Cybersecurity Laws and Regulations in 2026: A Plain-English Guide

Updated September 2026. We rewrote this guide to reflect the laws and rules in force today, including recent changes to the FTC Safeguards Rule, the SEC’s cyber disclosure rules, CIRCIA, CMMC and new EU laws. Each status below was checked in September 2026 and links to its source. This is general information, not legal advice.

There is no single U.S. cybersecurity law. Instead, organizations face a patchwork: federal rules for specific sectors (healthcare, finance, government and defense), disclosure rules for public companies, state privacy and breach notification laws, and criminal laws that punish hacking. Companies that operate in Europe also have to deal with GDPR, NIS2, DORA and the Cyber Resilience Act.

This guide explains what each major law covers, who it applies to and where it stands in 2026.

Cybersecurity laws at a glance (September 2026)

Healthcare: HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities and their business associates to protect electronic protected health information with administrative, physical and technical safeguards, including a risk analysis. The Breach Notification Rule requires notifying affected individuals, HHS and, for large breaches, the media.

What’s changing: In January 2025, HHS proposed the first major update to the Security Rule in years. It would make most safeguards mandatory, including multi-factor authentication, encryption, asset inventories and regular vulnerability scanning (Federal Register). As of mid-2026, the rule is not final: HHS moved it to its long-term actions list and now projects final action for July 2027 (Davis Wright Tremaine). The current Security Rule remains fully enforceable. For more on the threats hospitals face, see our healthcare cybersecurity guide.

Finance: GLBA, the FTC Safeguards Rule and banking rules

The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customer information. For non-bank financial companies such as mortgage brokers, auto dealers, payday lenders and tax preparers, the FTC enforces it through the Safeguards Rule.

Amendments that took effect on June 9, 2023 require a written information security program overseen by a “qualified individual,” a written risk assessment, multi-factor authentication, encryption of customer data, and regular testing and reporting to the board (FTC). Since May 13, 2024, covered companies must also notify the FTC within 30 days of discovering a breach involving unencrypted information of at least 500 consumers (FTC).

Other financial rules to know:

• Bank incident notification rule: banks must notify their federal regulator within 36 hours of a significant computer-security incident, with compliance required since May 1, 2022 (FDIC).
• SEC Regulation S-P: amendments adopted in 2024 require brokers, investment advisers and similar firms to have an incident response program and notify affected customers within 30 days. Larger firms had to comply by December 2025 and smaller firms by June 2026 (SEC).
• New York DFS Part 500: New York’s cybersecurity regulation for banks, insurers and other licensed firms was amended in 2023. The final requirements, including broad MFA and a full asset inventory, took effect on November 1, 2025 (Greenberg Traurig).

Government: FISMA

The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies to run risk-based security programs based on NIST standards, report incidents and undergo annual reviews. It updated the original 2002 law and gave the Department of Homeland Security, where CISA now leads this work, an operational role in federal cybersecurity (CISA). Contractors that run systems for agencies are usually bound by FISMA requirements through their contracts.

Critical infrastructure: CIRCIA

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. The law only takes effect through CISA’s final rule.

CISA published its proposed rule in April 2024. As of September 2026, the final rule has not been issued. CISA says funding lapses slowed the work, and it held four town hall meetings on the rule in June 2026 (CISA). Until the rule is final, reporting to CISA is voluntary, though sector rules may already require it. Our guide to cyber attacks on critical infrastructure explains why these sectors are a priority.

A related law, the Cybersecurity Information Sharing Act of 2015, gives companies legal protections when they share threat information with the government and each other. It was written to last 10 years and has since been kept alive with short-term extensions; the latest runs to December 11, 2026, according to the Congressional Research Service. Check its status if your company depends on those protections.

Public companies: SEC cybersecurity disclosure rules

Rules the SEC adopted in July 2023 require public companies to:

• File a Form 8-K (Item 1.05) within four business days of determining that a cybersecurity incident is material, describing its nature, scope, timing and likely impact.
• Describe their cybersecurity risk management, strategy and governance, including board oversight, in their annual 10-K (Regulation S-K Item 106).

The rules took effect in December 2023, with smaller reporting companies following in June 2024 (SEC). Banking and financial industry trade groups petitioned the SEC in May 2025 to rescind the incident disclosure requirement (SEC petition), and the SEC is reviewing Regulation S-K disclosures. As of September 2026, the rules have not been rescinded and remain in effect.

Defense contractors: CMMC

The Cybersecurity Maturity Model Certification (CMMC) program checks that defense contractors protect federal contract information (FCI) and controlled unclassified information (CUI). It has three levels:

• Level 1: 15 basic safeguarding requirements for FCI, with an annual self-assessment.
• Level 2: the 110 requirements of NIST SP 800-171 for CUI, verified by self-assessment or a third-party assessor (C3PAO).
• Level 3: Level 2 plus selected NIST SP 800-172 requirements, assessed by the government.

The program rule (32 CFR Part 170) took effect in December 2024, and the rule adding CMMC to defense contracts took effect on November 10, 2025, starting Phase 1 (Federal Register). Phase 2, which would have required third-party Level 2 certifications from November 10, 2026, was suspended on July 13, 2026 while the department reviews the program. During the suspension, contracts may only require Level 1 or Level 2 self-assessments, and existing obligations such as NIST SP 800-171 and incident reporting under DFARS still apply (Morgan Lewis; DoD CIO).

State laws: breach notification and privacy

All 50 states, plus D.C. and U.S. territories, have laws requiring businesses to notify people when their personal information is breached (NCSL). Deadlines and definitions vary, so companies with customers in many states have to follow the strictest rules that apply.

