{"object":"knowledge_changelog","schema_version":"1","baseline_date":"2026-08-25","as_of":"2026-10-23","count":300,"release":"registry.fly.io/isms-api-prod:deployment-01M5PM6DQBZ74X1QPCMQP85K9A","events":[{"id":"0518afe88a2ac7d48d21e615","type":"verification_refreshed","date":"2026-08-25","framework_ids":["ISO_27001"],"note":"Edition check against the ISO catalogue: ISO/IEC 27001:2022 Edition 3 remains the current published edition (stage 60.60); Amd 1:2024 climate changes noted.","batch_key":"2026-08-25-pr4-refresh","from":{"ISO_27001":"2026-03-13"},"to":{"ISO_27001":"2026-08-25"},"evidence_url":"https://www.iso.org/standard/27001","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"159df3b0b7ea552eabe80409","type":"verification_refreshed","date":"2026-08-25","framework_ids":["ISO_22301"],"note":"ISO catalogue confirms ISO 22301:2019 Edition 2 is current (stage 90.92, to be revised; Edition 3 at committee draft 30.60); Amd 1:2024 noted.","batch_key":"2026-08-25-pr4-refresh","from":{"ISO_22301":"2026-03-13"},"to":{"ISO_22301":"2026-08-25"},"evidence_url":"https://www.iso.org/standard/75106.html","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"474ee65f366d513a69f5102d","type":"version_changed","date":"2026-08-25","framework_ids":["NZ_PRIVACY_ACT_2020"],"note":"Version string clarified to reflect staggered commencement per codex verification against s2 of the Act.","from":{"NZ_PRIVACY_ACT_2020":"Public Act 2020 No 31 (in force 1 December 2020; IPP 3A in force 1 May 2026)"},"to":{"NZ_PRIVACY_ACT_2020":"Public Act 2020 No 31 (principal provisions in force 1 December 2020, ss 32-38 and 213-215 from 1 July 2020; IPP 3A in force 1 May 2026)"},"evidence_url":"https://www.legislation.govt.nz/act/public/2020/0031/latest/LMS23223.html"},{"id":"67d8fea2209a220bec3338d8","type":"content_corrected","date":"2026-08-25","framework_ids":["AU_ISM","AU_CPS_234","NZ_PRIVACY_ACT_2020","NZ_NZISM"],"note":"Codex adversarial legal-verification corrections: AU_ISM zero-padded ISM-#### IDs + quarterly cadence + PSPF wording + sort-id principle order; AU_CPS_234 14th heading (Definitions) + para 35(b) trigger + CPS 230 dates; NZ_PRIVACY_ACT_2020 administering agency (MoJ) + ss.115-116 + overseas scope + OPC IPP titles + no-copyright-in-enactments; NZ_NZISM GCISO publisher + 124 sections + MUST/SHOULD incident + waiver-vs-recorded-non-use + s4.5.15 + Official Information + section-title capitalisation.","evidence_url":"https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism"},{"id":"91f8de3571e023e09cb29d6b","type":"verification_refreshed","date":"2026-08-25","framework_ids":["HDS"],"note":"ANS confirms HDS referentiel v2.0 (April 2024) is the current certification reference; v2.1 planned for October 2026, not yet published.","batch_key":"2026-08-25-pr4-refresh","from":{"HDS":"2026-03-13"},"to":{"HDS":"2026-08-25"},"evidence_url":"https://esante.gouv.fr/services/hebergeurs-de-donnees-de-sante/les-referentiels-de-la-procedure-de-certification","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"a6ae520ffb460d031f3ce6ca","type":"framework_added","date":"2026-08-25","framework_ids":["NZ_NZISM"],"note":"Added the New Zealand Information Security Manual (NZISM) v3.9 (November 2025), GCSB/NCSC: 24-chapter section map. Completes New Zealand infosec coverage alongside NZ_PRIVACY_ACT_2020.","evidence_url":"https://nzism.gcsb.govt.nz/ism-document"},{"id":"b24cdc3325dd79e7333f770e","type":"framework_added","date":"2026-08-25","framework_ids":["AU_ISM","AU_CPS_234","NZ_PRIVACY_ACT_2020"],"note":"Australia/New Zealand pack: added the Australian Government Information Security Manual (ISM), APRA CPS 234 Information Security, and the New Zealand Privacy Act 2020 with its Information Privacy Principles.","evidence_url":"https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism"},{"id":"beac5be7b257a31bb2a8203f","type":"verification_refreshed","date":"2026-08-25","framework_ids":["TISAX"],"note":"ENX portal confirms ISA 6.0.3 is the current assessment basis (ISA 6 applies to assessments ordered before 2027-01-01; ISA2027 is published for 2027 assessments and does not supersede yet).","batch_key":"2026-08-25-pr4-refresh","from":{"TISAX":"2026-03-13"},"to":{"TISAX":"2026-08-25"},"evidence_url":"https://www.enx.com/en-US/TISAX/downloads/","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"bf1cf2292a3ce9a731968db7","type":"verification_refreshed","date":"2026-08-25","framework_ids":["ISO_27001","ISO_42001","ISO_27701","TISAX","HDS","ISO_9001","ISO_22301"],"note":"Baseline verification refresh: the seven modules still carrying 2026-03-13 dates re-checked against their official publishers; all seven CURRENT, stamped 2026-08-25. Per-module evidence in the individual events of this batch and in packages/framework-knowledge/verification-evidence/2026-08-25.json.","batch_key":"2026-08-25-pr4-refresh","from":{"ISO_27001":"2026-03-13","ISO_42001":"2026-03-13","ISO_27701":"2026-03-13","TISAX":"2026-03-13","HDS":"2026-03-13","ISO_9001":"2026-03-13","ISO_22301":"2026-03-13"},"to":{"ISO_27001":"2026-08-25","ISO_42001":"2026-08-25","ISO_27701":"2026-08-25","TISAX":"2026-08-25","HDS":"2026-08-25","ISO_9001":"2026-08-25","ISO_22301":"2026-08-25"},"evidence_url":"https://github.com/better-isms/isms-copilot/pull/2581","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"ca410069071866589a0075f4","type":"verification_refreshed","date":"2026-08-25","framework_ids":["ISO_9001"],"note":"ISO catalogue confirms ISO 9001:2015 Edition 5 remains the current certifiable edition (Edition 6 at stage 60.00 under publication, intended 2026-09, does not supersede yet); Amd 1:2024 noted.","batch_key":"2026-08-25-pr4-refresh","from":{"ISO_9001":"2026-03-13"},"to":{"ISO_9001":"2026-08-25"},"evidence_url":"https://www.iso.org/standard/62085.html","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"d1134c355737772d561ee104","type":"verification_refreshed","date":"2026-08-25","framework_ids":["ISO_42001"],"note":"Edition check against the ISO catalogue: ISO/IEC 42001:2023 Edition 1 remains current (stage 60.60), no amendments.","batch_key":"2026-08-25-pr4-refresh","from":{"ISO_42001":"2026-03-13"},"to":{"ISO_42001":"2026-08-25"},"evidence_url":"https://www.iso.org/standard/42001","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"d8c117cc14d6fbb2f75aebcb","type":"verification_refreshed","date":"2026-08-25","framework_ids":["ISO_27701"],"note":"Edition check against the ISO catalogue: ISO/IEC 27701:2025 Edition 2 is current (stage 60.60); the 2019 edition shows withdrawn.","batch_key":"2026-08-25-pr4-refresh","from":{"ISO_27701":"2026-03-13"},"to":{"ISO_27701":"2026-08-25"},"evidence_url":"https://www.iso.org/standard/27701","source_pr":2581,"registry_sha":"8faf4e2f"},{"id":"0d085a7184df1222d05c6dce","type":"content_corrected","date":"2026-08-26","framework_ids":["BSI_GRUNDSCHUTZ"],"note":"Added bare Baustein-ID detection triggers so a module cited by its ID alone (e.g. OPS.1.1.6) loads the IT-Grundschutz reference and grounds the ID-to-title mapping; knowledge content unchanged."},{"id":"ac63c88e2b091b0c2b7f3104","type":"framework_added","date":"2026-08-26","framework_ids":["ISO_SAE_21434","UN_R155","HITRUST","KR_ISMS_P","SG_MTCS"],"note":"Automotive and Asia pack: ISO/SAE 21434, UN R155, HITRUST CSF v11.8.0, K-ISMS/ISMS-P, and MTCS SS 584:2020. TISAX was already in the catalogue.","batch_key":"2026-08-26-automotive-asia","evidence_url":"https://github.com/better-isms/isms-copilot/pull/2616"},{"id":"b1bd392dbd22ba814fd51a8c","type":"verification_refreshed","date":"2026-08-26","framework_ids":["FR_SECNUMCLOUD"],"note":"Re-verified SecNumCloud v3.2 against the official ANSSI referentiel; confirmed it is now approved by ministerial order (arrete du 12 aout 2026, JORF du 14 aout 2026).","from":{"FR_SECNUMCLOUD":"2026-05-12"},"to":{"FR_SECNUMCLOUD":"2026-08-26"},"evidence_url":"https://www.legifrance.gouv.fr/loda/id/JORFTEXT000054678082"},{"id":"c9014f0e30054f6d4952e809","type":"content_corrected","date":"2026-08-26","framework_ids":["FR_SECNUMCLOUD"],"note":"Added 2026 regulatory-force provenance (arrete du 12 aout 2026, decret 2026-272 / art. 31 loi SREN) to the knowledge intro plus a decret-2026-272 detection pattern; the v3.2 referentiel requirement content is unchanged."},{"id":"2effa919158fa795c45e7e1e","type":"metadata_changed","date":"2026-08-31","framework_ids":["AU_ISM"],"note":"Display name now includes ASD ISM so the heyGRC picker substring search matches ASD ISM.","from":{"AU_ISM":"Australian Government Information Security Manual (ISM)"},"to":{"AU_ISM":"Australian Government Information Security Manual (ASD ISM)"},"source_pr":2684,"registry_sha":"fc1254a9"},{"id":"5679cfaf6ee3a9d71433fc46","type":"framework_added","date":"2026-08-31","framework_ids":["AU_NSW_CSP","AU_VIC_VPDSS"],"note":"Added NSW Cyber Security Policy 2026-2027 and Victorian Protective Data Security Standards v2.0 as public-law state packs.","batch_key":"2026-08-31-au-state-csp","evidence_url":"https://www.digital.nsw.gov.au/delivery/cyber-security-nsw/policies","source_pr":2684,"registry_sha":"fc1254a9"},{"id":"17ab64f9f70599813f5095ef","type":"framework_added","date":"2026-09-01","framework_ids":["AU_WA_CSP"],"note":"Added 2024 WA Government Cyber Security Policy as a public-law state pack. WA universities are in the official Scope list (unlike NSW CSP).","batch_key":"2026-09-01-au-wa-csp","evidence_url":"https://www.wa.gov.au/government/publications/2024-wa-government-cyber-security-policy"},{"id":"37ebdcff27706de5d7f33b92","type":"content_corrected","date":"2026-09-01","framework_ids":["AU_NSW_CSP","AU_VIC_VPDSS"],"note":"Codex catalog-release REQUEST_CHANGES: drop NSW Description-column one-liners (1.1-3.15) and VIC five-area coverage prose. Keep official IDs, category headings, and Standard titles only.","source_pr":2704},{"id":"78251f9d0ba83b39c99b6086","type":"framework_added","date":"2026-09-04","framework_ids":["CRA"],"note":"EU Cyber Resilience Act curated pack: full regulation at article/point level (Articles 1-71) with Annex I Parts I-II, Annex II, the Annex III/IV product classes and Annex VII, verified against EUR-Lex CELEX 32024R2847.","evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R2847"},{"id":"0a53b7edcf146623b8cb6cc3","type":"metadata_changed","date":"2026-09-05","framework_ids":["CRA"],"note":"Display name now includes EU Cyber Resilience Act so the heyGRC picker substring search matches Cyber Resilience Act and customers can distinguish the EU act from US Community Reinvestment Act / Canada Revenue Agency.","from":{"CRA":"CRA"},"to":{"CRA":"CRA (EU Cyber Resilience Act)"}},{"id":"37846e68305682be0315f673","type":"content_corrected","date":"2026-09-05","framework_ids":["CRA"],"note":"Tighten bare-CRA detector: drop generic cues (compliance, security, report, product, software, cyber, incident, firmware, IoT, support period) that collided with bank/tax/rating usage; require distinctive EU-CRA vocabulary (SBOM, digital elements, vulnerability reporting, ENISA, CE marking)."},{"id":"f04f8f2b8994044f31bd1742","type":"framework_added","date":"2026-09-06","framework_ids":["EASA_PART_IS","UK_CAA_CYBER_OVERSIGHT","DO_326A_ED_202A","NIST_IR_8401","NASA_STD_1006","CCSDS_SECURITY","ECSS_E_ST_80C"],"note":"Aerospace pack: EASA Part-IS (Regs (EU) 2023/203 and 2022/1645), UK CAA cyber oversight (CAP 1753 / CAF for Aviation CAP 1850), airworthiness security DO-326A / ED-202A set with AMC 20-42, NIST IR 8401 satellite ground segment profile (with IR 8270 / IR 8441 / SPD-5), NASA-STD-1006A, the CCSDS SEA-SEC security books, and ECSS-E-ST-80C security in space systems lifecycles. IDs, titles and document structure only.","batch_key":"2026-09-06-aerospace","source_pr":2852,"registry_sha":"1697dea197e530a83b1cd53505f631b38d3c8317"},{"id":"515bf6e103dcdda5fe4a3a94","type":"framework_added","date":"2026-09-08","framework_ids":["IEC_62443","NIST_800_82","ISO_27019"],"note":"Physical-economy pack: IEC 62443 family module (parts 2-1:2024 asset-owner security program with SPE 1-8 and 87 leaf requirements, 3-2:2020 zones-and-conduits risk assessment with ZCR 1-7 and 32 leaves, 3-3:2013 system security requirements with FR 1-7 and 51 SRs, 4-1:2018 secure development lifecycle with 47 practice requirements), NIST SP 800-82 Rev. 3 OT security guide (sections, defense-in-depth layers, CSF walk-through, Appendix F.7 overlay control families), and ISO/IEC 27019:2024 second edition energy-utility controls (all 105 controls incl. the 12 ENR additions). Part-qualified IDs, titles and document structure only; requirement bodies, REs and SL matrices not restated.","batch_key":"2026-09-08-physical-economy","source_pr":2901,"registry_sha":"472f6524a1512da31142311fd383c29e2edb3f74"},{"id":"9f68b26da56b2ae7cf541322","type":"verification_refreshed","date":"2026-09-13","framework_ids":["IE_DPA_2018","CYBER_ESSENTIALS","NCSC_CAF","ISO_27002","ISO_27018","CH_FADP"],"note":"Catalogue re-verification of the 17-19 Sep quarterly cohort: IE DPA 2018 Revised Acts current to 16 July 2026, Cyber Essentials v3.3/Danzell still current, CAF v4.0 still latest, ISO 27002:2022 and 27018:2025 still published 60.60, FADP SR 235.1 last amended 7 July 2025. Ireland NIS 2 still untransposed (CJEU referral 2026-07-08).","batch_key":"2026-09-13-quarterly-cohort","from":{"IE_DPA_2018":"2026-05-10","CYBER_ESSENTIALS":"2026-05-12","NCSC_CAF":"2026-05-12","ISO_27002":"2026-05-12","ISO_27018":"2026-05-12","CH_FADP":"2026-05-12"},"to":{"IE_DPA_2018":"2026-09-13","CYBER_ESSENTIALS":"2026-09-13","NCSC_CAF":"2026-09-13","ISO_27002":"2026-09-13","ISO_27018":"2026-09-13","CH_FADP":"2026-09-13"},"evidence_url":"https://revisedacts.lawreform.ie/eli/2018/act/7/revised/en/html","source_pr":2933,"registry_sha":"ef0cb632f96ed34ed1d5660e3c8eb6bfa092dd9d"},{"id":"f89cb41455ec1dd9f1b4376f","type":"verification_refreshed","date":"2026-09-13","framework_ids":["ENS"],"note":"Re-verified RD 311/2022 (mod. RD 1125/2024) against BOE consolidada; last update 2024-11-06, still current. Spain NIS 2 remains untransposed (CJEU referral 2026-07-08).","from":{"ENS":"2026-05-05"},"to":{"ENS":"2026-09-13"},"evidence_url":"https://www.boe.es/buscar/act.php?id=BOE-A-2022-7191","source_pr":2932,"registry_sha":"bb71f9900c92153a6d05d94e42f2c46be58807bc"},{"id":"c5a34350f21b40fb87d9e62d","type":"verification_refreshed","date":"2026-09-23","framework_ids":["UK_DPA_2018","UK_NIS_2018"],"note":"Quarterly cohort overdue from the 18 Sep sitting (crossed the 130d threshold 2026-09-23 and blocked PR CI). legislation.gov.uk revised texts current with all in-force changes as of 2026-09-23: UK DPA 2018 still 2018 c.12 amended by DUA 2025 (outstanding S.I. 2026/386 substitutions not yet in force); NIS Regs 2018 still SI 2018/506, last amendment in force 25 May 2024 (outstanding S.I. 2026/386 Sch.3 para 24 + S.I. 2026/230 reg 7(2)). Version statements unchanged.","batch_key":"2026-09-23-uk-quarterly-cohort","from":{"UK_DPA_2018":"2026-05-15","UK_NIS_2018":"2026-05-15"},"to":{"UK_DPA_2018":"2026-09-23","UK_NIS_2018":"2026-09-23"},"evidence_url":"https://www.legislation.gov.uk/ukpga/2018/12/contents"},{"id":"04e5558850d99f01e0cbedb3","type":"version_changed","date":"2026-09-24","framework_ids":["BSI_C5"],"note":"Version now names only the verified edition, C5:2020 (January 2020); C5:2026 edition facts (v1.0.1, 168 criteria / 17 areas, new area IDs IAM and GC, key date 1 June 2027) described in the knowledge text as a newer edition not reflected in the rows; lastVerified unchanged (carry-forward).","batch_key":"2026-09-24-km-suspect-sweep","from":{"BSI_C5":"C5:2020 (operational); C5:2026 (current revision, transition phase)"},"to":{"BSI_C5":"C5:2020 (January 2020)"},"source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"0847ebcad0d17d9dd7ddd895","type":"content_corrected","date":"2026-09-24","framework_ids":["FEDRAMP"],"note":"FedRAMP rebuilt on the Consolidated Rules for 2026: FedRAMP Certification terminology, Classes A to D, Program and Agency paths, key dates (end of new Rev5 applications 2027-06-11, VDR/VER 2026-12-07), 10 KSI themes and 46 indicators, Rev5 baseline counts from the legacy workbook, M-24-15 scope, statutory repeal date 2027-12-23; stale JAB, KSI-pilot and tailoring claims removed.","batch_key":"2026-09-24-km-us-part2-1109","evidence_url":"https://www.fedramp.gov/2026/","source_pr":3145,"registry_sha":"30ef3ee1a715850a0fe423cfec39d3f327a389bd"},{"id":"09a9f7b6d5b2f9bf63224c54","type":"content_corrected","date":"2026-09-24","framework_ids":["NEN_7510"],"note":"NEN 7510 legal anchors updated: Begz Art. 7 applicability of the 2024 generation from 1 June 2026 (Stcrt 2026, 17743) and the Cyberbeveiligingsregeling voor de zorg (Stcrt 2026, 28763); paywall wording replaced (EUR 0,00 on nen.nl, copyright applies).","evidence_url":"https://zoek.officielebekendmakingen.nl/stcrt-2026-17743.html","source_pr":3125,"registry_sha":"a7f8ac88eade451f14178c6e3748d296d334f9d9"},{"id":"0c1ab4afae13e9b96e73f44b","type":"content_corrected","date":"2026-09-24","framework_ids":["NIST_CSF","NIST_800_53","NIST_AI_RMF"],"note":"SP 800-53: SA-24 retitled Design For Cyber Resiliency (was Application Programming Interfaces), titles re-cased to the OSCAL Release 5.2.0 catalog, PT heading spelled out, release notes rebased on 5.2.0 (baselines, 800-53A/B). CSF 2.0: Profiles and Tiers cited to CSWP 29 Sec. 3.1/3.2, profile types corrected, Tier use optional, 1.1 to 2.0 transition re-anchored to CPRT withdrawal records. AI RMF: MAP 1.1, MAP 2.2 and MEASURE 2.6 restored to full official text, sentence punctuation restored in nine rows, edition status, versioning and AI 600-1 scope limit added.","batch_key":"2026-09-24-km-us-nist-1109-csf53ai","evidence_url":"https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final","source_pr":3140,"registry_sha":"1e0b95a58732e59c3589d697c62ed991757a9f5a"},{"id":"0cf275d57965a38d90c5d38f","type":"metadata_changed","date":"2026-09-24","framework_ids":["SOC_2"],"note":"SOC 2 copyrightHolder set to the holder named in the AICPA document footer (Association of International Certified Professional Accountants, AICPA & CIMA).","evidence_url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","source_pr":3141,"registry_sha":"30938a8f0cd5cc652ee44d2d140045040b339ad1"},{"id":"1a27763d7585642c9d4713a6","type":"metadata_changed","date":"2026-09-24","framework_ids":["CH_ICT_MIN_STD"],"note":"ipStatus public-law to copyrighted (copyright holder FONES): the standard is published under CC BY 4.0 (licence page, PDF p. 43). Knowledge rebuilt under the copyrighted-standard rule: attribution, licence link and modification notice added; tables reduced to table-of-contents IDs and titles; paraphrased tier characterisations and unverified legal-anchor claims removed; StromVV Art. 5a and ISG Art. 74e facts re-sourced from Fedlex.","batch_key":"2026-09-24-km-ch-finma-18-03","evidence_url":"https://www.bacs.admin.ch/dam/en/sd-web/dJRSfIeFXoTP/ikt-minimalstandard-2023-en.pdf","source_pr":3130,"registry_sha":"53072895bd6da95b6366d7101bbb2af708162659"},{"id":"20ace090fe369c955b952def","type":"verification_refreshed","date":"2026-09-24","framework_ids":["KR_ISMS_P"],"note":"Criteria