official Site

PCI DSS 4.0.1 Summary of Changes

PCI DSS 4.0.1 Full Enforcement

Quarterly external vulnerability scan by an Approved Scanning Vendor (ASV) required for PCI DSS compliance.

PCI DSS Quarterly ASV Scan - Q1

Quarterly user access review for SOC 2 compliance.

SOC 2 Quarterly Access Review - Q1

Annual review and update of privacy notices to ensure they accurately reflect current data processing activities.

GDPR Annual Privacy Notice Review

Q1 quarterly vulnerability scanning as recommended by NIST SP 800-53 RA-5.

NIST Quarterly Vulnerability Scanning Q1

Annual internal audit of the Information Security Management System required under ISO 27001 Clause 9.2.

ISO 27001 Internal Audit

Q1 quarterly authenticated vulnerability scanning for all FedRAMP systems.

FedRAMP Quarterly Vulnerability Scan

Financial entities must submit their Register of Information (RoI) detailing all contractual arrangements with ICT third-party service providers to their national competent authority by March 31, 2026. Data must reflect status as of December 31, 2025. Submissions must be in xBRL-CSV format.

DORA Register of Information Annual Submission

FedRAMP 20x Phase 2 pilot expected to conclude by Q2 FY26 (March 31, 2026). The pilot tests the new cloud-native authorization framework emphasizing machine-readable packages, continuous evidence, and automated monitoring. After this phase, FedRAMP plans to stop accepting new Rev5-based agency authorizations.

FedRAMP 20x Phase 2 Pilot Completion

Enforcement begins for MODPA. Notably stricter than most state privacy laws: requires data minimization (only collect data reasonably necessary), prohibits sale of sensitive data outright regardless of consent, and requires data protection assessments for high-risk processing.

Maryland Online Data Privacy Act - Enforcement Begins

Covered entities must file annual certifications of compliance with NYDFS Cybersecurity Regulation (23 NYCRR Part 500), including the November 1, 2025 amendments requiring expanded MFA for all information system access and written asset inventory procedures. This is the first certification cycle that includes the final tranche of Second Amendment requirements.

NYDFS Part 500 - Annual Certification Filing

April monthly Continuous Monitoring deliverables submission.

FedRAMP Monthly ConMon Submission - Apr

TSA Security Directive Pipeline-2021-02F expires on May 2, 2026. Pipeline operators must have a TSA-approved Cybersecurity Implementation Plan, maintain an up-to-date Cybersecurity Incident Response Plan, and operate an annual Cybersecurity Assessment Program. TSA is expected to issue renewal or replacement directives.

TSA Pipeline Cybersecurity Directive Expiration

CISA is expected to finalize the CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) implementing regulations by May 2026. Once effective, critical infrastructure operators must report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours.

CIRCIA Final Rule Expected

Smaller financial institutions must comply with amendments to SEC Regulation S-P. Requirements include: written policies for detecting, responding to, and recovering from unauthorized access; customer notification within 30 days of breach discovery; service provider oversight with 72-hour breach notification clauses; incident response program; and enhanced recordkeeping.

SEC Regulation S-P - Smaller Entity Compliance

Rules on notifying and appointing conformity assessment bodies become applicable to EU Member States. Member States must have notified bodies in place to assess products with digital elements for cybersecurity compliance.

EU CRA - Conformity Assessment Body Designation

New right to complain comes into force under the UK DUAA. Controllers must acknowledge complaints within 30 days and provide full response without undue delay. This formalizes complaint handling procedures under UK data protection law for the first time.

UK DUAA - Complaint Response Requirements

Q2 quarterly external vulnerability scan by an Approved Scanning Vendor.

PCI DSS Quarterly ASV Scan - Q2

Annual review of Business Associate Agreements to ensure all vendors handling PHI have current BAAs in place.

HIPAA Business Associate Agreement Review

Q2 quarterly user access review for SOC 2 compliance.

SOC 2 Quarterly Access Review - Q2

Annual review of Data Processing Agreements with all third-party processors.

