Building an AI inventory: record the use, assign an owner and keep it current
Build a manageable AI inventory by recording business uses, assigning owners and making gaps visible—then define how entries stay current.
NIST proposes design tenets for managing AI-agent identities and access
NIST’s proposed AI-agent identity tenets offer a basis for reviewing delegated access, revocation and oversight, without creating new compliance requirements.
NIST finalizes post-quantum cryptography transition roadmap
NIST’s final post-quantum cryptography transition report gives migration planners a framework for assessing cryptographic uses, supplier dependencies and applicable federal milestones.
NIST opens consultation on an executive cybersecurity handbook aligned with CSF 2.0
NIST’s draft executive cybersecurity handbook follows CSF 2.0’s structure. Comments close December 4; practitioners can review leadership reporting without assuming new requirements.
EU cyber authorities urge immediate action on two critical PHP vulnerabilities
EU cyber authorities urge immediate remediation of two PHP vulnerabilities, including checks with hosting providers and suppliers whose products may contain PHP.
NIST opens consultation on revised operational technology security guidance
NIST is seeking comments on draft OT security guidance until November 30. Here are practical areas to review without treating the consultation as a compliance deadline.
NIST opens consultation on a CSF 2.0 profile for federal O-RAN deployments
NIST’s draft CSF 2.0 profile for federal O-RAN deployments is open for comment until November 2. Teams can review its risk-management mappings without treating them as final requirements.
NIST finalizes token-protection guidance: what to review with cloud providers
NIST’s final token-protection guidance updates signing-key protection, validity decisions and workload identity recommendations. Here are practical questions for a focused cloud-control review.
CRA reporting readiness: dates, awareness timestamps and final-report follow-up
CRA reporting duties apply before the regulation’s wider requirements. Manufacturers should review existing products, preserve awareness timestamps and track distinct final-report deadlines.
NIST expands DevSecOps resources while agentic-AI work remains in planning
NIST has expanded its DevSecOps resources with SSDF mapping and implementation examples. Human-directed AI is demonstrated; agentic-AI work remains in planning.