States have also passed comprehensive consumer privacy laws that give residents rights over their data and require “reasonable” security. As of August 2026, 24 states have enacted one; Alabama, Louisiana, Oklahoma and Vermont were added in 2026, with effective dates in 2027 and 2028 (Privacy World).

California goes further. Regulations effective January 1, 2026 require certain businesses to conduct annual cybersecurity audits and risk assessments, with the first audit certifications phased in starting in 2028 for the largest companies (California Privacy Protection Agency).

Criminal law: the Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is the main federal anti-hacking law. It makes it a crime to access a computer without authorization or to exceed authorized access, and it also covers spreading damaging code and trafficking in passwords (18 U.S.C. § 1030). Victims can also sue under it.

Two changes narrowed its reach. In Van Buren v. United States (2021), the Supreme Court held that someone “exceeds authorized access” only when they enter parts of a system that are off-limits to them, not when they misuse data they are allowed to see (Supreme Court opinion). In May 2022, the Justice Department said it would not charge good-faith security research under the CFAA (DOJ Justice Manual 9-48.000). If you’re considering a career in penetration testing, stay within written scope and authorization.

Cybercrime is still hard to prosecute. Attackers often operate from countries that won’t extradite them, many victims never report, and criminals use cryptocurrency and anonymizing services to hide. Reporting to the FBI’s Internet Crime Complaint Center helps investigators connect cases and sometimes recover funds.

International laws: GDPR, NIS2, DORA and the Cyber Resilience Act

• GDPR: the EU’s data protection law requires appropriate security for personal data and notifying regulators of breaches within 72 hours where feasible. Fines can reach €20 million or 4% of global annual turnover (GDPR text).
• NIS2: expands EU cybersecurity duties to many more sectors, such as energy, transport, health, digital infrastructure and manufacturing. It requires risk management measures, management accountability and staged incident reporting (an early warning within 24 hours, a notification within 72 hours and a final report within a month). Member states had until October 17, 2024 to write it into national law, and in November 2024 the Commission warned 23 countries that had not fully done so (European Commission; Commission notice). Check the national law in each country where you operate.
• DORA: the Digital Operational Resilience Act has applied to EU financial firms since January 17, 2025. It covers ICT risk management, incident reporting, resilience testing and oversight of critical tech providers (ESMA).
• Cyber Resilience Act (CRA): sets security requirements for hardware and software products sold in the EU. It entered into force on December 10, 2024. Reporting of actively exploited vulnerabilities applies from September 11, 2026, and the main obligations from December 11, 2027 (European Commission).

How to stay compliant

Most of these laws ask for the same basics: know your data and systems, assess risk, use MFA and encryption, patch, train staff, manage vendors, and have a tested incident response plan with clear reporting deadlines. The practical approach is to build one security program on a recognized framework and map each law’s specific requirements to it.

• Our guide to cybersecurity frameworks compares NIST CSF 2.0, CIS Controls, ISO 27001 and others.
• Our cybersecurity compliance guide explains how to turn requirements into controls and evidence.
• Password and MFA rules show up in almost every regulation. See our password policy best practices.
• Working with the U.S. Department of Defense? Our guide to IAM vs IAT certifications covers the DoD 8140 workforce requirements.

Rules change fast. The CyberExperts Daily Brief tracks new regulations, deadlines and enforcement actions in a short weekday email.

Frequently asked questions

Sources

• Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, Jan 6, 2025): federalregister.gov
• Davis Wright Tremaine, HHS Updates HIPAA Rulemaking Timeframes (July 2026): dwt.com
• FTC, FTC Safeguards Rule: What Your Business Needs to Know: ftc.gov
• FTC, FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches: ftc.gov
• FDIC, Computer-Security Incident Notification Implementation (FIL-12-2022): fdic.gov
• SEC, SEC Adopts Amendments to Regulation S-P (2024-58): sec.gov
• Greenberg Traurig, NYDFS Final Cybersecurity Rules (Nov 2025): gtlaw.com
• CISA, Federal Information Security Modernization Act: cisa.gov
• CISA, Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA): cisa.gov
• Congressional Research Service, The Cybersecurity Information Sharing Act of 2015: Expiring Provisions (IF12959): congress.gov (PDF)
• SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (2023-139): sec.gov
• SEC, Joint Petition for Rulemaking to rescind Form 8-K Item 1.05 (May 2025): sec.gov
• Federal Register, DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (Sept 10, 2025): federalregister.gov
• Morgan Lewis, Department of War Suspends CMMC Phase II Requirements, but Cybersecurity Obligations Remain (July 2026): morganlewis.com
• DoD CIO, Cybersecurity Maturity Model Certification: dodcio.defense.gov
• NCSL, Security Breach Notification Laws: ncsl.org
• Privacy World, Adding to the Count: The latest in state consumer privacy laws (Aug 2026): privacyworld.blog
• California Privacy Protection Agency, CCPA Updates, Cybersecurity Audits, Risk Assessments and ADMT Regulations: cppa.ca.gov
• Legal Information Institute, 18 U.S. Code § 1030: law.cornell.edu
• Supreme Court, Van Buren v. United States (2021): supremecourt.gov (PDF)
• U.S. Department of Justice, Justice Manual 9-48.000, Computer Fraud and Abuse Act (charging policy revised May 19, 2022): justice.gov
• GDPR text: gdpr-info.eu
• European Commission, NIS2 Directive: digital-strategy.ec.europa.eu
• ESMA, Digital Operational Resilience Act (DORA): esma.europa.eu
• European Commission, Cyber Resilience Act: digital-strategy.ec.europa.eu

Oliviah Nelson

Oliviah Nelson is an avid cybersecurity author who dives deep into technical and engineering issues in the cyber world. The author of books and articles about technology and security, Oliviah Nelson is a well respected authority.