GDPR Official Text

GDPR Annual DPA Review

Semi-annual review of Records of Processing Activities (ROPA) required under Article 30 GDPR.

GDPR Records of Processing Review

Q2 quarterly vulnerability scanning per NIST SP 800-53 RA-5.

NIST Quarterly Vulnerability Scanning Q2

Annual surveillance audit by certification body to maintain ISO 27001 certification.

ISO 27001:2022

ISO 27001 Surveillance Audit

Semi-annual review of consumer request handling processes for CCPA compliance.

CCPA Consumer Request Process Review

Prepare for annual cyber insurance renewal. Insurers increasingly require evidence of compliance frameworks, MFA, EDR, and incident response plans.

Cyber Insurance Renewal Preparation

Annual review and testing of Business Continuity Plan including disaster recovery procedures.

Business Continuity Plan Review

The deadline for companies to complete their first audit verifying NIS2 compliance was extended from December 31, 2025, to June 30, 2026. Organizations must demonstrate implementation of cybersecurity risk management measures, incident response capabilities, and supply chain security.

NIS2 First Compliance Audit Deadline

The European Data Protection Board's 2026 coordinated enforcement action focuses on transparency and information obligations under GDPR Articles 12-14. Data protection authorities across EU member states will conduct investigations and potentially issue enforcement actions focused on how organizations explain their data collection, use, and sharing practices.

EDPB 2026 Coordinated Enforcement - Transparency

Colorado SB24-205 Consumer Protections for AI takes effect (delayed from February 1, 2026). Developers must exercise reasonable care to prevent algorithmic discrimination, publish documentation on high-risk AI systems, and disclose known discrimination risks. Deployers must adopt risk management policies, conduct initial and annual impact assessments, and provide pre-decision and adverse-decision consumer notices.

Colorado AI Anti-Discrimination Law Takes Effect

The Netherlands' cybersecurity bill implementing NIS2 is expected to enter into force in Q2 2026. Essential and important entities will need to register, implement risk management measures, and establish incident reporting procedures.

Netherlands NIS2 Implementation Expected

Financial entities must review and update their ICT risk management frameworks at least annually. The 2026 mid-year review cycle is a critical checkpoint for demonstrating ongoing compliance. Entities must maintain and update ICT risk policies, business continuity plans, ICT incident management procedures, and digital operational resilience testing programs.

DORA ICT Risk Management Framework Review

Significant amendments to Connecticut's Data Privacy Act take effect. Applicability threshold lowered from 100,000 to 35,000 consumers. Sensitive data definition expanded to include neural data, disability-related treatment, nonbinary status, financial account information, and government-issued ID data. New prohibition on sale of sensitive data without consent.

Connecticut Data Privacy Act Amendments - Expanded Scope

Utah's Digital Choice Act takes effect, requiring social media companies to implement data portability and interoperability tools. This is the first US state law explicitly requiring social media platforms to build tools allowing users to transfer personal data (friends, connections, photos, likes, social graph) to other services.

Utah Digital Choice Act - Data Portability Requirements

The HIPAA Security Rule modernization is scheduled to be finalized around May 2026, with the rule likely effective July/August 2026. Major changes: elimination of addressable vs required distinction (all become required), mandatory MFA, mandatory encryption, 12-month risk assessment cycle, 24-hour business associate breach notification, and enhanced workforce training requirements.

HIPAA Security Rule Modernization - Final Rule

July monthly Continuous Monitoring deliverables submission.

FedRAMP Monthly ConMon Submission - Jul

The majority of the EU AI Act rules come into force on August 2, 2026. Requirements for Annex III high-risk AI systems become enforceable, including AI used in employment, credit decisions, education, and law enforcement contexts. Organizations must have quality management systems, risk management frameworks, technical documentation, conformity assessments, and EU database registrations in place.

EU AI Act - High-Risk AI Systems Compliance

Article 50 transparency rules become enforceable. AI systems that interact with natural persons must be designed so that individuals are informed they are interacting with AI. Providers of AI systems that generate synthetic content (deepfakes, AI-generated text) must ensure outputs are marked as artificially generated.

