Updates
Compliance news
Short, curated pointers to official framework updates—HIPAA, SOC 2, CMMC, PCI DSS, NIST, CIS, CJIS, ISO 27001, FERPA, PIPEDA, Loi 25—and related assurance program changes. We link the primary source; notes are for orientation only—not legal advice or a certification claim.
Human-approved list. Framework feeds are checked daily. Security exploits, CVEs, and ransomware advisories are out of scope. Items stay draft until a human publishes them. Prefer the linked agency or standards body page as the source of truth.
- CISA
#StopRansomware: SafePay Ransomware
- General
MSP note: CISA published an update related to security and compliance: “#StopRansomware: SafePay Ransomware.” Review the official source and check whether any clients use the affected products, controls, or requirements.
- AICPA & CIMA
AICPA and AIUC announce joint SOC 2® + AIUC-1 assurance offering
- SOC 2
- AI
MSP note: CPA firms will package a standard SOC 2 with AIUC-1 agent safety testing. Broader launch is aimed at early 2027. MSPs should watch for AI-agent questions in security questionnaires; this does not replace SOC 2 readiness work.
- CISA
CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support
- General
MSP note: CISA is urging immediate patching of a critical, actively exploited authentication bypass in BeyondTrust Remote Support (CVE-2026-102764; KEV as of Oct 16, 2026). Self-hosted appliances on 26.2.3 and earlier need BT26-05-RS (upgrade first if older than 24.3.1); BeyondTrust-hosted SaaS was already patched. If you or clients run on-prem Remote Support, inventory those boxes, patch or isolate, hunt for odd admin sessions, and rotate any credentials the appliance held.
- CISA
CISA Adds One Known Exploited Vulnerability to Catalog
- General
MSP note: CISA published an update related to security and compliance: “CISA Adds One Known Exploited Vulnerability to Catalog.” Review the official source and check whether any clients use the affected products, controls, or requirements.