This Week in AIand Cyber Governance

Four things worth knowing this week, and what to do about each.

1. The CIRCIA incident reporting rule reaches the White House

On October 1, CISA sent its final rule under the Cyber Incident Reporting for Critical Infrastructure Act to the Office of Management and Budget for review. It is expected to be published before the end of the year. The law already sets the clocks: covered entities must report a covered cyber incident within 72 hours, and a ransom payment within 24 hours. Reporting becomes mandatory on dates the final rule will set.

What to do: confirm whether you are a covered entity in a critical infrastructure sector, and add CIRCIA to your incident reporting playbook alongside any SEC, state and sector clocks you already face.

2. The HIPAA Security Rule update slips to 2027

The government's latest regulatory agenda now targets July 2027 for the final HIPAA Security Rule update, after an earlier target of May 2026. The proposal would make encryption and multi-factor authentication mandatory rather than "addressable," among other changes. Until a final rule is issued, the current Security Rule applies.

What to do: don't wait. Encryption, multi-factor authentication and tested incident response are worth having now, and they will put you ahead when the rule lands.

3. The SEC cyber disclosure rules stay in force

The SEC opened a broad review of Regulation S-K in January, and industry groups have asked it to drop the cyber incident 8-K and the annual cyber governance disclosure. But no amendment has been proposed. Public companies still must file an Item 1.05 Form 8-K within four business days of deciding an incident is material, and describe their cyber risk management and governance each year.

What to do: keep your materiality process and disclosure playbook current; any change would need a formal proposal and comment period first.

4. CMMC Phase 2 is two weeks away

From November 10, 2026, DoD contracting officers begin requiring CMMC Level 2 certification by a third-party assessor where they designate it. AI tools that store or process Controlled Unclassified Information are inside that scope.

What to do: if you are preparing for an assessment, confirm that every AI tool your engineers use is either approved for CUI or blocked from it, and documented in your System Security Plan.

Coming up

• November 10, 2026: CMMC Phase 2 begins
• Before year end: CIRCIA final rule expected
• January 1, 2027: California and Colorado automated decision rules begin