counts (16/64/21, reduced sets 62/65), mandatory scope, lifecycle and 2026 reform status re-verified on law.go.kr and pipc.go.kr.","batch_key":"2026-09-24-km-suspect-sweep","from":{"KR_ISMS_P":"2026-08-28"},"to":{"KR_ISMS_P":"2026-09-24"},"evidence_url":"https://www.law.go.kr/admRulLsInfoP.do?admRulSeq=2100000244750","source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"22e2822d3106c97b69f9bbcb","type":"verification_refreshed","date":"2026-09-24","framework_ids":["UAVG","BIO_2","NEN_7510"],"note":"Netherlands 10-10 cohort re-verified 2026-09-24 against primary sources (wetten.overheid.nl, Staatsblad, Staatscourant, NEN catalogue); evidence in verification-evidence/2026-09-24.json.","from":{"UAVG":"2026-06-01","BIO_2":"2026-06-01","NEN_7510":"2026-06-01"},"to":{"UAVG":"2026-09-24","BIO_2":"2026-09-24","NEN_7510":"2026-09-24"},"evidence_url":"https://wetten.overheid.nl/BWBR0040940/2026-09-01","source_pr":3125,"registry_sha":"a7f8ac88eade451f14178c6e3748d296d334f9d9"},{"id":"30f4c6c9494ebab851b44f93","type":"verification_refreshed","date":"2026-09-24","framework_ids":["EU_AI_ACT"],"note":"Amendment chain re-verified via the Publications Office: Regulation (EU) 2026/1744 is the only amending act of Regulation (EU) 2024/1689; corrigenda R(01)-R(04) concern non-English language versions only; no corrigendum of 2026/1744. Every amended provision checked against the amending act and the official consolidated text 02024R1689-20260727.","batch_key":"2026-09-24-km-eu-ai-act-omnibus","from":{"EU_AI_ACT":"2026-07-09"},"to":{"EU_AI_ACT":"2026-09-24"},"evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727","source_pr":3133,"registry_sha":"1ecfb8cacd511519ac9c0dcaebbf2384f03b754e"},{"id":"417905f988df09aea40328c4","type":"content_corrected","date":"2026-09-24","framework_ids":["CYFUN"],"note":"CyFun IP posture and provenance: source acknowledgement (CCB, NIST CSF 2.0 CSWP 29) added, cue not to reproduce CyFun requirement statements or guidance, and the Royal Decree sentence corrected (neither the Royal Decree nor the NIS 2 law names CyFun; RD Art. 5 designates the CCB reference framework under RD Art. 4 and NBN EN ISO/IEC 27001).","source_pr":3131,"evidence_url":"https://www.ejustice.just.fgov.be/eli/arrete/2024/06/09/2024005260/justel"},{"id":"425e3f8d3748207704db08cb","type":"version_changed","date":"2026-09-24","framework_ids":["FEDRAMP"],"note":"FedRAMP version string now names the Consolidated Rules for 2026 and the 2027-06-11 cutoff for new Rev5 applications.","batch_key":"2026-09-24-km-us-part2-1109","from":{"FEDRAMP":"Rev. 5 baselines (2023, new authorizations until 2027-06-11) + 20x Phase 3 (CR26, 2026)"},"to":{"FEDRAMP":"Consolidated Rules for 2026 (CR26): 20x Classes A-C + Rev5 baselines (new Rev5 applications until 2027-06-11)"},"evidence_url":"https://www.fedramp.gov/2026/timeline/","source_pr":3145,"registry_sha":"30ef3ee1a715850a0fe423cfec39d3f327a389bd"},{"id":"49bd781a0c043b40299bd94f","type":"verification_refreshed","date":"2026-09-24","framework_ids":["NIST_800_218","NIST_PRIVACY_FRAMEWORK","NIST_800_207"],"note":"Full content re-verification on 2026-09-24: SSDF 1.1 (61 practices and tasks) against SP 800-218 Table 1 and the NIST CPRT dataset, SP 800-218 Rev. 1 still an Initial Public Draft; Privacy Framework 1.0 (5 Functions, 18 Categories, 100 Subcategories) against Appendix A and the NIST CPRT dataset, PF 1.1 still an Initial Public Draft; SP 800-207 (August 2020, no revision) against the PDF, with CISA ZTMM v2.0, OMB M-22-09, OMB M-26-05 and EO 14306 read directly.","batch_key":"2026-09-24-km-us-nist-1109-218-pf-207","from":{"NIST_800_218":"2026-07-01","NIST_PRIVACY_FRAMEWORK":"2026-07-01","NIST_800_207":"2026-07-01"},"to":{"NIST_800_218":"2026-09-24","NIST_PRIVACY_FRAMEWORK":"2026-09-24","NIST_800_207":"2026-09-24"},"evidence_url":"https://csrc.nist.gov/pubs/sp/800/218/final","source_pr":3143,"registry_sha":"ad408efb2947780ed669482062d1f79721a880f2"},{"id":"55697b0ae116c1787557a8cc","type":"version_changed","date":"2026-09-24","framework_ids":["NIS_2_IE"],"note":"Ireland National Cyber Security Bill still not published or initiated (Oireachtas bills 2024-2026); Autumn 2026 Government Legislation Programme lists it for priority publication; Commission referred Ireland to the CJEU on 8 July 2026 (IP/26/1499).","batch_key":"2026-09-24-km-suspect-sweep","from":{"NIS_2_IE":"General Scheme 2024-08-30 (Bill not yet enacted as of 2026-05-10)"},"to":{"NIS_2_IE":"General Scheme 2024-08-30 (Bill not yet published or enacted as of 2026-09-24)"},"source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"5e3145f3e97c406ec97a39c1","type":"version_changed","date":"2026-09-24","framework_ids":["NIS_2_FR"],"note":"France NIS 2 bill still not promulgated: Assemblée nationale dossier lists the public sitting for 7 October 2026 (July 2026 slot not held); Commission referred France to the CJEU on 8 July 2026 (IP/26/1499).","batch_key":"2026-09-24-km-suspect-sweep","from":{"NIS_2_FR":"Sénat T.A. n° 78 (12 mars 2025) — texte AN n° 1112 — bill not yet promulgated as of 2026-05-11"},"to":{"NIS_2_FR":"Sénat T.A. n° 78 (12 mars 2025), texte AN n° 1112, texte de la commission n° 1779-A0; bill not yet promulgated as of 2026-09-24"},"source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"60bb93005f7dc24911869e79","type":"framework_added","date":"2026-09-24","framework_ids":["NEN_7512"],"note":"Added NEN_7512 as a pointer module (K2b): NEN 7512:2022 catalogue metadata and the Begz public-law anchors (applicable under the Begz from 1 March 2024, Stcrt 2023, 9608); no norm text.","evidence_url":"https://www.nen.nl/nen-7512-2022-nl-297137","source_pr":3125,"registry_sha":"a7f8ac88eade451f14178c6e3748d296d334f9d9"},{"id":"6a8553279e7d11732b57e91a","type":"verification_refreshed","date":"2026-09-24","framework_ids":["NIST_CSF","NIST_800_53","NIST_AI_RMF"],"note":"Full content verification on 2026-09-24: CSF 2.0 (CSWP 29) all 106 Subcategories against the CPRT CSF_2_0_0 dataset and the PDF; SP 800-53 all 300 active base controls against the OSCAL Release 5.2.0 catalog and CPRT SP_800_53_5_2_0 (5.2.0 is the current release); AI RMF 1.0 all 72 Subcategories against the NIST AI 100-1 PDF (1.0 current, revision announced, no draft).","batch_key":"2026-09-24-km-us-nist-1109-csf53ai","from":{"NIST_CSF":"2026-07-01","NIST_800_53":"2026-07-01","NIST_AI_RMF":"2026-07-01"},"to":{"NIST_CSF":"2026-09-24","NIST_800_53":"2026-09-24","NIST_AI_RMF":"2026-09-24"},"evidence_url":"https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final","source_pr":3140,"registry_sha":"1e0b95a58732e59c3589d697c62ed991757a9f5a"},{"id":"6e51e996c58d8917363f38f6","type":"content_corrected","date":"2026-09-24","framework_ids":["CMMC"],"note":"CMMC re-verified against 32 CFR 170 and DFARS: DoW suspension of Phase 2 on 2026-07-13 (Level 1 and Level 2 Self only) and class deviation 2026-O0025 Rev 3 added; POA&M paragraph citations, DFARS 204.7504 cutoff dates, scoping, ESP definition, retention, DIBCAC override and appeals corrected or added; unsupported lead-time claims removed.","batch_key":"2026-09-24-km-us-part2-1109","evidence_url":"https://dowcio.war.gov/CMMC/","source_pr":3145,"registry_sha":"30ef3ee1a715850a0fe423cfec39d3f327a389bd"},{"id":"6f75b25b10001311efcd5166","type":"version_changed","date":"2026-09-24","framework_ids":["KR_ISMS_P"],"note":"Re-based on primary sources: current ISMS-P criteria notice (PIPC 2024-8 / MSIT 2024-30, 2024-07-24), Network Act Art. 47 and decree Art. 49, PIPA Act No. 21445 (mandatory privacy certification from 2027-07-01); reform plan and draft decree labelled as not in force.","batch_key":"2026-09-24-km-suspect-sweep","from":{"KR_ISMS_P":"ISMS-P (2018 integration; 2026 reform pending)"},"to":{"KR_ISMS_P":"ISMS-P certification criteria notice (PIPC Notice 2024-8 / MSIT Notice 2024-30, in force 2024-07-24); PIPA mandatory privacy certification enacted for 2027-07-01 (Act No. 21445); 2026 reform plan pending"},"source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"7ba9291fb12535fcd9a36c09","type":"content_corrected","date":"2026-09-24","framework_ids":["NIST_800_171","NIST_800_171_R3","NIST_800_66_R2"],"note":"800-171 Rev. 2 rows now carry the verbatim NIST requirement statements and correct Basic/Derived ranges (lastVerified kept: withdrawn prior edition retained for CMMC); Rev. 3 change facts corrected (03.05.07 not new, 19 new requirements, no ODP on 03.05.03, discussion sections); 800-66 Rev. 2 mapping, breach-notice and unsourced OCR claims corrected; applicability, assessment-companion and 164.306 general rules added; 800-171 modules migrated to per-file.","batch_key":"us-nist-1109-171-66","source_pr":3139,"registry_sha":"0bc8097bb1c4cb44b358b3d7308ea3857ae7b08d"},{"id":"819060347c24454340318335","type":"content_corrected","date":"2026-09-24","framework_ids":["NIS_2"],"note":"NIS 2 parent module gains status notes: no amending act in force (English corrigendum of 22.12.2023 to Art. 19(1) noted); COM(2026) 13 (2026/0012(COD)) and the Digital Omnibus COM(2025) 837 described as pending proposals at committee stage; 8 July 2026 Court of Justice referrals of Ireland, Spain, France and the Netherlands (IP/26/1499). Article rows unchanged; lastVerified unchanged.","batch_key":"2026-09-24-km-jp-appi-nis2-parent","evidence_url":"https://ec.europa.eu/commission/presscorner/detail/en/ip_26_1499","source_pr":3132,"registry_sha":"27d8d2ea88b638a1b3e38e58ab9310ee3162ea72"},{"id":"84fdc1c3b3e10de919213388","type":"verification_refreshed","date":"2026-09-24","framework_ids":["NIST_800_171_R3"],"note":"NIST SP 800-171 Rev. 3 (97 active requirements) re-verified row by row against NIST CPRT SP_800_171_3_0_0 and the PDF; current NIST revision.","batch_key":"us-nist-1109-171-66","from":{"NIST_800_171_R3":"2026-07-01"},"to":{"NIST_800_171_R3":"2026-09-24"},"evidence_url":"https://csrc.nist.gov/pubs/sp/800/171/r3/final","source_pr":3139,"registry_sha":"0bc8097bb1c4cb44b358b3d7308ea3857ae7b08d"},{"id":"85a455a240a2f9a0b0fc2073","type":"verification_refreshed","date":"2026-09-24","framework_ids":["NIS_2_FR"],"note":"Status re-verified against the Assemblée nationale and Sénat dossiers and Commission press release IP/26/1499; Légifrance unreachable by automated routes (bot challenge).","batch_key":"2026-09-24-km-suspect-sweep","from":{"NIS_2_FR":"2026-05-11"},"to":{"NIS_2_FR":"2026-09-24"},"evidence_url":"https://www.assemblee-nationale.fr/dyn/17/dossiers/DLR5L17N50731","source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"8bca68ff96d4b8015fca51a5","type":"framework_added","date":"2026-09-24","framework_ids":["FINMA_18_03"],"note":"FINMA Circular 2018/3 Outsourcing (dated 2017-09-21, in force 2018-04-01, last amended 2020-11-04, in force 2021-01-01): all 50 margin numbers verified against the current official PDF (DE/EN/FR), with scope, captive carve-out, small-bank and BA Art. 1b relief, and the two-step amendment history from the circular own list of modifications. Salvage of #2944 with its three refuted claims corrected.","batch_key":"2026-09-24-km-ch-finma-18-03","evidence_url":"https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2018-03-01012021_de.pdf?sc_lang=en","source_pr":3130,"registry_sha":"53072895bd6da95b6366d7101bbb2af708162659"},{"id":"8e07c717016c72360e182c10","type":"framework_added","date":"2026-09-24","framework_ids":["IT_GARANTE_COOKIE"],"note":"Italian Garante cookie guidelines module (provvedimento n. 231 del 10 giugno 2021, GU n. 163 del 9 luglio 2021): section structure plus summaries re-verified against the official text; states that the 2014 cookie provvedimento n. 229 is supplemented, not abrogated, and that the guidelines applied after a 6-month adaptation period (operational from 9 January 2022 per the Garante).","batch_key":"2026-09-24-km-it-garante-cookie","evidence_url":"https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9677876","source_pr":3126,"registry_sha":"d4e3c255714b076b07506baa52d006c2e9b83b0e"},{"id":"8fef759d2473d2264ce8b0a0","type":"version_changed","date":"2026-09-24","framework_ids":["EU_AI_ACT"],"note":"EU AI Act knowledge rebased on Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ L 24.7.2026, in force 27 July 2026): high-risk Chapter III Sections 1-3 now apply from 2 December 2027 (Annex III) and 2 August 2028 (Art. 6(1)/Annex I), new Art. 5 bans from 2 December 2026, Art. 50(2) grace to 2 December 2026 for generative systems on the market before 2 August 2026 (Art. 111(4)), plus all other amended provisions (Art. 4 AI literacy, new Art. 4a replacing Art. 10(5), Art. 6(1a)-(1c), 43(3), 57(1), 72(3), 75-75d, 99).","batch_key":"2026-09-24-km-eu-ai-act-omnibus","from":{"EU_AI_ACT":"2024/1689"},"to":{"EU_AI_ACT":"2024/1689 as amended by 2026/1744"},"evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1744","source_pr":3133,"registry_sha":"1ecfb8cacd511519ac9c0dcaebbf2384f03b754e"},{"id":"927b9f3e298e80324198ad11","type":"content_corrected","date":"2026-09-24","framework_ids":["PCI_DSS"],"note":"PCI DSS reduced to the six goals and twelve principal requirement IDs with official titles verbatim from the public PCI SSC page; reworded sub-requirement descriptions removed (K2b, no licence-gated source); edition facts added.","evidence_url":"https://www.pcisecuritystandards.org/merchants/process/","source_pr":3142,"registry_sha":"09a3cea61734c078326bf08046ec69ec9c3a3262"},{"id":"9622b6a0f96fd86df3ce1cab","type":"verification_refreshed","date":"2026-09-24","framework_ids":["CH_ICT_MIN_STD","CH_NCS"],"note":"Full content re-verification on 2026-09-24 against official sources: ICT Minimum Standard May 2023 still the NCSC general standard (CSRM still in testing), every retained row checked against the PDF table of contents; NCS of 5/13 April 2023 still current, every claim line-audited against the EN/DE/FR/IT strategy PDFs and the NCSC pages, second implementation report of May 2026 does not change M1-M17.","batch_key":"2026-09-24-km-ch-finma-18-03","from":{"CH_ICT_MIN_STD":"2026-07-17","CH_NCS":"2026-06-15"},"to":{"CH_ICT_MIN_STD":"2026-09-24","CH_NCS":"2026-09-24"},"evidence_url":"https://www.bacs.admin.ch/en/national-cyberstrategy-ncs","source_pr":3130,"registry_sha":"53072895bd6da95b6366d7101bbb2af708162659"},{"id":"9992ba26316976557b3a754b","type":"content_corrected","date":"2026-09-24","framework_ids":["CYFUN"],"note":"Important = 71 now cites where PR.PS-02 and PR.PS-03 are placed at Important: IMPORTANT booklet printed page 82 (PR.PS section) and the IMPORTANT v2026_02_20 and ESSENTIAL v3.1 self-assessment tools (sheet PROTECT, level column); the contents page lists 69.","source_pr":3131,"evidence_url":"https://cyfun.eu/sites/default/files/2026-03/CyFun2025_Booklet_IMPORTANT_E.pdf"},{"id":"9bf16edca33f0391a9e64d06","type":"content_corrected","date":"2026-09-24","framework_ids":["FINMA_23_01","CH_NCS"],"note":"FINMA 23/1: margin no. 20 exemption applies to banks and securities firms in categories 4 and 5. NCS: retired ncsc.admin.ch links re-pointed to bacs.admin.ch; goal 2 and 3 headings aligned to the strategy; second implementation report (May 2026) added; coordination claims re-anchored to measure M6; unsupported per-measure target-group and NCS III claims removed; IP basis recorded.","batch_key":"2026-09-24-km-ch-finma-18-03","source_pr":3130,"registry_sha":"53072895bd6da95b6366d7101bbb2af708162659"},{"id":"a697a13e42497174fb9936ac","type":"verification_refreshed","date":"2026-09-24","framework_ids":["PCI_DSS"],"note":"PCI DSS v4.0.1 confirmed as the only active version (Document Library, PCI SSC blog; RFC on v4.0.1 June-July 2026, no successor published); all rows verified verbatim against the official PCI SSC requirements page.","from":{"PCI_DSS":"2026-07-01"},"to":{"PCI_DSS":"2026-09-24"},"evidence_url":"https://www.pcisecuritystandards.org/document_library/","source_pr":3142,"registry_sha":"09a3cea61734c078326bf08046ec69ec9c3a3262"},{"id":"a94a09ede54e63a7a5a35835","type":"content_corrected","date":"2026-09-24","framework_ids":["CIS_CONTROLS_V8"],"note":"CIS Controls v8.1 rows checked against the official CIS Controls Navigator: titles of 3.11 and 13.8 corrected, CIS attribution line and link added, Implementation Group descriptions removed (counts kept), cue not to reproduce Safeguard descriptions added.","source_pr":3131,"evidence_url":"https://www.cisecurity.org/controls/cis-controls-navigator"},{"id":"bd7eeec75b0d30c5db648122","type":"content_corrected","date":"2026-09-24","framework_ids":["SOC_2"],"note":"SOC 2 table brought to the K2b IP posture: criterion IDs with the official AICPA series headings (P1.0 to P8.0 for Privacy) instead of paraphrased criterion labels, common criteria mapped to all five categories, IDs and counts primary-verified against the AICPA 2017 TSC March 2020 text; lastVerified carried forward because the 2022 release is login-gated.","evidence_url":"https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022","source_pr":3141,"registry_sha":"30938a8f0cd5cc652ee44d2d140045040b339ad1"},{"id":"c287da0054f05158d30de569","type":"verification_refreshed","date":"2026-09-24","framework_ids":["CIS_CONTROLS_V8"],"note":"CIS Controls v8.1 confirmed current on cisecurity.org; all 153 Safeguard IDs and titles and the IG counts re-verified against the CIS Controls Navigator v8.1, the 18 Control titles against the public Controls list.","from":{"CIS_CONTROLS_V8":"2026-06-01"},"to":{"CIS_CONTROLS_V8":"2026-09-24"},"source_pr":3131,"evidence_url":"https://www.cisecurity.org/controls/cis-controls-navigator"},{"id":"c3d552101047b9c5e3583132","type":"content_corrected","date":"2026-09-24","framework_ids":["CYFUN"],"note":"CyFun 2025 re-verified against the March 2026 booklets and official self-assessment tools: PR.PS-02 and PR.PS-03 moved to Important (Important = 71 subcategories), CyFun 2023/2025 coexistence to 18 April 2027 stated instead of 2023 superseded, 18 April 2027 Essential certification step added (Royal Decree 9 June 2024 Art. 22), unverified 30 percent change claim removed, source URLs updated.","source_pr":3131,"evidence_url":"https://cyfun.eu/en/cyberfundamentals-framework-2025"},{"id":"c961168b43db8dfe9f16735a","type":"verification_refreshed","date":"2026-09-24","framework_ids":["CYFUN"],"note":"CyFun 2025 Version 2025-10-01 confirmed as the current release on cyfun.eu and ccb.belgium.be; all 90 subcategory rows and their assurance levels re-verified against the current booklets and self-assessment tools.","from":{"CYFUN":"2026-06-15"},"to":{"CYFUN":"2026-09-24"},"source_pr":3131,"evidence_url":"https://cyfun.eu/en/cyberfundamentals-framework-2025"},{"id":"cd3c526ebdce01ee9d2bdcf9","type":"version_changed","date":"2026-09-24","framework_ids":["UAVG"],"note":"UAVG re-based on the consolidated text in force from 1 September 2026 after the Verzamelwet gegevensbescherming (Stb. 2026, 154; commenced by Stb. 2026, 196 except Art. I onderdeel I, new Art. 23a); amendment chain corrected against the official wijzigingenoverzicht.","from":{"UAVG":"Stb. 2018, 144 — consolidated tekst