What's changing in frameworks and regulation, and what recent incidents teach. Every item links to its source.
The three-year transition to ISO/IEC 27001:2022 ended on 31 October 2025. Certification is now against the 2022 edition and its reorganized Annex A of 93 controls.
Source: ISO ↗CSF 2.0 added Govern as a sixth function, alongside Identify, Protect, Detect, Respond and Recover, covering cyber risk strategy, roles and supply-chain risk. NIST continues to publish quick-start guides and mappings for it.
Source: NIST ↗The first certifiable management-system standard for AI, now a common anchor for AI governance programs alongside the NIST AI RMF and EU AI Act readiness.
Source: ISO ↗Summaries are for orientation, not legal advice. Check the source before acting.