Regulations & standards
Each page covers status, who it applies to, key dates, and an indicative IEC 62443 mapping. Sources are listed per item; dates we haven't confirmed against a primary source are flagged.
| Regulation / standard | Jurisdiction | Type | Status | Next date | Last verified |
|---|---|---|---|---|---|
| NIS2 NIS2 Directive (EU) 2022/2555 |
EU | Directive (transposed into national law) | active In force; national transposition largely complete, 4 Member States referred to CJEU | — | 28 Oct 2026 |
| CRA EU Cyber Resilience Act (Regulation (EU) 2024/2847) |
EU | Regulation (directly applicable) | active In force; reporting obligations apply since 11 Sep 2026; main obligations from 11 Dec 2027 | 11 Dec 2027 Main obligations apply (essential requirements, CE marking);... |
28 Oct 2026 |
| IEC 62443 ISA/IEC 62443 series (Industrial Automation and Control Systems security) |
International standard | Consensus standard (voluntary unless referenced by law/contract) | reference Published; parts revised on a rolling basis | — | 28 Oct 2026 |
| NERC CIP NERC CIP Reliability Standards (North America, Bulk Electric System) |
US / Canada (FERC-approved, NERC-enforced) | Mandatory reliability standards | active Multiple standards in force; several revisions subject to future enforcement | 1 Jul 2028 Multiple revised CIP standards (e.g. CIP-004-8, CIP-005-8,... |
28 Oct 2026 |
| UK NIS / CS&R Bill UK NIS Regulations 2018 & Cyber Security and Resilience (NIS) Bill |
United Kingdom | Regulations in force + Government Bill in Parliament | changing NIS Regulations 2018 in force; CS&R Bill at Lords third reading (scheduled 2 Nov 2026) | 2 Nov 2026 Lords third reading scheduled |
28 Oct 2026 |
| TSA SDs US TSA Pipeline & Rail Cybersecurity Security Directives |
United States | Security Directives (+ pending rulemaking RIN 1652-AA74) | active SD Pipeline-2021-02G and SD 1580/82-2022-01E in force 3 May 2026 – 2 May 2027; final rule TBD | 2 May 2027 Current pipeline and rail SDs expire (renewal expected to be... |
28 Oct 2026 |
| CIRCIA US CIRCIA – Cyber Incident Reporting for Critical Infrastructure Act of 2022 |
United States | Statute + CISA rulemaking (RIN 1670-AA04) | changing Final rule under OMB/OIRA review (submitted 1 Oct 2026); reporting not yet mandatory | — | 28 Oct 2026 |
| SOCI Australia Security of Critical Infrastructure Act 2018 (SOCI) & CIRMP Rules |
Australia | Act + Rules | active In force; annual CIRMP reporting cycle | — | 28 Oct 2026 |
| CER EU Critical Entities Resilience Directive (EU) 2022/2557 |
EU | Directive (transposed into national law) | active Transposition deadline passed 17 Oct 2024; infringement procedures opened Nov 2024 | — | 28 Oct 2026 |
| Machinery Reg. EU Machinery Regulation (EU) 2023/1230 |
EU | Regulation (directly applicable) | upcoming Adopted; applies from 20 Jan 2027 (needs verification) | 20 Jan 2027 Regulation applies (general date of application) |
28 Oct 2026 |