geldend van 01-07-2021 (Stb. 2021, 135)"},"to":{"UAVG":"Stb. 2018, 144, consolidated tekst geldend van 01-09-2026 (laatst gewijzigd bij Stb. 2026, 154, Verzamelwet gegevensbescherming)"},"evidence_url":"https://wetten.overheid.nl/BWBR0040940/2026-09-01","source_pr":3125,"registry_sha":"a7f8ac88eade451f14178c6e3748d296d334f9d9"},{"id":"d4d0b46f4634e3367a6ba9f2","type":"content_corrected","date":"2026-09-24","framework_ids":["NIST_800_218","NIST_PRIVACY_FRAMEWORK","NIST_800_207"],"note":"SSDF: PW.1.3 and PO.1.3 restored to full Table 1 text, PW.2.1 wording corrected, change-log note aligned to Appendix C, SSDF 1.2 (SP 800-218 Rev. 1) marked as Initial Public Draft only, M-26-05 and CISA form statements aligned to the primary texts; Privacy Framework: problem examples, Tiers, Table 3 footnote and PF 1.1 IPD summary aligned to the official texts, CSF functions stated as used alongside not inherited; SP 800-207: unsupported best-fit and mitigation claims replaced with the Section 3.1 and Section 5 text, Section 3.3.1 label, CISA ZTMM pillar functions per its Tables 2 to 6.","batch_key":"2026-09-24-km-us-nist-1109-218-pf-207","evidence_url":"https://csrc.nist.gov/pubs/sp/800/218/final","source_pr":3143,"registry_sha":"ad408efb2947780ed669482062d1f79721a880f2"},{"id":"d77d0e3158ada853207f81ad","type":"content_corrected","date":"2026-09-24","framework_ids":["JP_MY_NUMBER_ACT"],"note":"Knowledge text now records the current e-Gov consolidated status (as amended through Act No. 56 of 2026, in force 2026-07-17), the 2026 amendment stages and the current chapter structure; version and article rows stay on the verified 2013 English snapshot (carry-forward), lastVerified unchanged.","batch_key":"2026-09-24-km-suspect-sweep","source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"d987799a6e42828b1ed1a35b","type":"verification_refreshed","date":"2026-09-24","framework_ids":["CMMC"],"note":"CMMC fully re-verified against eCFR 32 CFR 170, DFARS 204.75/252.204-7021, the 2026-07-13 DoW memos and class deviation 2026-O0025 Rev 3.","batch_key":"2026-09-24-km-us-part2-1109","from":{"CMMC":"2026-07-01"},"to":{"CMMC":"2026-09-24"},"evidence_url":"https://www.ecfr.gov/current/title-32/part-170","source_pr":3145,"registry_sha":"30ef3ee1a715850a0fe423cfec39d3f327a389bd"},{"id":"df4768742271f27b0220f3be","type":"content_corrected","date":"2026-09-24","framework_ids":["ISO_9001"],"note":"ISO 9001 entry stays on the 2015 edition (name, version and lastVerified unchanged; clause rows unchanged) and now states the edition gap: ISO 9001:2026 (Edition 6, published 2026-09-16) is current and ISO 9001:2015 plus Amd 1:2024 are withdrawn (ISO catalogue); Global ACI-TECH-3-TR 2029-09-30 (M) transition milestones added; the 2026 clause structure is pending a permitted official source. Module extracted to its own file (migrate-when-touched).","batch_key":"2026-09-24-km-iso9001-2026-edition","source_pr":3123,"evidence_url":"https://www.iso.org/standard/9001"},{"id":"e564184ab760259b973c34e7","type":"content_corrected","date":"2026-09-24","framework_ids":["CRA"],"note":"CRA status after the Art. 14 reporting date: Art. 14 now in application and ENISA single reporting platform in initial operation since 11 September 2026; open-source steward reporting and Art. 64 penalties from 11 December 2027; EHDS Regulation (EU) 2025/327 Art. 104 amendments, Delegated Regulations (EU) 2025/1535 and 2026/881, Implementing Regulation (EU) 2025/2392 and the COM(2026) 590 proposal recorded; lastVerified unchanged (rows not all re-verified).","evidence_url":"http://data.europa.eu/eli/reg/2024/2847/oj","source_pr":3135,"registry_sha":"a736367c51f18913801f7765941861844357ab8e"},{"id":"e76cfbc867ebf16515dfd27e","type":"verification_refreshed","date":"2026-09-24","framework_ids":["JP_APPI"],"note":"Every APPI chapter, section and article row re-checked against the current Japanese consolidated text on e-Gov (law API v2, revision 415AC0000000057_20260717_508AC0000000062) and the scheduled revisions; amendment chain corroborated on the PPC 2026 amendment page.","batch_key":"2026-09-24-km-jp-appi-nis2-parent","from":{"JP_APPI":"2026-08-24"},"to":{"JP_APPI":"2026-09-24"},"evidence_url":"https://laws.e-gov.go.jp/law/415AC0000000057","source_pr":3132,"registry_sha":"27d8d2ea88b638a1b3e38e58ab9310ee3162ea72"},{"id":"e8a8671845b6e7487ca23869","type":"verification_refreshed","date":"2026-09-24","framework_ids":["NIS_2_IE"],"note":"Status re-verified against the Autumn 2026 Government Legislation Programme, the Oireachtas bills API, the gov.ie General Scheme page, NCSC Ireland and IP/26/1499.","batch_key":"2026-09-24-km-suspect-sweep","from":{"NIS_2_IE":"2026-05-10"},"to":{"NIS_2_IE":"2026-09-24"},"evidence_url":"https://assets.gov.ie/static/documents/5d6bc854/Government_Legislation_Programme_Autumn_2026.pdf","source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"ef11a9c6053f725f91173f7b","type":"metadata_changed","date":"2026-09-24","framework_ids":["BSI_C5"],"note":"Display name now identifies the edition the rows are verified against (BSI C5:2020), per the carry-forward rule; C5:2026 is described in the knowledge text only.","batch_key":"2026-09-24-km-suspect-sweep","source_pr":3128,"registry_sha":"fee768fb9a636859308a80c76c881c60a5677dbb"},{"id":"f4d0067984995de6d884a24a","type":"verification_refreshed","date":"2026-09-24","framework_ids":["NIST_800_66_R2"],"note":"NIST SP 800-66 Rev. 2 re-verified against the NIST PDF and 45 CFR Part 164 Subpart C (eCFR); HIPAA Security Rule NPRM (RIN 0945-AA22) still not final.","batch_key":"us-nist-1109-171-66","from":{"NIST_800_66_R2":"2026-07-01"},"to":{"NIST_800_66_R2":"2026-09-24"},"evidence_url":"https://csrc.nist.gov/pubs/sp/800/66/r2/final","source_pr":3139,"registry_sha":"0bc8097bb1c4cb44b358b3d7308ea3857ae7b08d"},{"id":"f727fe5af1482d4f9d8f808a","type":"version_changed","date":"2026-09-24","framework_ids":["JP_APPI"],"note":"APPI version statement rebased on the current e-Gov consolidated Japanese text (revision of 2026-07-17); Act No. 56 of 2026 (promulgated 2026-07-17) recorded as enacted but not yet in force: penal-provision changes from 2027-01-17, main provisions (administrative surcharge, under-16 rules, statistics consent exception, biometric data) on a Cabinet Order date within two years; English captions aligned in full to the Ministry of Justice translation.","batch_key":"2026-09-24-km-jp-appi-nis2-parent","from":{"JP_APPI":"Act No. 57 of 2003, as amended by Act No. 37 of 2021 (unified public/private-sector Act; Chapter V for administrative entities in force 2022-2023)"},"to":{"JP_APPI":"Act No. 57 of 2003, consolidated text in force on 2026-09-24 (e-Gov revision of 2026-07-17); Act No. 56 of 2026 promulgated 2026-07-17, main provisions not yet in force"},"evidence_url":"https://laws.e-gov.go.jp/law/415AC0000000057","source_pr":3132,"registry_sha":"27d8d2ea88b638a1b3e38e58ab9310ee3162ea72"},{"id":"fabb5cb02a1d226076530bb4","type":"content_corrected","date":"2026-09-24","framework_ids":["BIO_2"],"note":"BIO2 legal status updated: the Cyberbeveiligingswet entered into force on 15 August 2026 and the Cyberbeveiligingsregeling sector overheid (Stcrt 2026, 27679) and IenW (Stcrt 2026, 24093) reference BIO2 v1.3; BIO 1.04 history aligned to Stcrt 2026, 7416 n1.","evidence_url":"https://zoek.officielebekendmakingen.nl/stcrt-2026-27679.html","source_pr":3125,"registry_sha":"a7f8ac88eade451f14178c6e3748d296d334f9d9"},{"id":"003ed37d52dd1cfc3cc55ade","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NZ_PRIVACY_ACT_2020","NZ_NZISM"],"note":"Full content re-verification of every row and claim against the Privacy Act 2020 version as at 1 May 2026 (PCO) with the OPC principles page as second source, and against the NZISM v3.9 online manual (24 chapters, 124 sections) with the GCSB and NCSC NZISM pages as second source.","batch_key":"2026-09-25-km-backfill-b-nz","from":{"NZ_PRIVACY_ACT_2020":"2026-08-25","NZ_NZISM":"2026-08-25"},"to":{"NZ_PRIVACY_ACT_2020":"2026-09-25","NZ_NZISM":"2026-09-25"},"evidence_url":"https://www.legislation.govt.nz/act/public/2020/31/en/latest/","source_pr":3164,"registry_sha":"178f7a4b5a1d3ca0f2f46f3d04662d215fe2cca8"},{"id":"0155243706ce0090c2e46152","type":"content_corrected","date":"2026-09-25","framework_ids":["AU_NSW_CSP","AU_VIC_VPDSS","AU_WA_CSP"],"note":"Legacy evidence backfill content pass: NSW directive circular updated to DCS-2026-03 (DCS-2025-04 archived), section 9 heading and 24-hour incident clock added, scope bullets rewritten as summaries; VIC Part 4 exclusions gain s 84(2)(ca) under PDP Act authorised version 033 and unverified dates removed; WA timed duties, circular measures, Direction titles and ecosystem label added or corrected; licence statements recorded. lastVerified unchanged pending a clean final reviewer verdict.","batch_key":"2026-09-25-km-backfill-b-states","source_pr":3169,"registry_sha":"4ae525696a017ee3ad810e7680c370b7512dd76c"},{"id":"01e7af4916a8b2e0ba748d4e","type":"metadata_changed","date":"2026-09-25","framework_ids":["CA_OSFI_B13"],"note":"OSFI Guideline B-13 relabelled from public-law to copyrighted, holder His Majesty the King in Right of Canada as represented by OSFI (Crown copyright), under IP guidelines v1.3 section 4.4: the osfi-bsif.gc.ca terms allow non-commercial reproduction only and the guideline is not legislation; an attribution line is added and no permission was sought.","batch_key":"2026-09-25-ip-osfi-b13","from":{"CA_OSFI_B13":"public-law"},"to":{"CA_OSFI_B13":"copyrighted"},"source_pr":3224,"registry_sha":"a5cd3e968936dd52aa661a693de18225179e1f0d","evidence_url":"https://www.osfi-bsif.gc.ca/en/terms-conditions"},{"id":"05e47977fd74198d1f4d1f57","type":"version_changed","date":"2026-09-25","framework_ids":["UK_CAA_CYBER_OVERSIGHT"],"note":"Version label corrected: CAP 1850 is the second publication (August 2020) of the CAF for Aviation guidance, not a numbered Version 2; CAP 1753 Issue 3 unchanged.","from":{"UK_CAA_CYBER_OVERSIGHT":"CAP 1753 Issue 3 (April 2024) + CAP 1850 v2 (August 2020)"},"to":{"UK_CAA_CYBER_OVERSIGHT":"CAP 1753 Issue 3 (April 2024) + CAP 1850 second publication (August 2020)"},"evidence_url":"https://www.caa.co.uk/publication/download/17540","source_pr":3167,"registry_sha":"1c4e4a5d0f8086d548242953e355ee115dfa5ca1"},{"id":"0810d3fc6a345bed01b12721","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_HU"],"note":"Corrected against the promulgated texts (Magyar Kozlony 2024/130 and 2024/135): chapter map, annex titles, incident reporting in section 66 to the national incident-handling centre (NBSZ), authority designations in 418/2024 sections 16 and 65, fine caps in section 42, supervisory measures; unsupported NKI, CLXVI/2012 and CIII/2023 claims removed. lastVerified unchanged: the consolidated NJT text is person-only under its terms.","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://magyarkozlony.hu/"},{"id":"0b64a737b5274b07e4787363","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIST_IR_8401"],"note":"Legacy evidence backfill (K5): every row re-verified against the IR 8401 PDF, CSF 1.1, CSRC publication pages, the Federal Register (SPD-5, EO 14144, EO 14306), the IEEE SA record and the Legislative Observatory.","batch_key":"2026-09-25-km-backfill-c","from":{"NIST_IR_8401":"2026-09-06"},"to":{"NIST_IR_8401":"2026-09-25"},"source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://csrc.nist.gov/pubs/ir/8401/final"},{"id":"0d4c4a5b55c5d4103d8600fb","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_DE"],"note":"Every row re-verified against the consolidated BSIG XML on gesetze-im-internet.de (Stand with Art. 9 G v. 21.7.2026 and Art. 8 Abs. 1 G v. 23.7.2026) and the BGBl. publications 2025 I Nr. 301 and 2026 I Nr. 66, 221 and 226 on recht.bund.de.","batch_key":"2026-09-25-km-fix-nis2-de-pt","from":{"NIS_2_DE":"2026-07-15"},"to":{"NIS_2_DE":"2026-09-25"},"source_pr":3211,"registry_sha":"788352470a204ecb5894e4d6c6106a5f1059d5b1","evidence_url":"https://www.gesetze-im-internet.de/bsig_2025/BJNR12D0B0025.html"},{"id":"0fc637b5f450dbc1441617b9","type":"verification_refreshed","date":"2026-09-25","framework_ids":["JP_JIS_Q_27001"],"note":"JIS Q 27001:2025 and JIS Q 27002:2024 confirmed current on ISMS-AC (about page), the METI 2024-06-20 revision notice and the JIPDEC 27000 family overview of 2026-05-18; the METI JIS list of 2026-09-24 has no JIS Q 27001/27002 entry; ISO Open Data shows ISO/IEC 27001:2022, Amd 1:2024 and 27002:2022 at stage 60.60.","batch_key":"2026-09-25-km-fix-jp-jis-meti","from":{"JP_JIS_Q_27001":"2026-08-24"},"to":{"JP_JIS_Q_27001":"2026-09-25"},"source_pr":3214,"registry_sha":"a5c992a70e55204ab3f6c271acfd72d3b5647aea","evidence_url":"https://isms.jp/isms/about.html"},{"id":"0ff1320141be0a0386a8fca4","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_MT"],"note":"CIP Department is the coordinated vulnerability disclosure coordinator (art. 13 as substituted by LN 89/2026); art. 19(2) lists eleven measures incl. logging and traceability; Part map and deleted articles; Enforcement Committee fines and art. 41 appeals; S.L. 460.35 title corrected; lex specialis anchored to art. 3(16)-(17); unverified CIPD URL and parliament link removed.","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://legislation.mt/eli/sl/460.41/eng"},{"id":"114b3992943aa17dbee11488","type":"metadata_changed","date":"2026-09-25","framework_ids":["CCSDS_SECURITY"],"note":"Display name no longer credits the set to SEA-SEC alone (SLS-SEA-DLS and SEA-SA also own books in the 350-357 range).","source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://ccsds.org/publications/allpubs/"},{"id":"1609180806125124768fb64e","type":"content_corrected","date":"2026-09-25","framework_ids":["GDPR"],"note":"Art. 2(3) now read with Reg. (EU) 2018/1725 Art. 99 and Art. 2(4) with DSA Art. 89; rows for Arts 41(3), 41(5), 42(7), 43(3), 64(1) and 70(1) follow the 2018 corrigendum terms; Arts 30(1)(e), 30(2)(c), 40(3), 42(2), 49(1)(b), 49(1)(f), 79(2) and 83(4)-(6) aligned to the text; text-status note added (no amending act; Reg. (EU) 2025/2518 applies from 2 April 2027).","batch_key":"2026-09-25-km-fix-bdsg-gdpr","source_pr":3228,"registry_sha":"f1cd8653da2a7c61fcd170b19b5b3d739954226c","evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504"},{"id":"16a639b0f7728b85980a967d","type":"content_corrected","date":"2026-09-25","framework_ids":["AU_ISM","AU_CPS_234"],"note":"Legacy evidence backfill (K5): AU_ISM chapter map rebuilt from the September 2026 OSCAL catalog, licence line corrected to the ISM copyright page (Coat of Arms exception only), legal-status wording aligned to the ISM text; AU_CPS_234 re-verified against the Federal Register text F2018L01745, dead APRA URL replaced, application scope, clocks and CPS 230 boundary (1 July 2026 amended version) corrected, CC BY attribution added.","batch_key":"2026-09-25-km-backfill-b","source_pr":3168,"registry_sha":"fcc9b9335c72773b89b15774395021c62eb58ea6","evidence_url":"https://www.legislation.gov.au/F2018L01745/asmade/text"},{"id":"16b4b29d9b983e10f137b539","type":"verification_refreshed","date":"2026-09-25","framework_ids":["UK_FOIA_2000"],"note":"Full re-verification of all section, Part and Schedule headings against the legislation.gov.uk contents of the Freedom of Information Act 2000 (0 mismatches), plus Royal Assent and s. 87(3) commencement.","batch_key":"2026-09-25-km-uk-ico-commission-foia-eir","from":{"UK_FOIA_2000":"2026-07-23"},"to":{"UK_FOIA_2000":"2026-09-25"},"evidence_url":"https://www.legislation.gov.uk/ukpga/2000/36/contents","source_pr":3193,"registry_sha":"f656ddbcaabb4f33060e6977c922ce76cfee207d"},{"id":"1796721e49522639651114ed","type":"content_corrected","date":"2026-09-25","framework_ids":["NIST_IR_8401"],"note":"IR 8401 scope restated from section 1 (operational ground segment, MOC and PCC, space vehicle and user segment excluded, voluntary profile); PR.AC name per CSF 1.1 Table 1; informative references and superseded CCSDS 355.0-B-1 noted; IR 8323 Rev. 2 draft, EO 14144 civil space section, SPD-5 Sec. 5(c), IEEE 3536-2026 record (scope paraphrase removed) and EU Space Act procedure stage added.","source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://nvlpubs.nist.gov/nistpubs/ir/2022/NIST.IR.8401.pdf"},{"id":"19cea93ce07e2d745b666ab0","type":"version_changed","date":"2026-09-25","framework_ids":["AU_WA_CSP"],"note":"Version string drops the landing-page update date (the landing page moved to 8 September 2026); the verified edition is unchanged: the 2024 Policy PDF dated November 2024.","batch_key":"2026-09-25-km-backfill-b-states","from":{"AU_WA_CSP":"2024 (PDF dated November 2024; landing last updated 1 October 2025)"},"to":{"AU_WA_CSP":"2024 (PDF dated November 2024)"},"source_pr":3169,"registry_sha":"4ae525696a017ee3ad810e7680c370b7512dd76c"},{"id":"19d4c3a3625b90b8de071a8a","type":"verification_refreshed","date":"2026-09-25","framework_ids":["GDPR"],"note":"Re-verified against the EUR-Lex consolidated text 02016R0679-20160504 (with corrigendum OJ L 127, 23.5.2018); Cellar SPARQL shows no amending act; Reg. 2018/1725, DSA and Reg. 2025/2518 checked as second authoritative sources.","batch_key":"2026-09-25-km-fix-bdsg-gdpr","from":{"GDPR":"2026-07-22"},"to":{"GDPR":"2026-09-25"},"source_pr":3228,"registry_sha":"f1cd8653da2a7c61fcd170b19b5b3d739954226c","evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:02016R0679-20160504"},{"id":"1b5a9c39341e187510c0b4f6","type":"verification_refreshed","date":"2026-09-25","framework_ids":["IN_CERT_IN"],"note":"Directions No. 20(3)/2022-CERT-In and the 27 June 2022 extension re-read on cert-in.org.in (hub lists no later s. 70B(6) direction); s. 70B(7) checked against the Jan Vishwas Act 2023 Gazette and S.O. 4745(E).","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","from":{"IN_CERT_IN":"2026-07-15"},"to":{"IN_CERT_IN":"2026-09-25"},"source_pr":3221,"registry_sha":"081198802bd1d317ba010c8a677f046327199cb2","evidence_url":"https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf"},{"id":"1c2839d962425d2f11e33015","type":"content_corrected","date":"2026-09-25","framework_ids":["CRA"],"note":"Review-round fixes (K3): Art. 12(2) and 12(3) split so the derogation covers only Annex III products subject to Art. 32(2)(a)-(b) or 32(3) and Annex IV products under AI Act Annex VI internal control, for the CRA essential requirements only; added Art. 2(1), 3(1), 3(2), 3(22), 3(48), 7(3), 8(1) transition, 8(2), 13(8) fourth subparagraph, 14(7) fourth subparagraph, 14(8) CSIRT fallback, 52(14) and Annexes V, VI and VIII rows from the OJ text.","batch_key":"2026-09-25-km-backfill-d-other","source_pr":3188,"registry_sha":"ee95ba1a01e5a963416794b491dcfc79c25130aa","evidence_url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng"},{"id":"1ccc57af70c8cda9bbf21f40","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_LT"],"note":"Lithuania: version now names the consolidated edition from 2026-07-04 (amendments XV-894, in force 2026-06-30, and XV-1076); Art. 11 identification, Art. 18(4) final-report anchor and Government Resolution 818 editions corrected.","from":{"NIS_2_LT":"Nr. XII-1428 v redakcijos Nr. XIV-2902"},"to":{"NIS_2_LT":"Nr. XII-1428 (nauja redakcija Nr. XIV-2902; suvestinė redakcija nuo 2026-07-04, pakeitimai XV-894 ir XV-1076)"},"source_pr":3218,"registry_sha":"764192b70e7ae9cffb4caf0401556118709d95d2"},{"id":"1d3727e115be5aa557292c8e","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_GR"],"note":"Law 5160/2024 re-verified against the ΦΕΚ copies on cyber.gov.gr: central government and OTA report to the EYP National CERT with simultaneous notice to ΕΑΚ; ΕΑΚ itself is the CSIRT (EL CSIRT); ΚΥΑ 1689/2025 is the requirements framework without registration or sector timelines, registration is ΚΥΑ 1381/2025 (deadline 30.9.2025 by ΚΥΑ 1990/2025); art. 32 repeals arts 1-16 of Law 4577/2018; higher-education carve-out (art. 3 para 8Α, Law 5256/2025 art. 30); exact chapter table, public-body fine band, supervision and TSP 24-hour rule added; outdated eIDAS parallel-reporting claim removed.