EU AI Act - Transparency Obligations

Manufacturers of products with digital elements must begin reporting actively exploited vulnerabilities and severe incidents. Mandatory timelines include: early warning within 24 hours, full notification within 72 hours, and final report no later than 14 days after a corrective measure is available. These obligations apply to ALL products already on the EU market, including legacy products.

EU CRA - Vulnerability Reporting Obligations Begin

Q3 quarterly external vulnerability scan by an Approved Scanning Vendor.

PCI DSS Quarterly ASV Scan - Q3

Q3 quarterly user access review for SOC 2 compliance.

SOC 2 Quarterly Access Review - Q3

Review and update Data Protection Impact Assessments for high-risk processing activities under Article 35 GDPR.

GDPR Data Protection Impact Assessment Review

Annual update of information security risk assessment per ISO 27001 Clause 6.1.2.

ISO 27001 Risk Assessment Update

Annual security assessment of critical third-party vendors and service providers.

Vendor Security Assessment

Annual data mapping exercise to identify all personal information collected, sources, purposes, and third-party sharing.

CCPA Annual Data Mapping

Annual tabletop exercise to test incident response plan. Required by PCI DSS, HIPAA, SOC 2, NIST, and ISO 27001.

Incident Response Plan Test

FedRAMP anticipates making machine-readable package requirements effective September 30, 2026, with a one-year grace period. CSPs must submit authorization packages in machine-readable format. Services not complying after the grace period may lose FedRAMP Certification.

FedRAMP Machine-Readable Package Requirement

All new DoD contracts will require CMMC certification at the appropriate level (1, 2, or 3). Level 1 covers basic Federal Contract Information (FCI) with 17 practices and self-assessment. Level 2 covers Controlled Unclassified Information (CUI) with all 110 NIST SP 800-171 practices and third-party C3PAO assessment. Level 3 covers Advanced Persistent Threats with government-led assessment.

CMMC Mandatory in All DoD Contracts

Annual self-assessment for organizations handling Controlled Unclassified Information (CUI).

NIST 800-171 Annual Self-Assessment

October monthly Continuous Monitoring deliverables submission.

FedRAMP Monthly ConMon Submission - Oct

Phase 2 of India's Digital Personal Data Protection Act enforcement begins. Provisions related to consent managers take effect, including registration of consent managers with the Data Protection Board of India (DPBI), obligations of consent managers, and DPBI powers to investigate breaches and impose penalties.

India DPDP Act Phase 2 - Consent Manager Registration

Automated decision-making transparency obligations under Australia's Privacy Act come into effect. APP entities must include information about automated decisions in their privacy policies, explaining how automated systems make decisions about individuals and what safeguards are in place. The Children's Online Privacy Code must also be registered by this date.

Australia ADM Transparency Obligations

Prepare annual compliance status report for board of directors and executive leadership.

End-of-Year Compliance Reporting

PCAOB's QC 1000 (A Firm's System of Quality Control) takes effect. Audit firms must design, implement, and operate a quality control system compliant with QC 1000. Firms auditing 100+ issuers must establish an External Quality Control Function (EQCF). This affects cybersecurity disclosures through SOX IT audit quality.

PCAOB QC 1000 - Quality Control Standard Takes Effect

CSPs must submit a complete authorization package no later than December 16, 2026, to obtain FedRAMP Certification at Levels 1-4 through a time-limited 2026 opportunity under the Rev5 framework. This is a critical deadline for organizations seeking authorization before the full transition to 20x.

FedRAMP Rev5 Authorization Package Deadline

Q4 quarterly external vulnerability scan by an Approved Scanning Vendor.

PCI DSS Quarterly ASV Scan - Q4

Annual penetration testing required under PCI DSS Requirement 11.4. Must test both internal and external networks.

PCI DSS Annual Penetration Test

Annual security risk assessment required under HIPAA Security Rule. Must identify risks to ePHI confidentiality, integrity, and availability.