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7","evidence_url":"https://cyber.gov.gr/nomothesia/elliniki-nomothesia-gia-tin-kyvernoasfaleia/"},{"id":"1d4463c0d51e1c030be68fe9","type":"content_corrected","date":"2026-09-25","framework_ids":["NZ_PRIVACY_ACT_2020","NZ_NZISM"],"note":"Legacy evidence backfill: NZ Privacy Act gains statutory s 22 IPP headings, amendment chain (2025 No 53, 2025 No 74), s 117(5) and s 118 fine and OPC CC BY attribution; NZISM gains precise 1.2.3 applicability, the 1.2.6 legal-status wording and the April 2025 publication date of v3.9 (its licence attribution is the open-licence block).","batch_key":"2026-09-25-km-backfill-b-nz","source_pr":3164,"registry_sha":"178f7a4b5a1d3ca0f2f46f3d04662d215fe2cca8"},{"id":"2051cf88199230282be11c1f","type":"content_corrected","date":"2026-09-25","framework_ids":["CA_PIPEDA"],"note":"Legislative status updated: Bill C-36 (45-1) had first reading on 15 June 2026 and is at second reading (not law), and would replace ss. 1 to 30, repeal Parts 3 to 5 and Schedules 1 and 4; S.C. 2026, c. 3 Division 23 data-mobility amendments (new Division 1.2) are not in force and would be repealed under C-36 s. 51 if C-36 s. 3 comes first; C-27 status restated from LEGISinfo; s. 4(1) scope tightened; titles of s. 7.1, 7.3, 10.2 and 21 aligned to the marginal notes.","batch_key":"2026-09-25-km-fix-ca-privacy","source_pr":3222,"registry_sha":"8dd68ce7ac7cd6aeab6a12031dd03302b4410427","evidence_url":"https://www.parl.ca/legisinfo/en/bill/45-1/c-36"},{"id":"20a20ae4c3726a9b6339bde1","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_CZ"],"note":"Act 264/2025 Sb. re-verified against the e-Sbírka open-data text (version effective 1.11.2025): § 16 72-hour notice and 30-day final report apply only to incidents with significant impact, trust-service providers file the notice within 24 hours; Hlava III, Hlava II Díl 2 to 6 and Část druhá titles corrected; invented placeholder rubrics removed; §§ 51, 52, 62, 68 and 69 added; reporting start (§ 15 odst. 4) and Portál Úřadu added; CSIRT.CZ operator named.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7","evidence_url":"https://e-sbirka.gov.cz/sb/2025/264"},{"id":"20d66524840a89a1c1d023c2","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_BG"],"note":"Art. 16(2) names the Ministry of Innovation and Digital Transformation (until June 2026: the Ministry of e-Government) as national competent authority, not the minister; the register under Art. 6 stays with the minister.","batch_key":"2026-09-25-km-fix-nis2-at-bg","source_pr":3217,"registry_sha":"f8a367ed2a298ec2ecfee0ec2004d69f3a17d674","evidence_url":"https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234"},{"id":"22d0fb3534a4db6289674333","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_RO"],"note":"Every row re-verified against the OUG 155/2024 consolidated form of 06.07.2026 and the amending and subsequent acts on legislatie.just.ro (Legea 124/2025, Legea 123/2026, OUG 104/2021, DNSC orders 1/2025-3/2025 notes, Ordin 1/2026, Ordin 2/2026, Decizia 3/2026); dnsc.ro is bot-walled and was not used.","batch_key":"2026-09-25-km-fix-nis2-ro-sk","from":{"NIS_2_RO":"2026-05-05"},"to":{"NIS_2_RO":"2026-09-25"},"source_pr":3216,"registry_sha":"e32b69a9d135e83b54a2869ee84862b238e6c2a4","evidence_url":"https://legislatie.just.ro/Public/DetaliiDocument/311690"},{"id":"231fd70f06238e6dc5e1344f","type":"verification_refreshed","date":"2026-09-25","framework_ids":["SG_PDPA"],"note":"Re-verified all Act section titles against the SSO table of contents (version in force from 5 December 2025), the amendment history, Part 6A mechanics (s. 26D 3 calendar days, S 64/2021 reg. 4 500 individuals), no data-portability provisions in force, and the S 63/2021 structure as amended by S 580/2026.","batch_key":"2026-09-25-km-fix-be-bsi-sg","from":{"SG_PDPA":"2026-08-13"},"to":{"SG_PDPA":"2026-09-25"},"source_pr":3220,"registry_sha":"93a5a39a4fdca2191805c6cf75460760cd433be4","evidence_url":"https://sso.agc.gov.sg/Act/PDPA2012"},{"id":"239cbb089b6029e502c0fcf3","type":"verification_refreshed","date":"2026-09-25","framework_ids":["UK_DUA_2025"],"note":"Full re-verification of all section and Schedule titles and Part ranges against the legislation.gov.uk contents of the Data (Use and Access) Act 2025, and of the Part 6 commencement state against S.I. 2026/1015.","batch_key":"2026-09-25-km-uk-ico-commission","from":{"UK_DUA_2025":"2026-07-17"},"to":{"UK_DUA_2025":"2026-09-25"},"evidence_url":"https://www.legislation.gov.uk/ukpga/2025/18/contents","source_pr":3185,"registry_sha":"b0d4c5a98a53a265def4e62209c3596292129618"},{"id":"2427794d39c8155a3d4afdc0","type":"content_corrected","date":"2026-09-25","framework_ids":["ISO_27000"],"note":"ISO/IEC 27000:2026 status corrected to published 2026-07-03 (stage 60.60) with the 2018 edition withdrawn, per ISO Open Data; secondary-sourced clause table and concept paraphrase removed (K2b A-prime); family table rebuilt from ISO Open Data titles.","source_pr":3213,"registry_sha":"566c10fc3616dc8275fb937acdd5614c577982c4","evidence_url":"https://isopublicstorageprod.blob.core.windows.net/opendata/_latest/iso_deliverables_metadata/json/iso_deliverables_metadata.jsonl"},{"id":"258822350e424423f5e4495d","type":"version_changed","date":"2026-09-25","framework_ids":["BE_DPA_2018"],"note":"Version label now names the JUSTEL consolidation updated to 2 April 2026, which includes the Loi du 30 mars 2026 (MB 2 avril 2026, NUMAC 2026002492) in force 1 September 2026; the criminal-penalty rows (Arts. 222 to 227) now state the level-1 penalty maximum fines and Art. 230 is marked repealed.","batch_key":"2026-09-25-km-fix-be-bsi-sg","from":{"BE_DPA_2018":"MB/BS 5 septembre 2018, NUMAC 2018040581 (consolidated through 8 July 2024)"},"to":{"BE_DPA_2018":"MB/BS 5 septembre 2018, NUMAC 2018040581 (JUSTEL consolidated through 2 April 2026, incl. Loi du 30 mars 2026 in force 1 September 2026)"},"source_pr":3220,"registry_sha":"93a5a39a4fdca2191805c6cf75460760cd433be4","evidence_url":"https://www.ejustice.just.fgov.be/eli/loi/2026/03/30/2026002492/justel"},{"id":"269ec0675c01d30bbe32255c","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_FI"],"note":"Amendment chain added (critical entities 369/2025; supervisor renames and Annex II point 8 transfer 698/2025; CRA CSIRT task and Finanssivalvonta data sharing 441/2026; Sateilyturvakeskus from 1.1.2027 by 785/2026); section 40 enforcement corrected to the fines enforcement act 672/2002; definitions re-anchored to sections 2, 11 and 27; sections 37 and 39 corrected; unverified Eduskunta date and HE glossary claims removed.","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://www.finlex.fi/fi/lainsaadanto/2025/124"},{"id":"2a7cb6d0a647838ad8db95fc","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_FI"],"note":"Every claim re-verified against the Finlex consolidated text (ajantasa 4.9.2026) and the Finlex open-data texts of the original act and the six amending acts; European Commission NIS2 page as second source.","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","from":{"NIS_2_FI":"2026-05-05"},"to":{"NIS_2_FI":"2026-09-25"},"source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://www.finlex.fi/fi/lainsaadanto/2025/124"},{"id":"2a953f120566c3d2ee8ea630","type":"version_changed","date":"2026-09-25","framework_ids":["JP_JIS_Q_27001"],"note":"JIS Q 27002 edition corrected to JIS Q 27002:2024 (revised 2024-06-20, replacing JIS Q 27002:2014); there is no JIS Q 27002:2023. The version also states that JIS Q 27001:2025 (Amendment 1) is applied with JIS Q 27001:2023.","batch_key":"2026-09-25-km-fix-jp-jis-meti","from":{"JP_JIS_Q_27001":"JIS Q 27001:2025 (= ISO/IEC 27001:2022 + Amd 1:2024); JIS Q 27002:2023 (= ISO/IEC 27002:2022)"},"to":{"JP_JIS_Q_27001":"JIS Q 27001:2025 (= ISO/IEC 27001:2022 + Amd 1:2024; applied with JIS Q 27001:2023); JIS Q 27002:2024 (= ISO/IEC 27002:2022)"},"source_pr":3214,"registry_sha":"a5c992a70e55204ab3f6c271acfd72d3b5647aea","evidence_url":"https://www.meti.go.jp/files/900015968.pdf"},{"id":"2bfbc6e519dc7a1ba2a68d3b","type":"metadata_changed","date":"2026-09-25","framework_ids":["JP_METI_CYBERSECURITY_MGMT"],"note":"METI/IPA Cybersecurity Management Guidelines relabelled from public-law to copyrighted, holders METI and IPA, under IP guidelines 4.3 and 4.4: non-legislative guidance whose METI site licence (PDL1.0) is not CC BY or UK OGL and whose co-author IPA reserves copyright; content stays IDs and official headings with an attribution line.","batch_key":"2026-09-25-km-fix-jp-jis-meti","from":{"JP_METI_CYBERSECURITY_MGMT":"public-law"},"to":{"JP_METI_CYBERSECURITY_MGMT":"copyrighted"},"source_pr":3214,"registry_sha":"a5c992a70e55204ab3f6c271acfd72d3b5647aea","evidence_url":"https://www.meti.go.jp/main/rules.html"},{"id":"2c24eb45b230f0016ad0ff72","type":"verification_refreshed","date":"2026-09-25","framework_ids":["UN_R155"],"note":"Legacy evidence backfill (K5): every row re-verified against the EU Official Journal publications of UN R155 (2025/5, up to Supplement 3) and R156, with Regulation (EU) 2019/2144 (consolidated 2026-08-02) and the Council Decisions on WP.29 positions as second authoritative sources; no R155 amendment after Supplement 3 found.","batch_key":"2026-09-25-km-backfill-d-automotive","from":{"UN_R155":"2026-08-26"},"to":{"UN_R155":"2026-09-25"},"source_pr":3190,"registry_sha":"99254aa4fc3a7f476f1cb0a8f2eb50af4a203b17","evidence_url":"https://eur-lex.europa.eu/eli/reg/2025/5/oj/eng"},{"id":"2cffd2e9e82d4fdabac77d32","type":"content_corrected","date":"2026-09-25","framework_ids":["ISO_19011"],"note":"Owner committee corrected to ISO/TMBG per ISO Open Data; ISO Open Data edition metadata added; clause 4 to 7 titles labelled as ISO 19011:2018 titles carried forward (not re-verified); secondary-sourced Annex A titles and 2026-change descriptions removed (K2b A-prime). lastVerified unchanged.","source_pr":3213,"registry_sha":"566c10fc3616dc8275fb937acdd5614c577982c4","evidence_url":"https://isopublicstorageprod.blob.core.windows.net/opendata/_latest/iso_deliverables_metadata/json/iso_deliverables_metadata.jsonl"},{"id":"2da0fcb644c4418534f411f2","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_BE"],"note":"Belgian NIS 2 law now tracked on the Justel consolidation to 19 January 2026: amended by the law of 19 December 2025 on the resilience of critical entities (MB 19 January 2026, NUMAC 2026000133; Art. 3 para. 4 critical entities, new Art. 75/1). Knowledge rebuilt against the law, the Royal Decree of 9 June 2024 (as amended 15 December 2024) and the CER law: article map, scope, categories, sectoral authorities, conformity-assessment routes and deadlines, incident articles (duty Art. 34, timing Art. 35), sanctions and limitation periods corrected; unsourced claims removed.","batch_key":"2026-09-25-km-cohort-1024","from":{"NIS_2_BE":"MB/BS 2024-05-17, NUMAC 2024202344"},"to":{"NIS_2_BE":"MB/BS 2024-05-17, NUMAC 2024202344; consolidated to 2026-01-19 (CER law of 2025-12-19)"},"evidence_url":"https://www.ejustice.just.fgov.be/eli/loi/2024/04/26/2024202344/justel","source_pr":3147,"registry_sha":"b8bb2d3f7ae2ebfe05b956c6ebff0d7b084896fe"},{"id":"2f69d27d8cecc9daa2954216","type":"content_corrected","date":"2026-09-25","framework_ids":["NCSC_CAF"],"note":"CAF knowledge line-audited against the CAF v4.0 PDF and the NCSC changelog and record of changes: v4.0 change list completed (new A2.b Understanding threat, A2.c Assurance, new C1.f, 39 to 41 outcomes), NIS competent authorities given their Schedule 1 titles (drinking water is the Secretary of State, not Ofwat), RDSPs placed with the Information Commissioner, Enhanced Profile marked sector specific, GovAssure wording aligned to gov.uk, unsourced CE mapping removed; OGL v3.0 attribution added.","source_pr":3165,"registry_sha":"04ddd433820479b2858a133053899c6611a80dea"},{"id":"2fd1ed00f445cc274e017996","type":"verification_refreshed","date":"2026-09-25","framework_ids":["DO_326A_ED_202A"],"note":"Legacy evidence backfill (K5) under K2b: identifiers, titles and dates re-verified against EUROCAE and RTCA catalogue metadata and the SC-216 ToR Rev. 20; public anchors against EASA ED Decision 2020/006/R (AMC 20-42), the FAA NPRM, Federal Register API, Unified Agenda and AC 119-1A. No purchased copy opened.","batch_key":"2026-09-25-km-backfill-c","from":{"DO_326A_ED_202A":"2026-09-06"},"to":{"DO_326A_ED_202A":"2026-09-25"},"source_pr":3179,"registry_sha":"7361b2be91c1719a8bcb7281de5c1f94873936a6","evidence_url":"https://www.easa.europa.eu/en/document-library/agency-decisions/ed-decision-2020006r"},{"id":"30b87510b19a20686b98ca8e","type":"verification_refreshed","date":"2026-09-25","framework_ids":["FINMA_23_01"],"note":"Full content re-verification: every margin-number claim and description checked against the current FINMA Circular 2023/1 PDF (EN, cross-read DE/FR); FINMA listing shows the 7.12.2022 version only and the regulatory projects overview (1 June 2026) lists no revision; underlying acts and ISG checked on fedlex.","batch_key":"2026-09-25-km-cohort-1024","from":{"FINMA_23_01":"2026-06-15"},"to":{"FINMA_23_01":"2026-09-25"},"evidence_url":"https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf?sc_lang=en","source_pr":3147,"registry_sha":"b8bb2d3f7ae2ebfe05b956c6ebff0d7b084896fe"},{"id":"30d48453f5fed443a295fc1e","type":"content_corrected","date":"2026-09-25","framework_ids":["EN_18286"],"note":"ICS corrected to 35.240.01 (EVS catalogue); unsourced approval-date, M/613 and working-group claims, scope paraphrase and unverified prEN sibling table removed (K2b A-prime); EU AI Act anchors updated for Regulation (EU) 2026/1744 (Art. 17(2), Art. 40(1)-(2), Art. 113(3)(c)); not cited in the OJEU as of 2026-09-25.","source_pr":3213,"registry_sha":"566c10fc3616dc8275fb937acdd5614c577982c4","evidence_url":"https://www.evs.ee/en/evs-en-18286-2026"},{"id":"371e1481440ef26375a9dcc2","type":"content_corrected","date":"2026-09-25","framework_ids":["IE_DPA_2018"],"note":"Art. 9 conditions row: s. 50 is limited to data concerning health processed for insurance, pension or mortgage-of-property purposes, not a general special-category condition for insurance and pensions.","batch_key":"2026-09-25-km-ie-dpa-confirm","source_pr":3208,"registry_sha":"476e3eba81692860d73e636a0c405cdc9a8fafea","evidence_url":"https://www.irishstatutebook.ie/eli/2018/act/7/section/50/enacted/en/html"},{"id":"3b699e537746de21670240d3","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_GR"],"note":"Every row re-verified against ΦΕΚ Α 195/2024 (Law 5160/2024) and the ΚΥΑ 1381, 1645, 1689, 1990 and 2267/2025 gazette copies on cyber.gov.gr, with ΦΕΚ Α 223/2025 (Law 5256/2025) for the only amending law found.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","from":{"NIS_2_GR":"2026-05-05"},"to":{"NIS_2_GR":"2026-09-25"},"source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7","evidence_url":"https://cyber.gov.gr/nomothesia/elliniki-nomothesia-gia-tin-kyvernoasfaleia/"},{"id":"3d8de05071711aa942657898","type":"verification_refreshed","date":"2026-09-25","framework_ids":["UK_EIR_2004"],"note":"Full re-verification of all regulation and Part headings against the legislation.gov.uk contents of the Environmental Information Regulations 2004 (0 mismatches), plus made and in-force dates, enabling power and Directive reference.","batch_key":"2026-09-25-km-uk-ico-commission-foia-eir","from":{"UK_EIR_2004":"2026-07-23"},"to":{"UK_EIR_2004":"2026-09-25"},"evidence_url":"https://www.legislation.gov.uk/uksi/2004/3391/contents","source_pr":3193,"registry_sha":"f656ddbcaabb4f33060e6977c922ce76cfee207d"},{"id":"3e6354dcfe5586d0c5cd99c2","type":"content_corrected","date":"2026-09-25","framework_ids":["ENS"],"note":"ENS knowledge line-audited against the BOE consolidated text of RD 311/2022 (as amended by RD 1125/2024) and the BOE open-data API: CCN-STIC 892 marked withdrawn by the CCN on 28 March 2025, CCN-STIC guide titles and edition dates taken from official copies, chapter and measure-group headings made exact, Art. 2.3 (Art. 12 policy duty for private suppliers), Art. 13.5 POC, Art. 31.2-31.7 audit mechanics, Anexo I annual re-evaluation, Anexo III BÁSICA self-assessment, the transitional provision and the ITS on the state-of-security report (BOE-A-2016-10108) and incident notification (BOE-A-2018-5370) added; unsupported wording removed; NIS 2 status updated to the Commission referral of 8 July 2026 (IP/26/1499).","source_pr":3174,"registry_sha":"02e445c40caf706693f62fc2592a76f955abde80"},{"id":"3ebbc48989fcaecde1a9b0ff","type":"verification_refreshed","date":"2026-09-25","framework_ids":["IN_SEBI_CSCRF"],"note":"CSCRF circular 2024/113 and framework, clarifications 2024/184, 2025/60 and 2025/119, extensions 2025/45 and 2025/96, the 11 June 2025 FAQs, the 5 May 2026 AI advisory and the 24 August 2026 FIRE circular re-read on sebi.gov.in; SEBI circular listing checked to its 9 September 2026 top entry.","batch_key":"2026-09-25-km-fix-in-sebi-cscrf","from":{"IN_SEBI_CSCRF":"2026-07-17"},"to":{"IN_SEBI_CSCRF":"2026-09-25"},"evidence_url":"https://www.sebi.gov.in/sebi_data/attachdocs/aug-2024/1724326790365.pdf","source_pr":3223,"registry_sha":"8e18f11ed3855ce3f6d20785bdfcd735d36a0cfc"},{"id":"4108db5e56502d59860cd8ea","type":"content_corrected","date":"2026-09-25","framework_ids":["ISO_SAE_21434"],"note":"Brought to the K2b A-prime posture: scope paraphrase, TARA step purposes, concept definitions, certification claims and the unverified SAE J3061 supersession removed; edition metadata re-checked in ISO Open Data (edition 1, 2021-08-31, stage 90.20, no replacing project); OBP citation dropped; clause titles and concept names kept and labelled as carried forward from 2026-08-26, not re-verified; lastVerified unchanged.","batch_key":"2026-09-25-km-backfill-d-automotive","source_pr":3190,"registry_sha":"99254aa4fc3a7f476f1cb0a8f2eb50af4a203b17","evidence_url":"https://isopublicstorageprod.blob.core.windows.net/opendata/_latest/iso_deliverables_metadata/json/iso_deliverables_metadata.jsonl"},{"id":"42c70f3a30c83fef810aa766","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_SE","NIS_2_EE"],"note":"SE: SFS 2026:623 (in force 1 July 2026) made FRA/NCSC the single point of contact, CSIRT (CERT-SE), cyber-crisis authority and rule-maker, MCF only until 30 June 2026; MCFFS 2026:1 and 2026:8 added, MCFFS 2026:11 and 2026:12 stated on both sides of 1 October 2026; supervisory table completed per 2025:1507 7-15 (Transportstyrelsen, Läkemedelsverket, county boards); definition citations corrected (betydande incident is in 2 kap. 5, not 1 kap. 2); DORA carve-out, registration, recipient-information duties added. EE: KORKS (RT I, 30.06.2026, 1) replaces the Emergency Act in KüTS references from 1 October 2026, both consolidated texts cited; bill 897 SE adopted 23 September 2026 labelled not yet in force; trust-service 24 h report, thresholds, late-entrant and transition deadlines added.","batch_key":"2026-09-25-km-fix-nis2-se-ee","source_pr":3212,"registry_sha":"4ae0118b947a5ad6f9ad83c5efaa09606c060682","evidence_url":"https://rkrattsbaser.gov.se/sfsr?bet=2025:1507"},{"id":"43e1baa23db13e908271eb6b","type":"content_corrected","date":"2026-09-25","framework_ids":["IEC_62443"],"note":"Added an edition-status note from IEC Webstore catalogue metadata: publication dates of the four tabulated parts, IEC 62443-3-3 Corrigendum 1 (2014-04-24) and IEC 62443-4-1 Ed. 2.0 under development (stage PCC, forecast 2028-04-21); requirement titles not re-verified, lastVerified unchanged.","batch_key":"2026-09-25-km-backfill-d-ot","source_pr":3184,"registry_sha":"a04c0d9ccc1af659689204ebb79a1b08c251800e","evidence_url":"https://webstore.iec.ch/en/publication/33615"},{"id":"4765f5126c9149fb3eeaa72d","type":"metadata_changed","date":"2026-09-25","framework_ids":["AU_ESSENTIAL_EIGHT","CYBER_ESSENTIALS","NCSC_CAF","CH_ICT_MIN_STD","AU_ISM","NZ_NZISM","AU_NSW_CSP","AU_VIC_VPDSS"],"note":"ipStatus moved to the new open-licence category for openly licensed government material (CC BY 4.0, Open Government Licence v3.0); each module now carries structured licence metadata, a named licensor and, in its knowledge text, the attribution line, licence link and modification notice.","batch_key":"2026-09-25-open-licence-status","from":{"AU_ESSENTIAL_EIGHT":"public-law","CYBER_ESSENTIALS":"copyrighted","NCSC_CAF":"copyrighted","CH_ICT_MIN_STD":"copyrighted","AU_ISM":"public-law","NZ_NZISM":"public-law","AU_NSW_CSP":"public-law","AU_VIC_VPDSS":"public-law"},"to":{"AU_ESSENTIAL_EIGHT":"open-licence","CYBER_ESSENTIALS":"open-licence","NCSC_CAF":"open-licence","CH_ICT_MIN_STD":"open-licence","AU_ISM":"open-licence","NZ_NZISM":"open-licence","AU_NSW_CSP":"open-licence","AU_VIC_VPDSS":"open-licence"},"source_pr":3181,"registry_sha":"d8f2442031831dec57f6a412524155def9b16738"},{"id":"47b1e1fdad66570f550fe32e","type":"verification_refreshed","date":"2026-09-25","framework_ids":["FR_SECNUMCLOUD"],"note":"Legacy evidence backfill (K5): all 278 requirement IDs and subsection titles re-verified against the ANSSI référentiel v3.2 PDF (current on the ANSSI référentiels page), with the arrêté du 12 août 2026, décret 2026-272 and its rectificatif from the JORF open data as second authoritative source.","batch_key":"2026-09-25-km-backfill-d-cloud","from":{"FR_SECNUMCLOUD":"2026-08-26"},"to":{"FR_SECNUMCLOUD":"2026-09-25"},"source_pr":3187,"registry_sha":"da1072e42ee56401069181c51e7d3bf833a4a051","evidence_url":"https://cyber.gouv.fr/documents/388/secnumcloud-referentiel-exigences-v3.2.pdf"},{"id":"47d6dbadd7bb711f6ee7f0df","type":"content_corrected","date":"2026-09-25","framework_ids":["IN_RBI_IT_CYBER"],"note":"CERT-In notification duty stated per Direction from the texts (UCB paragraph 87 requires it; NBFC paragraph 28 does not); Housing Finance Companies report to NHB; the outsourcing repeal is limited to what paragraph 95 says for Commercial Banks; the unverified list of replacement Digital Payment Security Controls Directions is removed.","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","source_pr":3221,"registry_sha":"5873013652880ba98dd07e421814d4f15a8cddb1","evidence_url":"https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=13616"},{"id":"48182b521206ca99a972b651","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_CZ"],"note":"Act 264/2025 Sb. § 16 odst. 3 písm. c) sequence corrected: if the incident still lasts after the 30-day window, a progress report is due without undue delay after that window and the final report within 30 days of resolution.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","source_pr":3230},{"id":"4869c686a2d069ecd422a893","type":"verification_refreshed","date":"2026-09-25","framework_ids":["CH_FADP"],"note":"The full article-by-article re-verification of PR #3174 against the Fedlex FADP and DPO consolidations, plus the second-review fixes, now has clean fresh-context reviewer and Grok verdicts on the final text, so lastVerified moves from 2026-09-13.","batch_key":"2026-09-25-km-ch-fadp-confirm","from":{"CH_FADP":"2026-09-13"},"to":{"CH_FADP":"2026-09-25"},"source_pr":3205,"registry_sha":"da44a3ed4b28319c0aef3b42f6daff4829b28836","evidence_url":"https://www.fedlex.admin.ch/eli/cc/2022/491/en"},{"id":"48a936d13fa7bf638d426d22","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_SK"],"note":"Section rubrics corrected against the official text (§ 4, 5, 7, 9-12, 19, 27, 29-29n; no § 25); non-statutory essential/important terms replaced by PZS and prevádzkovateľ kritickej základnej služby, with § 31 fine tiers mapped accordingly; § 27 ods. 11 crisis declared by NBÚ; added 318/2025, 67/2026, decrees 111/2026 and 212/2026, § 24 ods. 5 and 8, § 20 ods. 4-5, § 29 audit and § 34b transition to 31.12.2026.","batch_key":"2026-09-25-km-fix-nis2-ro-sk","source_pr":3216,"registry_sha":"e32b69a9d135e83b54a2869ee84862b238e6c2a4","evidence_url":"https://static.slov-lex.sk/static/SK/ZZ/2018/69/20260430.html"},{"id":"48ab12f1caeb47fd2a630df3","type":"content_corrected","date":"2026-09-25","framework_ids":["FINMA_23_01","FINMA_18_03"],"note":"FINMA 18/3 and 23/1 directive lines that restated definitions (18/3 margin nos. 3, 4 and 8; 23/1 margin nos. 7, 8 and 14-18) reworded as pointers to the margin number with short notes in our own words, per the founder IP decision of 2026-09-25; ipStatus stays public-law with the researched rights basis (URG Art. 5, FINMASA Art. 7(1)(b), BGE 151 II 391, BGer 2C_388/2024) recorded in the module header.","batch_key":"2026-09-25-ip-decisions-modules","evidence_url":"https://www.fedlex.admin.ch/eli/cc/1993/1798_1798_1798/de#art_5","source_pr":3182,"registry_sha":"ee77137cd6ad400f1a6e0806a35ad7380bbaf712"},{"id":"49dadefd84886929356f727b","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_MT"],"note":"Version now states LN 71/2025 as amended by LN 89/2026 at the legislation.mt point in time 7 April 2026 (no later amending notice).","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","from":{"NIS_2_MT":"S.L. 460.41 (Cap. 460); LN 71/2025; amending LN 89/2026"},"to":{"NIS_2_MT":"S.L. 460.41 (Cap. 460); LN 71/2025 as amended by LN 89/2026 (point in time 7 April 2026)"},"source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://legislation.mt/eli/sl/460.41/eng"},{"id":"4d8e156aac45eb3503f9f494","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_HR"],"note":"Part ranges corrected against NN 14/2024 (DIO DEVETI is čl. 101-104, DIO DESETI 105-116, plus the missing ranges of DIO IV to VIII); čl. 9 now includes kritični subjekti and čl. 10 covers medium, not smaller, Annex I entities; Annex IV title, čl. 102(2), 103 and 104 penalties and prosecutors, Uredba čl. 68, 69 and 71 mechanics, the čl. 105, 106 and 109 transitional regime and the NN 57/2024 reorganisation (Ministarstvo pravosuđa, uprave i digitalne transformacije) added; zakon.hr dropped as a source.","batch_key":"2026-09-25-km-fix-nis2-hr-si","source_pr":3227,"registry_sha":"2600c52f18c09d5848dca13b59aabfe5375694c4","evidence_url":"https://narodne-novine.nn.hr/clanci/sluzbeni/2024_02_14_254.html"},{"id":"4f6f3bb010894e8511dea8bf","type":"content_corrected","date":"2026-09-25","framework_ids":["CA_OSFI_B13"],"note":"OSFI Guideline B-13 content cut to section IDs, official headings and bare facts under the Crown copyright posture: the three paraphrased domain outcome statements, the paraphrased purpose line, the self-assessment lead-time note and the descriptions of Guidelines E-21 and B-10 and the incident reporting advisory are removed; IDs, headings, scope and lastVerified are unchanged, and the only date change is the 20 to 22 February 2024 amendment date correction recorded in event fbeb2953083fef8c1efd3120.","batch_key":"2026-09-25-ip-osfi-b13","source_pr":3224,"registry_sha":"a5cd3e968936dd52aa661a693de18225179e1f0d","evidence_url":"https://www.osfi-bsif.gc.ca/en/terms-conditions"},{"id":"5000057c3c6fbaf529155bf5","type":"verification_refreshed","date":"2026-09-25","framework_ids":["UK_CAA_CYBER_OVERSIGHT"],"note":"Legacy evidence backfill (K5): every row re-verified against CAP 1753 Issue 3 (listing: current, version date 02-May-2024), CAP 1850 and CAP 1849, the CAA oversight and ASSURE pages, legislation.gov.uk and the NCSC CAF v4.0.","batch_key":"2026-09-25-km-backfill-c","from":{"UK_CAA_CYBER_OVERSIGHT":"2026-09-06"},"to":{"UK_CAA_CYBER_OVERSIGHT":"2026-09-25"},"evidence_url":"https://www.caa.co.uk/publication/download/17492","source_pr":3167,"registry_sha":"1c4e4a5d0f8086d548242953e355ee115dfa5ca1"},{"id":"552f8e0515f9c67ea8cbc9d0","type":"content_corrected","date":"2026-09-25","framework_ids":["UK_CAA_CYBER_OVERSIGHT"],"note":"CAP 1753 Issue 3 profiles named (Tier 1 to 3 with sections and regulations), tier-specific Stage 2 and Stage 3 rules, ASSURE procurement and specialisms, 60-day and quarterly mechanics, CAP 1850 described as the guidance for the separate CAF for Aviation workbook (second publication, August 2020), submission-route conflict flagged, NIS Regulations 2018 regulation 11 clock added.","evidence_url":"https://www.caa.co.uk/publication/download/17492","source_pr":3167,"registry_sha":"1c4e4a5d0f8086d548242953e355ee115dfa5ca1"},{"id":"55ac056fa840bb54f9494858","type":"content_corrected","date":"2026-09-25","framework_ids":["UN_R155"],"note":"UN R155 re-verified against OJ L 2025/5 (up to Supplement 3), the 2021 R155 and R156 publications and Regulation (EU) 2019/2144 Annex II: CSMS certificate validity is a maximum of 3 years (6.7, extendable 6.10), not typically 3 years; scope now categories L, M, N and O with an ECU; unsupported US-regime and adoption-month claims removed; non-party status anchored to the UN Treaty Collection; Annex 5 Part A headings verbatim; transitional relief, para. 7.3 requirements, refusal grounds, reporting, retention, DETA and CoP mechanics, R156 scope, update security and pending 01 series added; ISO/SAE 21434 link restated from the R155 footnote to 5.3.1(a); GB 44495/44496-2024 dates added.","batch_key":"2026-09-25-km-backfill-d-automotive","source_pr":3190,"registry_sha":"99254aa4fc3a7f476f1cb0a8f2eb50af4a203b17","evidence_url":"https://eur-lex.europa.eu/eli/reg/2025/5/oj/eng"},{"id":"5634c195af6d61b253349771","type":"version_changed","date":"2026-09-25","framework_ids":["CCSDS_SECURITY"],"note":"Version label corrected: the source is the ccsds.org publications catalogue (17 books in the 350-357 range), not an SEA-SEC catalogue.","from":{"CCSDS_SECURITY":"CCSDS SEA-SEC catalogue as listed on ccsds.org, September 2026"},"to":{"CCSDS_SECURITY":"CCSDS 350-357 security books as listed in the ccsds.org publications catalogue, September 2026"},"source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://ccsds.org/publications/allpubs/"},{"id":"5699ed61f6eafdd29ada6283","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_SI"],"note":"Full re-verification of ZInfV-1 (Uradni list RS 40/2025) against the Uradni list text and PDF; no ZInfV-1A or other amendment found (uradni-list.si archive to 28.2.2026 and PISRS after).","batch_key":"2026-09-25-km-fix-nis2-hr-si","from":{"NIS_2_SI":"2026-05-05"},"to":{"NIS_2_SI":"2026-09-25"},"source_pr":3227,"registry_sha":"2600c52f18c09d5848dca13b59aabfe5375694c4","evidence_url":"https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2025-01-1571/zakon-o-informacijski-varnosti-zinfv-1"},{"id":"58ddc1121e8a39cb09225a08","type":"content_corrected","date":"2026-09-25","framework_ids":["NCSC_CAF","UK_FOIA_2000","UK_EIR_2004"],"note":"Regulator transition: from 30 September 2026 the Information Commission replaces the Information Commissioner (DUA 2025 ss. 118-119 commenced by S.I. 2026/1015 reg. 2; FOIA 2000 and EIR 2004 wording substituted by S.I. 2026/386 Sch. 2 para. 12 and Sch. 3 para. 8), still known as the ICO; FOIA and EIR headings and the NCSC_CAF UK NIS row carry both readings.","batch_key":"2026-09-25-km-uk-ico-commission-foia-eir","evidence_url":"https://www.legislation.gov.uk/uksi/2026/386/made","source_pr":3193,"registry_sha":"f656ddbcaabb4f33060e6977c922ce76cfee207d"},{"id":"5f089849828fbb59f051b5b6","type":"content_corrected","date":"2026-09-25","framework_ids":["CH_FADP"],"note":"Second-review fixes: Art. 6 para. 7(b) makes consent explicit where a private person relies on consent for high-risk profiling (not a mandatory basis; Art. 31 grounds remain); Art. 24 para. 5bis forwarding goes to the Federal Office for Cybersecurity (BACS) per the authentic DE text; Art. 71 wording narrowed to the statute; Italian title corrected.","batch_key":"2026-09-25-km-ch-fadp-confirm","source_pr":3205,"registry_sha":"da44a3ed4b28319c0aef3b42f6daff4829b28836"},{"id":"5f807bd99b893d6c4686cbcd","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_RO"],"note":"Chapter table rebuilt from the official text (10 chapters: Chapter IX sanctions arts. 60-63, Chapter X transitional arts. 64-68); Legea 362/2018 repeal cited as art. 66 alin. (1) lit. a), not art. 65; Legea 58/2023 and OUG 119/2022 no longer described as abandoned NIS 2 drafts; added Legea 123/2026, DNSC Ordin 1/2026, Ordin 2/2026 and Decizia 3/2026, the art. 15 6-hour cross-border clock and PNRISC, arts. 5-6, 11-14, 18, 48-50 and the full art. 60 fine bands.","batch_key":"2026-09-25-km-fix-nis2-ro-sk","source_pr":3216,"registry_sha":"e32b69a9d135e83b54a2869ee84862b238e6c2a4","evidence_url":"https://legislatie.just.ro/Public/DetaliiDocument/311690"},{"id":"621649fa083299d15e759770","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_FI"],"note":"Version now names the consolidated Kyberturvallisuuslaki 124/2025 as amended by 369/2025, 494/2025, 698/2025, 997/2025, 441/2026 and 785/2026 (Finlex ajantasa 4.9.2026).","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","from":{"NIS_2_FI":"Kyberturvallisuuslaki 4.4.2025/124"},"to":{"NIS_2_FI":"Kyberturvallisuuslaki 124/2025, muutettu 369/2025, 494/2025, 698/2025, 997/2025, 441/2026 ja 785/2026 (ajantasa 4.9.2026)"},"source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://www.finlex.fi/fi/lainsaadanto/2025/124"},{"id":"6422d105b313596909c000bd","type":"content_corrected","date":"2026-09-25","framework_ids":["IN_SEBI_CSCRF"],"note":"Rebuilt on the current CSCRF position: Merchant Bankers per circular 2025/119 para 7.2 (active Small-size, inactive exempt; issue-management Mid-size rule removed), Portfolio Managers per para 7.1 AUM bands, a category crosswalk for every RE type and a per-category obligations table; ISO 27001 mandatory for MIIs only; own-SOC and group-SOC routes to Market SOC scoped to FAQ Q60 and Q59; incident reporting per Annexure-O (6 hours email, 24 hours portal) with the FIRE portal; statutory authority SEBI Act s. 11(1) only; 2025/119 Parts A, B and D added.","batch_key":"2026-09-25-km-fix-in-sebi-cscrf","evidence_url":"https://www.sebi.gov.in/sebi_data/attachdocs/aug-2025/1756380695925.pdf","source_pr":3223,"registry_sha":"8e18f11ed3855ce3f6d20785bdfcd735d36a0cfc"},{"id":"66aebf2cf65954bd63b9e84b","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_SI"],"note":"ZInfV-1 transitional rules re-attributed (čl. 61 continued status, čl. 62(1) 18 months, 62(2) and 62(3) one year); čl. 52(5) and 52(6) fines corrected to 1 000-10 000 and 500-3 000 EUR and čl. 53(4)-(6) added; čl. 30(3) CSIRT reply is immediate and where possible within 24 hours; Chapter VII title, annex titles, the čl. 7(1) carve-out, čl. 6(5), čl. 56-58 scope and the implementing acts UL RS 66/2025 and 78/2025 added.","batch_key":"2026-09-25-km-fix-nis2-hr-si","source_pr":3227,"registry_sha":"2600c52f18c09d5848dca13b59aabfe5375694c4","evidence_url":"https://www.uradni-list.si/glasilo-uradni-list-rs/vsebina/2025-01-1571/zakon-o-informacijski-varnosti-zinfv-1"},{"id":"66d5249fceb19a966040c8cc","type":"content_corrected","date":"2026-09-25","framework_ids":["FR_SECNUMCLOUD"],"note":"Annex description corrected (Annexe 2 holds recommendations to clients, not document references); section 18.2 rows now carry the full parent title; legal-force paragraph now cites loi SREN art. 31 and décret 2026-272 art. 2 and adds the décret art. 3 derogation regime (arrêté du 14 avril 2026); unverified v3.2.a draft remark removed.","batch_key":"2026-09-25-km-backfill-d-cloud","source_pr":3187,"registry_sha":"da1072e42ee56401069181c51e7d3bf833a4a051","evidence_url":"https://www.legifrance.gouv.fr/eli/arrete/2026/8/12/PRMD2617964A/jo/texte"},{"id":"67c3ce34ef39798b21d91ef2","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_BG"],"note":"ЗКС re-verified against ДВ бр. 17/2026, ДВ бр. 94/2018, ДВ бр. 43/2026 and ДВ бр. 55/2026: МЕУ merged into МИДТ; 17 sectors not 18; chapter titles, 12 risk measures, reporting to СЕРИКС with 24 h for trust service providers, чл. 28 and 30 bands, КРС as statutory НКО, ДАНС as a чл. 27е control body, § 47 deadlines and the closed § 51 window corrected; unverified ДАЕУ, NSPOC and infringement claims removed.","batch_key":"2026-09-25-km-fix-nis2-at-bg","source_pr":3217,"registry_sha":"708b8aa154df0999fe1c9171f3049a7a98cbc017","evidence_url":"https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234"},{"id":"6920f62a3f060c64cb7cef21","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_LT","NIS_2_PL"],"note":"Full re-verification against the e-seimas consolidated text of Law XII-1428 (edition from 2026-07-04) and the Sejm ELI API texts of Dz.U. 2026 poz. 252, 815, 1003 and 1206 plus the Kancelaria Sejmu unified UKSC text of 2026-08-18.","from":{"NIS_2_LT":"2026-05-05","NIS_2_PL":"2026-05-11"},"to":{"NIS_2_LT":"2026-09-25","NIS_2_PL":"2026-09-25"},"source_pr":3218,"registry_sha":"764192b70e7ae9cffb4caf0401556118709d95d2","evidence_url":"https://api.sejm.gov.pl/eli/acts/DU/2018/1560"},{"id":"6cbf0851bba3bae646738fdd","type":"content_corrected","date":"2026-09-25","framework_ids":["ECSS_E_ST_80C"],"note":"ECSS licence (no reproduction without ESA consent) triggers K2b: scope-and-applicability summary and clause 5.3.3 paraphrase removed; clause titles, DRL items, Annex B headings and normative references re-verified; 140 requirement identifiers, 5.1.3.1/5.1.3.2 titles and ECSS-S-ST-00 / ECSS-M-ST-80 citations