HHS HIPAA Security Rule

HIPAA Annual Risk Assessment

Annual HIPAA Privacy Rule training for all workforce members who handle PHI.

HIPAA Privacy Rule Training

Complete SOC 2 Type II audit for the 2026 reporting period.

SOC 2 Type II Audit Completion

Q4 quarterly user access review for SOC 2 compliance.

SOC 2 Quarterly Access Review - Q4

Annual assessment against NIST Cybersecurity Framework.

NIST CSF 2.0

NIST CSF Annual Assessment

Annual management review of ISMS performance required under ISO 27001 Clause 9.3.

ISO 27001 Management Review

Annual security assessment required for FedRAMP authorized cloud service providers.

FedRAMP.gov

FedRAMP Annual Assessment

Annual security awareness training for all employees. Required by multiple frameworks.

Security Awareness Training Completion

Annual review of data retention and disposal policies.

Data Retention Policy Review

Every EU Member State must make at least one certified EU Digital Identity Wallet available to citizens and residents by late December 2026 under Regulation (EU) 2024/1183 (eIDAS 2.0). This has significant implications for organizations that authenticate users, as they may need to accept wallet-based identity verification.

EU Digital Identity Wallet - Member State Availability

SWIFT customers must submit their annual security attestation via the KYC-SA platform by December 31, 2026, using CSCF v2026. New for 2026: Control 2.4 Back Office Data Flow Security becomes mandatory, requiring protection of bridging servers between secure zones and back-office systems. Independent assessments are required to support attestations.

SWIFT CSP Annual Attestation Deadline

The 2026 SOX reporting cycle requires expanded IT controls coverage for new FASB disclosure standards (ASU 2023-07 segments, ASU 2023-09 tax, ASU 2023-08 crypto). SOX scope must also cover faster 8-K materiality judgments for cyber incidents, sustainability data controls, and address PCAOB inspection expectations around cloud migrations, AI use, and vendor shifts.

SOX IT Controls - New FASB Disclosure Requirements

OCR's risk analysis enforcement initiative expands in 2026 to include risk management. OCR now evaluates not just whether organizations conduct risk analyses but how they act on those analyses. Weak execution and stagnant risk remediations are increasingly associated with regulatory enforcement.

HIPAA Risk Analysis Enforcement Expansion

Organizations that missed the October 31, 2025 transition deadline from ISO 27001:2013 to ISO 27001:2022 must now pursue entirely new ISO 27001:2022 certification (not a transition). This requires a full initial certification audit process. All new certifications issued in 2026 must be against the 2022 version.

ISO 27001:2022 - Post-Transition New Certification

Eligible CSPs may obtain a temporary FedRAMP Validated Level 1 authorization by demonstrating they have obtained an independent assessment under frameworks including StateRAMP/GovRAMP. This new pathway expands the FedRAMP marketplace by recognizing existing certifications from state-level programs.

FedRAMP Authorization via StateRAMP/GovRAMP Pathway

Under PCI DSS 4.0.1 (now mandatory), scope definition must be done annually for merchants (every six months for TPSPs) with thorough documentation. Additionally, disk-level encryption no longer qualifies as encryption at rest (except on removable media), and automated technical solutions are required for public-facing web applications.

PCI DSS 4.0.1 Scope Definition and Documentation

Healthcare organizations classified as critical infrastructure under CIRCIA must prepare for compliance with final reporting rules expected by mid-2026. Once effective, covered healthcare entities must report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours.

CIRCIA Healthcare Sector Compliance Preparation

SWIFT mandates that all connected banks implement standardized cyber incident response protocols by 2026. Banks must establish formalized incident response procedures aligned with SWIFT CSP requirements, including detection, containment, eradication, and recovery phases. Banks must also demonstrate capability for coordinated response with SWIFT's CIRT.

Never Miss a Compliance Deadline

Calendar View

February 2026

Upcoming Deadlines

NIS2 - Entity Registration Deadline

China Cross-Border Data Transfer Certification Rules

SEC Annual 10-K Cybersecurity Disclosure (FY2025)

Stay Ahead of Compliance Deadlines