added.","source_pr":3179,"registry_sha":"7361b2be91c1719a8bcb7281de5c1f94873936a6","evidence_url":"https://ecss.nl/standard/ecss-e-st-80c-space-engineering-security-in-space-systems-lifecycles/"},{"id":"6e4bf959d038f072fcd97a68","type":"version_changed","date":"2026-09-25","framework_ids":["CCPA"],"note":"Version string now names the 2025 statutes (AB 137, AB 566) and the CPI-adjusted amounts effective 2025-01-01 in addition to CPRA and the 2026 CPPA regulations.","batch_key":"2026-09-25-km-fix-ccpa-hipaa","from":{"CCPA":"CCPA (2018) as amended by CPRA (operative 2023-01-01), AB 1008 and SB 1223 (operative 2025-01-01); CPPA ADMT/cyber-audit/risk-assessment/insurance regulations effective 2026-01-01"},"to":{"CCPA":"CCPA (2018) as amended by CPRA (operative 2023-01-01) and later statutes through AB 137 and AB 566 (2025); CPI-adjusted amounts effective 2025-01-01; CPPA ADMT/cyber-audit/risk-assessment/insurance regulations effective 2026-01-01"},"source_pr":3226,"registry_sha":"f409117be208e34d3a2aea1ed42e2610a6cad729"},{"id":"6f89d40d4ca99e5b8f074505","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NCSC_CAF"],"note":"Full content re-verification of all 4 objectives, 14 principles and 41 contributing outcomes against the CAF v4.0 PDF; NCSC changelog confirms v4.0 (4 August 2025) is still current.","batch_key":"2026-09-25-km-backfill-a-uk","from":{"NCSC_CAF":"2026-09-13"},"to":{"NCSC_CAF":"2026-09-25"},"evidence_url":"https://www.ncsc.gov.uk/files/NCSC-Cyber-Assessment-Framework-4.0.pdf","source_pr":3165,"registry_sha":"04ddd433820479b2858a133053899c6611a80dea"},{"id":"6fa3518f30f66328f21f0af5","type":"version_changed","date":"2026-09-25","framework_ids":["CA_PIPEDA"],"note":"Version label now names the Justice Laws consolidation actually verified: current to 2026-09-03, last amended 2025-03-04.","batch_key":"2026-09-25-km-fix-ca-privacy","from":{"CA_PIPEDA":"S.C. 2000, c. 5 (current consolidation)"},"to":{"CA_PIPEDA":"S.C. 2000, c. 5 (consolidation current to 2026-09-03, last amended 2025-03-04)"},"source_pr":3222,"registry_sha":"8dd68ce7ac7cd6aeab6a12031dd03302b4410427","evidence_url":"https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html"},{"id":"729de389a4b30f22729714ed","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_HR"],"note":"Full re-verification of the Zakon o kibernetičkoj sigurnosti (NN 14/2024) and the Uredba (NN 135/2024) against Narodne novine; the NN yearly indexes 2024 to 2026 show no amendment of either act.","batch_key":"2026-09-25-km-fix-nis2-hr-si","from":{"NIS_2_HR":"2026-05-05"},"to":{"NIS_2_HR":"2026-09-25"},"source_pr":3227,"registry_sha":"2600c52f18c09d5848dca13b59aabfe5375694c4","evidence_url":"https://narodne-novine.nn.hr/clanci/sluzbeni/2024_02_14_254.html"},{"id":"7432bc17f3bb317270aef6bc","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_SK"],"note":"Version label now names the amendments after 366/2024: 318/2025 Čl. VIII (from 1.1.2026) and 67/2026 Čl. III (from 30.4.2026); current version of 69/2018 in force from 30.4.2026.","batch_key":"2026-09-25-km-fix-nis2-ro-sk","from":{"NIS_2_SK":"Zákon č. 69/2018 Z. z. v znení 366/2024 Z. z."},"to":{"NIS_2_SK":"Zákon č. 69/2018 Z. z. v znení 366/2024, 318/2025 a 67/2026 Z. z. (znenie od 30. 4. 2026)"},"source_pr":3216,"registry_sha":"e32b69a9d135e83b54a2869ee84862b238e6c2a4","evidence_url":"https://static.slov-lex.sk/static/SK/ZZ/2018/69/"},{"id":"77d291091815c463c534f965","type":"content_corrected","date":"2026-09-25","framework_ids":["IN_DPDPA"],"note":"RBI cross-reference updated: the 2023 IT Governance Master Direction and the 2016 Cyber Security Framework were repealed on 31 July 2026 (RBI/DoS/2026-27/221) and replaced by the 2026 entity-wise Directions (DAKSH 6 hours, HFCs to NHB); SEBI ISO 27001 is not mandatory for Qualified REs (2025/119 para 6.11); RTI amendment is s. 44(3) and s. 44(1) amends the TRAI Act; Rules 17-23 titles; s. 6(9) and s. 27(1)(d) commence 13 Nov 2026; Board established by G.S.R. 844(E); s. 7 clause letters; Rule 6(1)(e) wording.","batch_key":"2026-09-25-km-fix-in-dpdpa-irdai","source_pr":3229,"registry_sha":"d67f6b528ec1405bb399a951eca3cba790bdf058","evidence_url":"https://www.meity.gov.in/static/uploads/2025/11/c56ceae6c383460ca69577428d36828b.pdf"},{"id":"7860ed069b4cafbb30121b31","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_CY","NIS_2_LV"],"note":"Full re-verification against the Cyprus Official Gazette copy of K.D.P. 281/2026 and the Latvian official publication of the 04.06.2026 amending law plus the consolidated NKDL.","from":{"NIS_2_CY":"2026-05-05","NIS_2_LV":"2026-05-05"},"to":{"NIS_2_CY":"2026-09-25","NIS_2_LV":"2026-09-25"},"source_pr":3215,"registry_sha":"68ac8060fc8d18d650ad2c02d299b2a20b1937b6","evidence_url":"https://www.vestnesis.lv/op/2026/115.1"},{"id":"7a8764b7303be90fa881f39c","type":"verification_refreshed","date":"2026-09-25","framework_ids":["CYBER_ESSENTIALS"],"note":"Full content re-verification against the NCSC Requirements for IT Infrastructure v3.3 (current since 27 April 2026, no successor announced), with the CE+ Test Specification, IASME and gov.uk procurement notes as second authoritative sources.","batch_key":"2026-09-25-km-backfill-a-uk","from":{"CYBER_ESSENTIALS":"2026-09-13"},"to":{"CYBER_ESSENTIALS":"2026-09-25"},"evidence_url":"https://www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdf","source_pr":3165,"registry_sha":"04ddd433820479b2858a133053899c6611a80dea"},{"id":"7ac0f9df3f2e2eec897c60d8","type":"content_corrected","date":"2026-09-25","framework_ids":["HIPAA"],"note":"160.404 tiers now carry the 45 CFR 102.3 amounts (91 FR 3665) and the 2019 enforcement-discretion caps; 164.520(a)(2)/(a)(3) titles fixed; 162.1902 NCPDP timeline and 162.2001/162.2002 claims attachments added; 2024 reproductive health rule flagged as vacated by Purl v. HHS (N.D. Tex. 2025) except 164.520; Ciox third-party directive note; Security Rule NPRM flagged as proposal only.","batch_key":"2026-09-25-km-fix-ccpa-hipaa","evidence_url":"https://www.govinfo.gov/content/pkg/FR-2026-01-28/pdf/2026-01688.pdf","source_pr":3226,"registry_sha":"f409117be208e34d3a2aea1ed42e2610a6cad729"},{"id":"7b11ab6ca7744da07c5a728f","type":"verification_refreshed","date":"2026-09-25","framework_ids":["DIGID_ASSESSMENT"],"note":"All 21 norm texts, version, scope, obligated party, legal basis, werking regime and reporting standard re-verified against the Logius norm, overview, Hoe werkt het, rapportage and Mededelingen pages and the Aansluitvoorwaarden, with the NCSC webapplication guidelines and the NOREA Handreiking Versie 2025 as second sources.","batch_key":"2026-09-25-km-fix-digid-aiuc","from":{"DIGID_ASSESSMENT":"2026-07-17"},"to":{"DIGID_ASSESSMENT":"2026-09-25"},"source_pr":3225,"registry_sha":"18524a43c3a7d6dfb2b28de7d38f3f98044311bd","evidence_url":"https://www.logius.nl/onze-dienstverlening/toegang/digid/ict-beveiligingsassessments-digid/documentatie/norm-ict-beveiligingsassessments-digid"},{"id":"7be8c8342f3845922d6c032a","type":"version_changed","date":"2026-09-25","framework_ids":["HIPAA"],"note":"Version string now names the current 45 CFR text (2013 Omnibus base as amended through 91 FR 14350) and the CMP amounts in 45 CFR 102.3 (91 FR 3665).","batch_key":"2026-09-25-km-fix-ccpa-hipaa","from":{"HIPAA":"2013 Omnibus Final Rule"},"to":{"HIPAA":"45 CFR Parts 160, 162, 164 (2013 Omnibus Final Rule as amended through 91 FR 14350, 2026); CMP amounts per 45 CFR 102.3 (2025 adjustment, 91 FR 3665)"},"source_pr":3226,"registry_sha":"f409117be208e34d3a2aea1ed42e2610a6cad729"},{"id":"7c7c68ce34173385f8520285","type":"verification_refreshed","date":"2026-09-25","framework_ids":["AIUC_1"],"note":"All 53 requirement IDs and titles (51 active, E007 and E014 retired) and the July 15, 2026 release re-verified against the official requirement index and changelog, with the publisher GitHub changelog (July 15 release commit) as second source.","batch_key":"2026-09-25-km-fix-digid-aiuc","from":{"AIUC_1":"2026-07-23"},"to":{"AIUC_1":"2026-09-25"},"source_pr":3225,"registry_sha":"18524a43c3a7d6dfb2b28de7d38f3f98044311bd","evidence_url":"https://standard.aiuc-1.com/llms.txt"},{"id":"7d5ca07b007391866b4b3906","type":"content_corrected","date":"2026-09-25","framework_ids":["DIGID_ASSESSMENT"],"note":"Assessment scope rewritten as our own summary instead of an English rendering of NOREA's scope definition (NOREA is a private professional body; only its standard names and numbers are kept), and the IP basis for the verbatim Logius norm texts recorded (Auteurswet art. 15b, no copyright reservation found on the Logius norm page or site).","batch_key":"2026-09-25-km-fix-digid-aiuc","source_pr":3225},{"id":"7f6db493f9240d7fb760f55f","type":"verification_refreshed","date":"2026-09-25","framework_ids":["IN_RBI_IT_CYBER"],"note":"Every retained claim re-verified on rbi.org.in: press release 2026-2027/787, repeal circular RBI/DoS/2026-27/221, the seven entity-wise cyber Directions, the DoS and DoR withdrawn-circular lists, the 2025 outsourcing Directions and the 2018 payment data storage directive.","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","from":{"IN_RBI_IT_CYBER":"2026-07-15"},"to":{"IN_RBI_IT_CYBER":"2026-09-25"},"source_pr":3221,"registry_sha":"081198802bd1d317ba010c8a677f046327199cb2","evidence_url":"https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=13643"},{"id":"7f94684edf4f6aa12de0d6a4","type":"content_corrected","date":"2026-09-25","framework_ids":["JP_METI_CYBERSECURITY_MGMT"],"note":"IPA English name since 2026-06-05 is Innovation Platform Agency, Japan (Japanese name and abbreviation unchanged); Appendix D mapping stated precisely (ISO/IEC 27001:2022, 27002:2022, NIST CSF Version 1.1, CIS Controls Version 8); the three principles now carry their verbatim official headings instead of paraphrased labels; Japanese and English publication dates added. lastVerified unchanged: meti.go.jp served a WAF challenge on 2026-09-25.","batch_key":"2026-09-25-km-fix-jp-jis-meti","source_pr":3214,"registry_sha":"a5c992a70e55204ab3f6c271acfd72d3b5647aea","evidence_url":"https://www.ipa.go.jp/pressrelease/2026/press20260605-2.html"},{"id":"84e199c5cde3e6dc4e8fd696","type":"content_corrected","date":"2026-09-25","framework_ids":["UK_GDPR","UK_DPA_2018","UK_DUA_2025"],"note":"Regulator transition: from 30 September 2026 the Information Commission replaces the Information Commissioner (DUA 2025 ss. 118-119 commenced by S.I. 2026/1015 reg. 2; wording substituted by S.I. 2026/386 Sch. 2 para. 23 and Sch. 3 para. 41), still known as the ICO; UK_DUA_2025 commencement status and official Part 1-8 and Schedule titles updated.","batch_key":"2026-09-25-km-uk-ico-commission","evidence_url":"https://www.legislation.gov.uk/uksi/2026/1015/made","source_pr":3185,"registry_sha":"b0d4c5a98a53a265def4e62209c3596292129618"},{"id":"851589435ccdc1c5958f5d29","type":"content_corrected","date":"2026-09-25","framework_ids":["UK_NIS_2018"],"note":"NIS Regulations 2018 knowledge line-audited against the legislation.gov.uk revised text: reg. 19 marked omitted since 31 December 2020 (S.I. 2020/1245), reg. A20 corrected and reordered, reg. 8A and 14A and Part titles made exact, Schedule 1 competent authorities corrected (joint Secretary of State roles for electricity, gas and aviation, health England only, Information Commissioner for RDSPs), S.I. 2026/386 described as the Information Commission rename only, operative rules (72-hour clocks, penalty caps) and pending changes (S.I. 2026/230, CS&R Bill at Lords report stage) added.","source_pr":3165,"registry_sha":"04ddd433820479b2858a133053899c6611a80dea"},{"id":"85ef0fdbd74ed22bf6e6d3e1","type":"content_corrected","date":"2026-09-25","framework_ids":["NASA_STD_1006"],"note":"NASA-STD-1006A: responsible organisation is the Office of the Chief Engineer (MRPP is the support programme); suggested SSPR 1 tailoring, interference reporting route, training cadence, CUI category and precedence rules summarised from the approved PDF; CCSDS 232.1-B-2 title variants recorded.","source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://standards.nasa.gov/sites/default/files/standards/NASA/A/0/2022-07-15-NASA-STD-1006A-Approved.pdf"},{"id":"8606a0e866e2421d35adef82","type":"verification_refreshed","date":"2026-09-25","framework_ids":["IN_DPDPA"],"note":"Section titles, Schedule, commencement phases and Rules re-verified against the Act (MeitY Gazette copy), G.S.R. 843(E) to 846(E) and corrigendum G.S.R. 892(E); RBI repeal circular, RBI withdrawn list, SEBI 2025/119 and the CERT-In Directions checked for the cross-references.","batch_key":"2026-09-25-km-fix-in-dpdpa-irdai","from":{"IN_DPDPA":"2026-07-15"},"to":{"IN_DPDPA":"2026-09-25"},"source_pr":3229,"registry_sha":"d67f6b528ec1405bb399a951eca3cba790bdf058","evidence_url":"https://egazette.gov.in/WriteReadData/2025/267650.pdf"},{"id":"88e24862e0831b293c38f72f","type":"version_changed","date":"2026-09-25","framework_ids":["UN_R155"],"note":"Version label now names the current UN R155 text: original version up to Supplement 3 (in force 10 January 2025), as published in OJ L 2025/5; companion UN R156 unchanged.","batch_key":"2026-09-25-km-backfill-d-automotive","from":{"UN_R155":"UN R155 (2021) + companion UN R156 (SUMS)"},"to":{"UN_R155":"UN R155 original version up to Supplement 3 (in force 10 January 2025) + companion UN R156 (SUMS)"},"source_pr":3190,"registry_sha":"99254aa4fc3a7f476f1cb0a8f2eb50af4a203b17","evidence_url":"https://eur-lex.europa.eu/eli/reg/2025/5/oj/eng"},{"id":"895894ba63b33215b7acf671","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_PL"],"note":"Poland: UKSC now cited as t.j. Dz.U. 2026 poz. 20 as amended by poz. 252, 815 and 1003; CER act changes (4 July 2026), Art. 26 ust. 3 pkt 24 (28 October 2026), Annex 1 change (11 January 2027) and the six-month transitional marks added.","from":{"NIS_2_PL":"Ustawa z dnia 5 lipca 2018 r. o KSC, ze zmianami wprowadzonymi ustawą z dnia 23 stycznia 2026 r. (Dz.U. 2026 poz. 252)"},"to":{"NIS_2_PL":"Ustawa z dnia 5 lipca 2018 r. o KSC (t.j. Dz.U. 2026 poz. 20, ze zm. poz. 252, 815, 1003)"},"source_pr":3218,"registry_sha":"764192b70e7ae9cffb4caf0401556118709d95d2"},{"id":"89b585f0698db1ea3bcc302f","type":"verification_refreshed","date":"2026-09-25","framework_ids":["ENS"],"note":"Full content re-verification of all 41 article titles, 73 Annex II measures, Annex I and III and the conformity, audit and role provisions against the BOE consolidated text of RD 311/2022; the BOE open-data API lists RD 1125/2024 as the only amendment.","batch_key":"2026-09-25-km-backfill-a","from":{"ENS":"2026-09-13"},"to":{"ENS":"2026-09-25"},"evidence_url":"https://www.boe.es/buscar/act.php?id=BOE-A-2022-7191","source_pr":3174,"registry_sha":"02e445c40caf706693f62fc2592a76f955abde80"},{"id":"8a20c9fb029ff5d9f248ab95","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_DE"],"note":"Version label now follows the official Vollzitat: BSIG last amended by Art. 8 Abs. 1 G v. 23.07.2026 (BGBl. 2026 I Nr. 226); Art. 9 G v. 21.07.2026 (BGBl. 2026 I Nr. 221) also amended it.","batch_key":"2026-09-25-km-fix-nis2-de-pt","from":{"NIS_2_DE":"BGBl. 2025 I Nr. 301 (zuletzt geändert Art. 4 G. v. 11.03.2026, BGBl. 2026 I Nr. 66)"},"to":{"NIS_2_DE":"BGBl. 2025 I Nr. 301 (zuletzt geändert durch Art. 8 Abs. 1 G v. 23.07.2026, BGBl. 2026 I Nr. 226)"},"source_pr":3211,"registry_sha":"788352470a204ecb5894e4d6c6106a5f1059d5b1","evidence_url":"https://www.gesetze-im-internet.de/bsig_2025/BJNR12D0B0025.html"},{"id":"8b146b0d4fafd02888896b42","type":"content_corrected","date":"2026-09-25","framework_ids":["NIST_800_82"],"note":"Rev. 4 status updated: the initial public draft was published 21 September 2026 (comments due 30 November 2026), obsoleting the January 2026 pre-draft; added Appendix D.5, the Rev. 3 potential-updates item, the FISMA authority and voluntary-use statement, the CSF 1.1 selectivity note and the overlay citation name; the F.3 Table 22 description now matches the text (baseline allocation with OT discussion, additions and removals; privacy-only controls excluded).","batch_key":"2026-09-25-km-backfill-d-ot","source_pr":3184,"registry_sha":"a04c0d9ccc1af659689204ebb79a1b08c251800e","evidence_url":"https://csrc.nist.gov/pubs/sp/800/82/r4/ipd"},{"id":"8faf90da8666d976fb86defd","type":"verification_refreshed","date":"2026-09-25","framework_ids":["FEDRAMP"],"note":"FedRAMP content rebuilt on the Consolidated Rules for 2026 in #3145 now has a clean final reviewer verdict (interim merge gate, codex quota until 2026-09-30); lastVerified moves from the carried-forward 2026-07-01.","batch_key":"2026-09-25-km-us-part2-1109-fedramp","from":{"FEDRAMP":"2026-07-01"},"to":{"FEDRAMP":"2026-09-25"},"evidence_url":"https://www.fedramp.gov/2026/","source_pr":3149,"registry_sha":"4b5435faff36ca90fae58180691d77b142b981c1"},{"id":"900f7c37a42fddc619351399","type":"verification_refreshed","date":"2026-09-25","framework_ids":["CA_PIPEDA"],"note":"Every section row, the Schedule 1 principles, scope and legislative status re-verified against the Justice Laws consolidation current to 2026-09-03, with S.C. 2026, c. 3 and the LEGISinfo records and first-reading text of Bills C-36 and C-27 as second authoritative sources.","batch_key":"2026-09-25-km-fix-ca-privacy","from":{"CA_PIPEDA":"2026-05-11"},"to":{"CA_PIPEDA":"2026-09-25"},"source_pr":3222,"registry_sha":"8dd68ce7ac7cd6aeab6a12031dd03302b4410427","evidence_url":"https://laws-lois.justice.gc.ca/eng/acts/P-8.6/FullText.html"},{"id":"90c6e4524bb27050ede6e086","type":"verification_refreshed","date":"2026-09-25","framework_ids":["ISO_27000"],"note":"ISO/IEC 27000:2026 edition, status and all remaining titles re-verified against ISO Open Data (iso_deliverables_metadata, ODC-By v1.0).","from":{"ISO_27000":"2026-07-06"},"to":{"ISO_27000":"2026-09-25"},"source_pr":3213,"registry_sha":"566c10fc3616dc8275fb937acdd5614c577982c4","evidence_url":"https://isopublicstorageprod.blob.core.windows.net/opendata/_latest/iso_deliverables_metadata/json/iso_deliverables_metadata.jsonl"},{"id":"90fe3facda2b059ec48f5f51","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_MT"],"note":"Every claim re-verified against the consolidated S.L. 460.41 (point in time 7 April 2026) and the LN 71/2025 and LN 89/2026 texts on legislation.mt; European Commission NIS2 page as second source.","batch_key":"2026-09-25-km-fix-nis2-fi-hu-mt","from":{"NIS_2_MT":"2026-05-05"},"to":{"NIS_2_MT":"2026-09-25"},"source_pr":3219,"registry_sha":"c9139bf4022d88bc0b771fc3eaafcc4c07a1becf","evidence_url":"https://legislation.mt/eli/sl/460.41/eng"},{"id":"91100fccb74039deed5bab97","type":"version_changed","date":"2026-09-25","framework_ids":["IN_RBI_IT_CYBER"],"note":"RBI repealed the IT Governance Master Direction RBI/2023-24/107 on 31 July 2026 (circular RBI/DoS/2026-27/221); the module now covers the entity-wise Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026.","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","from":{"IN_RBI_IT_CYBER":"RBI/2023-24/107 dated 2023-11-07, effective 2024-04-01"},"to":{"IN_RBI_IT_CYBER":"RBI (Commercial Banks and sibling entity-wise) Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, dated 2026-07-31, in force on issue"},"source_pr":3221,"registry_sha":"081198802bd1d317ba010c8a677f046327199cb2","evidence_url":"https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=13643"},{"id":"93d84d598b507a2eebb2a99f","type":"content_corrected","date":"2026-09-25","framework_ids":["CH_FADP"],"note":"Swiss FADP knowledge line-audited against the Fedlex consolidation of SR 235.1 (7 July 2025) and the DPO SR 235.11 (1 December 2025): Art. 59, 60 and 67 headings corrected, invented FDPIC publication power removed and Art. 51 measures listed, fines cited to Arts. 60-63, Art. 16(2) transfer list and FDPIC SCC recognition corrected, Convention 108+ status, EU adequacy review date, ISG Arts. 74a-74h reporting and amendment history corrected or added, unverified cantonal citations removed. lastVerified is unchanged (reviewer cap reached before a clean final round).","source_pr":3174,"registry_sha":"02e445c40caf706693f62fc2592a76f955abde80"},{"id":"9400e329bd255175dcdd99ae","type":"version_changed","date":"2026-09-25","framework_ids":["AU_ISM"],"note":"AU_ISM re-based from the June 2026 ISM (OSCAL v2026.06.18) to the September 2026 release (OSCAL v2026.09.4): 23 guideline chapters, 71 sections, 1,143 controls, new chapter Guidelines for system access.","batch_key":"2026-09-25-km-backfill-b","from":{"AU_ISM":"OSCAL catalog v2026.06.18 (June 2026 release)"},"to":{"AU_ISM":"September 2026 release (OSCAL catalog v2026.09.4)"},"source_pr":3168,"registry_sha":"fcc9b9335c72773b89b15774395021c62eb58ea6","evidence_url":"https://github.com/AustralianCyberSecurityCentre/ism-oscal/releases/tag/v2026.09.4"},{"id":"94089dc6def7ec65b2679311","type":"version_changed","date":"2026-09-25","framework_ids":["NZ_PRIVACY_ACT_2020"],"note":"Version string now names the verified reprint (version as at 1 May 2026).","batch_key":"2026-09-25-km-backfill-b-nz","from":{"NZ_PRIVACY_ACT_2020":"Public Act 2020 No 31 (principal provisions in force 1 December 2020, ss 32-38 and 213-215 from 1 July 2020; IPP 3A in force 1 May 2026)"},"to":{"NZ_PRIVACY_ACT_2020":"Public Act 2020 No 31, version as at 1 May 2026 (principal provisions in force 1 December 2020, ss 32-38 and 213-215 from 1 July 2020; IPP 3A in force 1 May 2026)"},"source_pr":3164,"registry_sha":"178f7a4b5a1d3ca0f2f46f3d04662d215fe2cca8"},{"id":"946352c8b24e06c82a5c7250","type":"verification_refreshed","date":"2026-09-25","framework_ids":["EASA_PART_IS"],"note":"Legacy evidence backfill (K5): every row re-verified against the Official Journal and consolidated texts from the Publications Office, with the EASA Easy Access Rules (December 2025) as second authoritative source; no newer amendment or consolidation found.","batch_key":"2026-09-25-km-backfill-c","from":{"EASA_PART_IS":"2026-09-06"},"to":{"EASA_PART_IS":"2026-09-25"},"evidence_url":"https://eur-lex.europa.eu/eli/reg_impl/2023/203/2026-02-22/eng","source_pr":3167,"registry_sha":"1c4e4a5d0f8086d548242953e355ee115dfa5ca1"},{"id":"95db70dec24d419455f1954d","type":"content_corrected","date":"2026-09-25","framework_ids":["CYBER_ESSENTIALS"],"note":"Cyber Essentials knowledge line-audited against the NCSC Requirements for IT Infrastructure v3.3 and the CE+ Test Specification v3.2: control themes retitled and reordered to v3.3, Certification Body terminology, CE+ test cases (MFA check added, unsourced configuration test removed), scope rules rebuilt from v3.3 section D (BYOD, cloud, end-user devices, sub-sets), April 2026 scheme changes, 12-month validity and stale MoD and central government procurement rows (CSM v4, Def Stan 05-138 Issue 4, PPN 014) corrected; OGL v3.0 attribution added.","source_pr":3165,"registry_sha":"04ddd433820479b2858a133053899c6611a80dea"},{"id":"97e9aa9c36aa0756318c7d48","type":"verification_refreshed","date":"2026-09-25","framework_ids":["BDSG"],"note":"All § titles, scope, supervisory, DPO, fine and pending-amendment claims re-verified against the consolidated BDSG (Vollzitat BGBl. 2026 I Nr. 199) with BGBl. 2026 I Nr. 139 and Nr. 199 on recht.bund.de as second authoritative sources.","batch_key":"2026-09-25-km-fix-bdsg-gdpr","from":{"BDSG":"2026-07-15"},"to":{"BDSG":"2026-09-25"},"source_pr":3228,"registry_sha":"f1cd8653da2a7c61fcd170b19b5b3d739954226c","evidence_url":"https://www.gesetze-im-internet.de/bdsg_2018/"},{"id":"98653b68bec3396ccdaffd07","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_CY"],"note":"Cyprus: added DSA Decision K.D.P. 281/2026 (incident notification, in force 3 July 2026, repeals K.D.P. 39/2022), verified article anchors, trust-service-provider 24-hour rule, contact-person duty, and the EU transposition status after the Commission referrals of 8 July 2026.","source_pr":3215,"registry_sha":"68ac8060fc8d18d650ad2c02d299b2a20b1937b6"},{"id":"9c1ae263b848ce38bd280727","type":"content_corrected","date":"2026-09-25","framework_ids":["AU_WA_CSP"],"note":"WA Cyber Security Policy: the timed duties table and the Premier's Circular 2025/13 measures list added by #3169 are removed under the founder IP decision of 2026-09-25, because they paraphrased the Policy's obligations; clause IDs, official headings, date facts and lastVerified are unchanged.","batch_key":"2026-09-25-ip-decisions-modules","source_pr":3182,"registry_sha":"957f50e7541b301afd1714607b403fa92ff99303","evidence_url":"https://www.wa.gov.au/terms-of-use"},{"id":"9c8ca2ad8c718c1e80b84a5a","type":"content_corrected","date":"2026-09-25","framework_ids":["CA_QC_LAW_25"],"note":"Status note added: the CAI 2026 quinquennial report was tabled in the National Assembly on 11 June 2026, and the Assembly was dissolved on 27 August 2026 (43rd legislature ended, general election 5 October 2026). Statute text not re-read; lastVerified unchanged.","batch_key":"2026-09-25-km-fix-ca-privacy","source_pr":3222,"registry_sha":"8dd68ce7ac7cd6aeab6a12031dd03302b4410427","evidence_url":"https://www.cai.gouv.qc.ca/actualites/publication-du-rapport-quinquennal-2026-de-la-commission"},{"id":"9d551de53b5ecae396637696","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_LV"],"note":"Latvia: NKDL now cited as amended by the law of 04.06.2026 (Latvijas Vestnesis Nr. 115, in force 18.06.2026); Art. 20 point 11 expansion from 01.10.2026, auditor transition until 01.12.2026, incident reports to CERT.LV corrected.","from":{"NIS_2_LV":"Nacionālās kiberdrošības likums (2024)"},"to":{"NIS_2_LV":"Nacionālās kiberdrošības likums (2024), ar grozījumiem, kas izdarīti ar 04.06.2026. likumu (LV Nr. 115, 17.06.2026.)"},"source_pr":3215,"registry_sha":"68ac8060fc8d18d650ad2c02d299b2a20b1937b6"},{"id":"a01a76721a875f34b4fbc75d","type":"content_corrected","date":"2026-09-25","framework_ids":["EASA_PART_IS"],"note":"Part-IS re-verified against the consolidated texts of Regulations (EU) 2023/203 (22 February 2026) and 2022/1645 (16 October 2025): Delegated Regulation (EU) 2025/22 ground handling extension (27 March 2031) and declaring-organisation exemptions added, NIS equivalence restated on the article text with NIS 2 Article 4 and recital 29, Article 2 exclusions, Article 6(2) and Article 7, key clocks and retention periods, IS.D.OR design-organisation signatory, 2019/1583 dates per 2020/910, incident point titles aligned to the Annex body headings.","evidence_url":"https://eur-lex.europa.eu/eli/reg_impl/2023/203/2026-02-22/eng","source_pr":3167,"registry_sha":"1c4e4a5d0f8086d548242953e355ee115dfa5ca1"},{"id":"a2331b2ce87d35fd02ddfecb","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_PT"],"note":"Every row re-verified against the DL 125/2025 and RJC text and the Análise Jurídica tabs on diariodarepublica.pt (no amendment of the DL; one implementing act) and the Regulamento n.º 756/2026 PDF; cncs.gov.pt is bot-walled and was not used.","batch_key":"2026-09-25-km-fix-nis2-de-pt","from":{"NIS_2_PT":"2026-05-05"},"to":{"NIS_2_PT":"2026-09-25"},"source_pr":3211,"registry_sha":"788352470a204ecb5894e4d6c6106a5f1059d5b1","evidence_url":"https://diariodarepublica.pt/dr/detalhe/decreto-lei/125-2025-962603401"},{"id":"a24e26a5736f051b6e0600f5","type":"content_corrected","date":"2026-09-25","framework_ids":["CRA"],"note":"Legacy evidence backfill (K5): Annex III class I point 1 now uses the statutory name (identity management systems and privileged access management software and hardware); Art. 64(10)(a) states the fine carve-out covers paragraphs 2 to 9 as corrected by OJ L 2025/90555; added the Art. 26 Commission guidance C(2026) 5252 of 27 July 2026 and the Art. 27(1) standardisation request M/606 (C(2025) 618); clarified the Art. 4, 17(2), 19(2) and Annex I Part II (1) rows against the OJ text.","batch_key":"2026-09-25-km-backfill-d-other","source_pr":3188,"registry_sha":"ee95ba1a01e5a963416794b491dcfc79c25130aa","evidence_url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng"},{"id":"a328324c8cfab64508143d24","type":"content_corrected","date":"2026-09-25","framework_ids":["IE_DPA_2018"],"note":"Three rows narrowed to the Revised Act text: s. 48 political-opinion processing is limited to electoral activities in the State to compile data on political opinions; s. 60(3)(b) confidential opinions are a separate limb with no necessity and proportionality test; the Art. 9 conditions row cites ss. 45-54, since s. 55 is the Art. 10 criminal-data provision.","batch_key":"2026-09-25-km-ie-dpa-confirm","source_pr":3208,"registry_sha":"67907dac76e6564a90fed5b8d5ab396fe2fed48e"},{"id":"a501a075eb881b77d487ba91","type":"verification_refreshed","date":"2026-09-25","framework_ids":["BE_DPA_2018"],"note":"Re-verified against the JUSTEL FR and NL consolidations (updated to 2 April 2026) and the Loi du 30 mars 2026: Titre 6 criminal penalties, Art. 230 repeal, Art. 7 age 13, article count and the APD organic law (Art. 7 organs, Art. 88 amended).","batch_key":"2026-09-25-km-fix-be-bsi-sg","from":{"BE_DPA_2018":"2026-07-17"},"to":{"BE_DPA_2018":"2026-09-25"},"source_pr":3220,"registry_sha":"93a5a39a4fdca2191805c6cf75460760cd433be4","evidence_url":"https://www.ejustice.just.fgov.be/eli/loi/2018/07/30/2018040581/justel"},{"id":"a57b7f94ade641c47933af1e","type":"version_changed","date":"2026-09-25","framework_ids":["DIGID_ASSESSMENT"],"note":"Version label now says the norm is adopted by BZK and published by Logius, as the Logius norm page and the Aansluitvoorwaarden state.","batch_key":"2026-09-25-km-fix-digid-aiuc","from":{"DIGID_ASSESSMENT":"Normenkader 3.0 (1 augustus 2022) — gepubliceerd door Logius / MinBZK"},"to":{"DIGID_ASSESSMENT":"Normenkader 3.0 (1 augustus 2022), vastgesteld door BZK, gepubliceerd door Logius"},"source_pr":3225,"registry_sha":"18524a43c3a7d6dfb2b28de7d38f3f98044311bd","evidence_url":"https://www.logius.nl/onze-dienstverlening/toegang/digid/ict-beveiligingsassessments-digid/documentatie/norm-ict-beveiligingsassessments-digid"},{"id":"a597a787cb80b14d9d71104e","type":"content_corrected","date":"2026-09-25","framework_ids":["CA_OSFI_B13"],"note":"OSFI Guideline B-13 structure note corrected: heading 3.0 (Confidentiality, integrity and availability of technology assets is maintained) is a numbered domain-level heading that follows Domain 3's separate outcome line and carries no Principle, not the outcome statement itself; it is now named in the directives and is still not a table row; rows, dates and lastVerified are unchanged.","batch_key":"2026-09-25-ip-osfi-b13","source_pr":3224},{"id":"a62a3f6ff72e308138321923","type":"verification_refreshed","date":"2026-09-25","framework_ids":["BSI_GRUNDSCHUTZ"],"note":"Re-verified Edition 2023 status, errata (Stand 26.03.2026), all 111 Baustein IDs and titles against the BSI Edition 2023 Bausteine page, BSI-Standards 200-1 to 200-4, Testat validity, the Grundschutz++ milestone plan and the BaFin BAIT letter of 19.12.2024.","batch_key":"2026-09-25-km-fix-be-bsi-sg","from":{"BSI_GRUNDSCHUTZ":"2026-08-08"},"to":{"BSI_GRUNDSCHUTZ":"2026-09-25"},"source_pr":3220,"registry_sha":"93a5a39a4fdca2191805c6cf75460760cd433be4","evidence_url":"https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/IT-Grundschutz/IT-Grundschutz-Kompendium/it-grundschutz-kompendium_node.html"},{"id":"a695904fbb5b6d9174e9ae16","type":"content_corrected","date":"2026-09-25","framework_ids":["DIGID_ASSESSMENT"],"note":"Assessment scope reduced to a one-line pointer in our own words, with the NOREA scope definition (in and out of scope) routed to the Logius page instead of itemised, because the earlier exclusion and subsystem sentence tracked NOREA's text; added the Logius statement that all applications behind a connection are in scope and the report is per connection. Header records the 2026-09-29 re-check of the Auteurswet art. 15b basis and art. 11 as a supporting ground.","batch_key":"2026-09-25-km-fix-digid-aiuc","source_pr":3225},{"id":"a6b29f4eaa1a6c8c82e890c8","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIST_800_82"],"note":"Legacy evidence backfill (K5): every row re-verified against the NIST SP 800-82r3 PDF (table of contents, Section 6, Appendix F, Appendix G) with the CSRC publication page, document history and potential-updates list as second authoritative source; Rev. 3 remains the current final publication.","batch_key":"2026-09-25-km-backfill-d-ot","from":{"NIST_800_82":"2026-09-08"},"to":{"NIST_800_82":"2026-09-25"},"source_pr":3184,"registry_sha":"a04c0d9ccc1af659689204ebb79a1b08c251800e","evidence_url":"https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf"},{"id":"a98763583bd3f80f8d2e4013","type":"content_corrected","date":"2026-09-25","framework_ids":["IN_RBI_IT_CYBER"],"note":"Rewritten for the 31 July 2026 DoS consolidation: seven entity-wise cyber Directions with references, 6-hour DAKSH reporting paragraphs, NBFC scope for all layers by chapter, Commercial Banks chapter and section arrangement; the 2023 IT Governance MD, 2016 bank cyber framework and 2021 digital payment security MD marked repealed (31 July 2026) and the 2023 IT outsourcing MD repealed (28 November 2025, replaced by the Managing Risks in Outsourcing Directions, 2025); KYC reference updated.","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","source_pr":3221,"registry_sha":"081198802bd1d317ba010c8a677f046327199cb2","evidence_url":"https://rbi.org.in/scripts/NotificationUser.aspx?Id=13663&Mode=0"},{"id":"abf4f1e0f072845d9d1aa64a","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_PT"],"note":"Regulamento CNCS n.º 756/2026 (DR 2.ª série n.º 118, 22.06.2026, in force 23.06.2026) recorded as the Art. 10.º n.º 2 implementing act, so the deferred RJC provisions take effect 24 months after 22.06.2026; chapter structure, Art. 27.º (9 areas), Art. 25.º, Arts. 40.º-44.º (incl. 2-hour rule), Art. 62.º-63.º fines, Art. 66.º n.º 5 warning and DORA/eIDAS coordination corrected against the RJC text.","batch_key":"2026-09-25-km-fix-nis2-de-pt","source_pr":3211,"registry_sha":"788352470a204ecb5894e4d6c6106a5f1059d5b1","evidence_url":"https://diariodarepublica.pt/dr/detalhe/regulamento/756-2026-1134399056"},{"id":"acbcd69cf729ebf14741f580","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_CZ"],"note":"Every row re-verified against the full e-Sbírka open-data text of Act 264/2025 Sb. (latest version 2025-11-01, no amendment), with CSIRT.CZ for the Národní CERT operator.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","from":{"NIS_2_CZ":"2026-05-05"},"to":{"NIS_2_CZ":"2026-09-25"},"source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7","evidence_url":"https://e-sbirka.gov.cz/sb/2025/264"},{"id":"acf66377b7988bc795d9b4ed","type":"content_corrected","date":"2026-09-25","framework_ids":["JP_JIS_Q_27001"],"note":"JIS Q 27001 alias re-verified against ISMS-AC, METI and JIPDEC: JIS Q 27002:2024 replaces the wrong 2023 label; JIS Q 27001:2025 described as Amendment 1 applied with JIS Q 27001:2023; certification criterion stated as ISMS-AC words it (JIS Q 27001 (ISO/IEC 27001)) instead of an unsourced claim that certificates are issued against the JIS number; editions table with official titles and dates; ISO edition metadata from ISO Open Data with ODC-By attribution.","batch_key":"2026-09-25-km-fix-jp-jis-meti","source_pr":3214,"registry_sha":"a5c992a70e55204ab3f6c271acfd72d3b5647aea","evidence_url":"https://isms.jp/isms/about.html"},{"id":"ad0842305343fd0dabb5f0ef","type":"verification_refreshed","date":"2026-09-25","framework_ids":["EN_18286"],"note":"EN 18286:2026 status (published, not OJEU-cited) and EU AI Act anchors re-verified against EVS, the European Commission AI Act standardisation page and the Publications Office texts of Regulations (EU) 2024/1689 and 2026/1744.","from":{"EN_18286":"2026-07-25"},"to":{"EN_18286":"2026-09-25"},"source_pr":3213,"registry_sha":"566c10fc3616dc8275fb937acdd5614c577982c4","evidence_url":"https://www.evs.ee/en/evs-en-18286-2026"},{"id":"b672df05c95b9e0e5e9bca8c","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_DK"],"note":"NIS 2-loven re-verified against LOV 434/2025, BEK 620/2025 and the L 141 remarks: incident reports go to the competent authority and the CSIRT (Forsvarets Efterretningstjeneste) via Virk.dk, not CFCS; the BEK 620 authority table replaces the invented typical list (Finanstilsynet is not designated, Energistyrelsen covers only waste incineration); energy, telecom and FIL § 333 entities are carved out by § 1, stk. 2; the EUR 10m/2% and 7m/1.4% levels are remarks-based maxima for listed offences only; sentencing follows straffeloven kap. 10, legal persons kap. 5; § 13 stk. 1 nr. 3 status report is on CSIRT request; § 20 stk. 1 names the minister.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7","evidence_url":"https://www.retsinformation.dk/eli/lta/2025/434"},{"id":"b82ef6edb2c453b84f9c6da5","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_SE","NIS_2_EE"],"note":"Full re-verification against primary sources: SE via Riksdagen open data (SFS 2025:1506 unamended, 2025:1507 up to SFS 2026:623), the Regeringskansliet SFS register, the NCSC (FRA) regulations list and MCFFS PDFs, and CERT-SE; EE via the Riigi Teataja public API (KüTS texts to 30 September 2026 and from 1 October 2026, the 2025 amending act, KORKS), the Riigikogu API for bill 897 SE, the Constitution section 108 and the CERT-EE RFC 2350.","batch_key":"2026-09-25-km-fix-nis2-se-ee","from":{"NIS_2_SE":"2026-05-05","NIS_2_EE":"2026-05-05"},"to":{"NIS_2_SE":"2026-09-25","NIS_2_EE":"2026-09-25"},"source_pr":3212,"registry_sha":"4ae0118b947a5ad6f9ad83c5efaa09606c060682","evidence_url":"https://www.riigiteataja.ee/akt/130062026131"},{"id":"bcbd65fb6cbe29d2ba4e30f6","type":"verification_refreshed","date":"2026-09-25","framework_ids":["UK_NIS_2018"],"note":"Full content re-verification against the legislation.gov.uk revised text of S.I. 2018/506 (latest amendment in force 25 May 2024) and each amending and pending instrument, with GOV.UK, ICO and the Parliament Bills API as second authoritative sources.","batch_key":"2026-09-25-km-backfill-a-uk","from":{"UK_NIS_2018":"2026-09-23"},"to":{"UK_NIS_2018":"2026-09-25"},"evidence_url":"https://www.legislation.gov.uk/uksi/2018/506/data.xml","source_pr":3165,"registry_sha":"04ddd433820479b2858a133053899c6611a80dea"},{"id":"c0497271b1baa70ffa86452e","type":"content_corrected","date":"2026-09-25","framework_ids":["CCPA"],"note":"Monetary amounts updated to the CPPA CPI adjustment effective 1 January 2025 ($26,625,000 threshold; $107 to $799 damages; $2,663 / $7,988 fines and AG penalties); s.1798.115(d), 1798.136, 1798.140(d)/(j)/(ae)/(ag), 1798.150(b) corrected; s.1798.120(a)(2), 1798.145(a)(2)(A), 1798.199.90(a), 1798.199.95(d), 1798.199.100 added; 2025 amendment chain and pending SB 923 / AB 1542 status added.","batch_key":"2026-09-25-km-fix-ccpa-hipaa","evidence_url":"https://cppa.ca.gov/regulations/cpi_adjustment.html","source_pr":3226,"registry_sha":"f409117be208e34d3a2aea1ed42e2610a6cad729"},{"id":"c7039f82c5a63d7f6c874028","type":"content_corrected","date":"2026-09-25","framework_ids":["DO_326A_ED_202A"],"note":"Airworthiness security set re-verified on catalogue metadata (K2b): publisher catalogue descriptions and scope paraphrases removed (ED-202B change summary, ED-305 description); RTCA issue dates, ER-042 (July 2026) and SC-216 projected dates added; AMC 20-42 recognition stated precisely (ED-202A Section 2.1.1 for the PISRA); ED Decision application date 1 January 2021; FAA NPRM citation, scope and status (no final rule by 25 September 2026); AC 119-1A OpSpec D301; unsupported RTCA supersession claims removed.","source_pr":3179,"registry_sha":"7361b2be91c1719a8bcb7281de5c1f94873936a6","evidence_url":"https://www.easa.europa.eu/en/document-library/agency-decisions/ed-decision-2020006r"},{"id":"c998d4359c553ca625f7d3da","type":"content_corrected","date":"2026-09-25","framework_ids":["FINMA_23_01"],"note":"FINMA 23/1 knowledge line-audited against the EN PDF (DE/FR cross-read): critical services no longer presented as a Chapter II definition (margin no. 112 only); Chapter IV index range 22-100; ordinance anchors split by addressee (BO Art. 12 banks, BO Art. 14e persons under BA Art. 1b, FinIO Arts. 12/68); category table replaced by BO Annex 3 thresholds; margin no. 114 marked spent since the revised CAO and LROV-FINMA (1 January 2025); ISG Arts. 74a-74h, FINMASA Art. 29(2) and FINMA Guidance 03/2024 reporting mechanics added; broken fedlex links for BA and BO fixed; unsourced insurer-circular claim removed.","batch_key":"2026-09-25-km-cohort-1024","evidence_url":"https://www.finma.ch/en/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf?sc_lang=en","source_pr":3147,"registry_sha":"b8bb2d3f7ae2ebfe05b956c6ebff0d7b084896fe"},{"id":"d1a46bc992ea0afc7b932279","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_AT"],"note":"NISG 2026 re-verified against the RIS consolidated text (as of 1 October 2026) and BGBl. I Nr. 94/2025: registration is three months from 1 October 2026 (§ 29 Abs. 3), not a fixed 31 December 2026; NISG 2018 Bescheide lapse on 1 October 2026 (§ 51 Abs. 5) instead of OES status continuing; both sides of 1 October 2026 described; CSIRT model, reporting to the sectoral or national CSIRT, § 45 Abs. 4 fines, district-authority enforcement, § 39 measures and outdated eIDAS reporting claim corrected.","batch_key":"2026-09-25-km-fix-nis2-at-bg","source_pr":3217,"registry_sha":"708b8aa154df0999fe1c9171f3049a7a98cbc017","evidence_url":"https://ris.bka.gv.at/eli/bgbl/i/2025/94"},{"id":"d3e2c39f67ab93814486cff4","type":"verification_refreshed","date":"2026-09-25","framework_ids":["AU_NSW_CSP","AU_VIC_VPDSS","AU_WA_CSP"],"note":"Full content re-verification of every row (PR #3169) now has a clean fresh-context reviewer verdict and a clean second-reviewer verdict on the final content, so lastVerified moves from 2026-08-31.","batch_key":"2026-09-25-km-backfill-b-states","from":{"AU_NSW_CSP":"2026-08-31","AU_VIC_VPDSS":"2026-08-31","AU_WA_CSP":"2026-08-31"},"to":{"AU_NSW_CSP":"2026-09-25","AU_VIC_VPDSS":"2026-09-25","AU_WA_CSP":"2026-09-25"},"evidence_url":"https://www.digital.nsw.gov.au/delivery/cyber-security-nsw/policies","source_pr":3169,"registry_sha":"f74c79c742ee4f5c273df93daa143bacb4935bb4"},{"id":"d4069b6ea75ee26176bd88c7","type":"verification_refreshed","date":"2026-09-25","framework_ids":["AU_ISM","AU_CPS_234"],"note":"Full content re-verification of every row against the primary sources (ASD ISM OSCAL catalog v2026.09.4 and September 2026 PDF; Federal Register of Legislation F2018L01745), with cyber.gov.au and apra.gov.au as second authoritative sources.","batch_key":"2026-09-25-km-backfill-b","from":{"AU_ISM":"2026-08-25","AU_CPS_234":"2026-08-25"},"to":{"AU_ISM":"2026-09-25","AU_CPS_234":"2026-09-25"},"source_pr":3168,"registry_sha":"fcc9b9335c72773b89b15774395021c62eb58ea6","evidence_url":"https://www.legislation.gov.au/F2018L01745/asmade/text"},{"id":"d4d9767139bac63dcf92873d","type":"content_corrected","date":"2026-09-25","framework_ids":["AIUC_1"],"note":"Source URLs moved to standard.aiuc-1.com (old www.aiuc-1.com requirement URLs 308-redirect) and the launch announcement to aiuc.com/updates/introducing-aiuc-1 (the /research URL is 404); the scoping page figure of 50 requirements is noted against the 51 active requirements of the official index; controls described as core and supplemental; retirement provenance taken from the publisher GitHub changelog.","batch_key":"2026-09-25-km-fix-digid-aiuc","source_pr":3225,"registry_sha":"18524a43c3a7d6dfb2b28de7d38f3f98044311bd","evidence_url":"https://standard.aiuc-1.com/llms.txt"},{"id":"d5a3e2bc7c733c9a753cb515","type":"verification_refreshed","date":"2026-09-25","framework_ids":["CRA"],"note":"Legacy evidence backfill (K5): every row re-verified against the OJ text of Regulation (EU) 2024/2847, its English corrigenda, EHDS Art. 104-105 and Delegated Regulations 2025/1535 and 2026/881 and Implementing Regulation 2025/2392, with the Commission CRA pages and the ENISA SRP page as second authoritative source; no amendment after Regulation (EU) 2025/327.","batch_key":"2026-09-25-km-backfill-d-other","from":{"CRA":"2026-09-04"},"to":{"CRA":"2026-09-25"},"source_pr":3188,"registry_sha":"ee95ba1a01e5a963416794b491dcfc79c25130aa","evidence_url":"https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng"},{"id":"d5f88acba7ea5a4e1db3a253","type":"version_changed","date":"2026-09-25","framework_ids":["IE_DPA_2018"],"note":"Irish Data Protection Act 2018 version string now records that the Act was substantially commenced on 25 May 2018 with s. 30 still not commenced (S.I. 174/2018, 532/2019, 570/2019). Knowledge line-audited against the Law Reform Commission Revised Act and the eISB: Part 4 and chapter headings exact, Part 8 counted as 66 amended Acts, s. 15, 29, 31, 32, 58 and 59 rows corrected (s. 59 carve-out limited to parties and candidates or office-holders), s. 43, 48, 60 (S.I. 610/2024), 117 and the Representative Actions Act added, unverified one-stop-shop examples and NIS 2 bill claim removed. lastVerified is unchanged (reviewer cap reached before a clean final round).","from":{"IE_DPA_2018":"Number 7 of 2018, in force 2018-05-25"},"to":{"IE_DPA_2018":"Number 7 of 2018, substantially commenced 2018-05-25 (s. 30 not commenced)"},"source_pr":3174,"registry_sha":"02e445c40caf706693f62fc2592a76f955abde80"},{"id":"d7005cbbd305c1937645eb33","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_BG"],"note":"Every row re-verified against the State Gazette texts (ДВ бр. 17/2026 ЗИД на ЗКС, original ДВ бр. 94/2018, ДВ бр. 43/2026, ДВ бр. 55/2026 § 73), with CERT Bulgaria (govcert.bg) for the national CSIRT; no ЗКС amendment after ДВ бр. 55/2026 found.","batch_key":"2026-09-25-km-fix-nis2-at-bg","from":{"NIS_2_BG":"2026-05-05"},"to":{"NIS_2_BG":"2026-09-25"},"source_pr":3217,"registry_sha":"708b8aa154df0999fe1c9171f3049a7a98cbc017","evidence_url":"https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234"},{"id":"d73c685df028ee79987c9cbc","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_AT"],"note":"Every row re-verified against the RIS OGD consolidated NISG 2026 and NISG 2018, with the authentic BGBl. I Nr. 94/2025 PDF as second authoritative source; no amendment to NISG 2026 and no NISG 2026 Verordnung as of 2026-09-25.","batch_key":"2026-09-25-km-fix-nis2-at-bg","from":{"NIS_2_AT":"2026-05-05"},"to":{"NIS_2_AT":"2026-09-25"},"source_pr":3217,"registry_sha":"708b8aa154df0999fe1c9171f3049a7a98cbc017","evidence_url":"https://ris.bka.gv.at/eli/bgbl/i/2025/94"},{"id":"d898c6eacc4842809d1331c4","type":"verification_refreshed","date":"2026-09-25","framework_ids":["HIPAA"],"note":"Every row re-verified against the eCFR Title 45 XML from govinfo bulk data (amended through 10 Aug 2026), with the Federal Register documents and govinfo court opinions as second authoritative sources.","batch_key":"2026-09-25-km-fix-ccpa-hipaa","from":{"HIPAA":"2026-07-09"},"to":{"HIPAA":"2026-09-25"},"evidence_url":"https://www.govinfo.gov/bulkdata/ECFR/title-45/ECFR-title45.xml","source_pr":3226,"registry_sha":"f409117be208e34d3a2aea1ed42e2610a6cad729"},{"id":"d916fa1f4889403a7058e3b0","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_SK"],"note":"Every row re-verified against the Slov-Lex consolidated version of 69/2018 from 30.04.2026, its history index and the texts of 366/2024, 318/2025, 67/2026 and decrees 226/2025, 227/2025, 111/2026, 212/2026 and 493/2022.","batch_key":"2026-09-25-km-fix-nis2-ro-sk","from":{"NIS_2_SK":"2026-05-05"},"to":{"NIS_2_SK":"2026-09-25"},"source_pr":3216,"registry_sha":"e32b69a9d135e83b54a2869ee84862b238e6c2a4","evidence_url":"https://static.slov-lex.sk/static/SK/ZZ/2018/69/20260430.html"},{"id":"d9e2730d0b4f5c478afa8fdc","type":"content_corrected","date":"2026-09-25","framework_ids":["DIGID_ASSESSMENT"],"note":"Eleven norm texts aligned verbatim to the Logius Normenkader 3.0 page (B.01, B.05, U/TV.01, U/WA.03, U/WA.05, U/PW.03, U/NW.04, U/NW.05, U/NW.06, C.03, C.08); obligated party is every DigiD dienstverlener with an active connection; scope per the NOREA text quoted by Logius; legal basis is Aansluitvoorwaarden DigiD en DigiD Machtigen art. 5.5, 5.6 and 5.10 (TVS 1.22 and 1.23); reporting standard is NOREA Richtlijn 3000D (3000A attest route for ENSIA municipalities ends after the 2026 period), not ISAE; NCSC domain labels; BSNk PP is the BSN-koppelregister polymorfe pseudoniemen; Logius URLs updated.","batch_key":"2026-09-25-km-fix-digid-aiuc","source_pr":3225,"registry_sha":"18524a43c3a7d6dfb2b28de7d38f3f98044311bd","evidence_url":"https://www.logius.nl/onze-dienstverlening/toegang/digid/ict-beveiligingsassessments-digid/documentatie/norm-ict-beveiligingsassessments-digid"},{"id":"da5b5841c875543fc3fb31dc","type":"content_corrected","date":"2026-09-25","framework_ids":["IN_CERT_IN"],"note":"IT Act s. 70B(7) fine ceiling corrected from one lakh to one crore rupees (Jan Vishwas (Amendment of Provisions) Act, 2023, Schedule serial 32 clause (I), in force 30 November 2023 by S.O. 4745(E)); RBI and SEBI parallel-reporting notes updated to the 2026 DAKSH and FIRE-portal channels; DPDP dates deferred to the IN_DPDPA module; KYC 2016 reference annotated.","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","source_pr":3221,"registry_sha":"081198802bd1d317ba010c8a677f046327199cb2","evidence_url":"https://www.meity.gov.in/static/uploads/2024/03/Gazette-Notification-No.-248047-dated-11-August-2023-The-Jan-Vishwas-Amendment-of-Provisions-Act-2023.pdf"},{"id":"de7bb8691853e3fda63c56ab","type":"verification_refreshed","date":"2026-09-25","framework_ids":["CCSDS_SECURITY"],"note":"Legacy evidence backfill (K5): all 17 books re-verified against the ccsds.org catalogue rows and each PDF cover and document-control page.","batch_key":"2026-09-25-km-backfill-c","from":{"CCSDS_SECURITY":"2026-09-06"},"to":{"CCSDS_SECURITY":"2026-09-25"},"source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://ccsds.org/publications/allpubs/"},{"id":"df928fbf63b7ee18ff1a789d","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_GR"],"note":"Version label now includes Law 5256/2025 (ΦΕΚ Α 223/08.12.2025), whose arts 30-31 amend Law 5160/2024 (higher-education carve-out, errata in arts 24 and 26).","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","from":{"NIS_2_GR":"Ν. 5160/2024, ΦΕΚ Α' 195/27.11.2024"},"to":{"NIS_2_GR":"Ν. 5160/2024, ΦΕΚ Α' 195/27.11.2024 (τροπ. Ν. 5256/2025, ΦΕΚ Α' 223/08.12.2025)"},"source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7"},{"id":"e3c1027b3a47dce2fe70a8d4","type":"metadata_changed","date":"2026-09-25","framework_ids":["AU_WA_CSP"],"note":"WA Cyber Security Policy relabelled from public-law to copyrighted, holder State of Western Australia (Crown copyright), per the founder IP decision of 2026-09-25: the wa.gov.au terms license non-commercial use only and the policy is not legislation; content stays clause IDs and official headings, with an attribution line added.","batch_key":"2026-09-25-ip-decisions-modules","from":{"AU_WA_CSP":"public-law"},"to":{"AU_WA_CSP":"copyrighted"},"evidence_url":"https://www.wa.gov.au/terms-of-use","source_pr":3182,"registry_sha":"ee77137cd6ad400f1a6e0806a35ad7380bbaf712"},{"id":"e4849ae4d831c0170f02dca2","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NASA_STD_1006"],"note":"Legacy evidence backfill (K5): every row re-verified against the NASA-STD-1006A approved PDF and the standards.nasa.gov listing (version A, change 0, active, next review 15 July 2027).","batch_key":"2026-09-25-km-backfill-c","from":{"NASA_STD_1006":"2026-09-06"},"to":{"NASA_STD_1006":"2026-09-25"},"source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://standards.nasa.gov/standard/NASA/NASA-STD-1006"},{"id":"e484a6979d9b132977b26496","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_BE"],"note":"Full content re-verification against the Justel consolidated law (FR/NL, to 19 January 2026), the Royal Decree of 9 June 2024 and the CER law of 19 December 2025, with the CCB NIS2 pages as second authoritative source.","batch_key":"2026-09-25-km-cohort-1024","from":{"NIS_2_BE":"2026-06-15"},"to":{"NIS_2_BE":"2026-09-25"},"evidence_url":"https://www.ejustice.just.fgov.be/eli/loi/2024/04/26/2024202344/justel","source_pr":3147,"registry_sha":"b8bb2d3f7ae2ebfe05b956c6ebff0d7b084896fe"},{"id":"e5d207c87b6bf1e774fedfe3","type":"content_corrected","date":"2026-09-25","framework_ids":["SG_PDPA"],"note":"Added the Personal Data Protection (Amendment No. 2) Regulations 2026 (S 580/2026, in operation 1 September 2026) amending reg. 1A of S 63/2021 (business contact information of the designated individual via a record on the PDPC website or the organisation official website) and the attribution line required by the Singapore Statutes Online terms of use (clause 13).","batch_key":"2026-09-25-km-fix-be-bsi-sg","source_pr":3220,"registry_sha":"93a5a39a4fdca2191805c6cf75460760cd433be4","evidence_url":"https://sso.agc.gov.sg/SL-Supp/S580-2026/Published/20260831?DocDate=20260831"},{"id":"e5ed03759fb809b3145b29e3","type":"content_corrected","date":"2026-09-25","framework_ids":["IE_DPA_2018"],"note":"s. 30 row: the (uncommenced) offence covers any company or corporate body, as the Act states, not only a company.","batch_key":"2026-09-25-km-ie-dpa-confirm","source_pr":3208,"registry_sha":"761265301efb99f9aa83b2bd7a8535c23880df73","evidence_url":"https://www.irishstatutebook.ie/eli/2018/act/7/section/30/enacted/en/html"},{"id":"e86e776bad21abac0d980025","type":"content_corrected","date":"2026-09-25","framework_ids":["CCSDS_SECURITY"],"note":"CCSDS security books re-checked against the ccsds.org catalogue and every cover page: supersession of 355.0-B-1 and 352.0-B-1, ISO equivalents, 350.5-G-2 draft marking, reproduction permission statement, non-binding status and Non-Standards Track noted; catalogue-description paraphrase removed.","source_pr":3172,"registry_sha":"0516a6050d819683c1ba1900e43c90f385654d9a","evidence_url":"https://ccsds.org/publications/allpubs/"},{"id":"e99efc11ca8127766900ca09","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_BG"],"note":"Version label now includes ДВ бр. 55/2026 (§ 73 ЗИД на Закона за насърчаване на инвестициите), which replaced the Minister of e-Government with the Minister of Innovation and Digital Transformation throughout the ЗКС.","batch_key":"2026-09-25-km-fix-nis2-at-bg","from":{"NIS_2_BG":"ЗКС в редакцията на ДВ бр. 17/2026"},"to":{"NIS_2_BG":"ЗКС, изм. ДВ бр. 17/2026 и бр. 55/2026"},"source_pr":3217,"registry_sha":"708b8aa154df0999fe1c9171f3049a7a98cbc017"},{"id":"eadfac9d583a39804857a845","type":"content_corrected","date":"2026-09-25","framework_ids":["BDSG"],"note":"Supervisory map corrected (§ 40 covers private bodies only, Land public bodies under Land law, BfDI under § 9 also for commercial telecom providers); Art. 9(2)(j) opens via §§ 27-28 and Art. 85 is not filled by § 85; § 44 and Teil 3 Kapitel 6 titles aligned; pending BGBl. 2026 I Nr. 139 changes to § 30 added; secondary sources removed from the Source block.","batch_key":"2026-09-25-km-fix-bdsg-gdpr","source_pr":3228,"registry_sha":"f1cd8653da2a7c61fcd170b19b5b3d739954226c","evidence_url":"https://www.gesetze-im-internet.de/bdsg_2018/"},{"id":"eb465da4d626790947314490","type":"verification_refreshed","date":"2026-09-25","framework_ids":["NIS_2_DK"],"note":"Every row re-verified against LOV 434/2025 (Retsinformation print 26.9.2026: Gældende, no later amendments), BEK 620/2025 (Gældende), the L 141 bill remarks, LOV 258/2025 and LOV 435/2025, with SAMSIK and FE official pages for the CSIRT and sector authorities.","batch_key":"2026-09-25-km-fix-nis2-cz-dk-gr","from":{"NIS_2_DK":"2026-05-05"},"to":{"NIS_2_DK":"2026-09-25"},"source_pr":3230,"registry_sha":"d0142b2d8dcdc5a6e5a0bfc71f9b6a7f27fed2a7","evidence_url":"https://www.retsinformation.dk/eli/lta/2025/434"},{"id":"ebcc20cacb0178f136b19525","type":"content_corrected","date":"2026-09-25","framework_ids":["NIS_2_DE"],"note":"Added the July 2026 amendment chain (§ 2 Nr. 23, § 33, § 35 Abs. 2, new § 66 transition keeping old § 33 Abs. 2 and 5 until the KRITIS-Dachgesetz ordinance, Anlage 1 GModG); corrected § 38 Abs. 2 (subsidiary BSIG liability exists), § 61 Abs. 9 (acts of the competent supervisory authority, unreliable management only), § 28 Abs. 5-6 exception lists and § 30 wording; added § 39 Abs. 4.","batch_key":"2026-09-25-km-fix-nis2-de-pt","source_pr":3211,"registry_sha":"788352470a204ecb5894e4d6c6106a5f1059d5b1","evidence_url":"https://www.recht.bund.de/bgbl/1/2026/221/regelungstext.pdf?__blob=publicationFile&v=1"},{"id":"ed0c494d5b94702621ca5989","type":"content_corrected","date":"2026-09-25","framework_ids":["BSI_GRUNDSCHUTZ"],"note":"Grundschutz++ note now states the BSI milestone plan (Stand September 2026): Methodik-GS++ published at it-sa on 27 October 2026, GS++ certification applications from 1 January 2027, classic IT-Grundschutz certifiability ends 30 November 2031 (replaces an unsourced transition until about 2029); BaFin status corrected: KAIT, VAIT and ZAIT out of force since the end of 16 January 2025, BAIT fully repealed at the end of 31 December 2026.","batch_key":"2026-09-25-km-fix-be-bsi-sg","source_pr":3220,"registry_sha":"93a5a39a4fdca2191805c6cf75460760cd433be4","evidence_url":"https://www.bsi.bund.de/dok/grundschutz-plus-plus"},{"id":"eea5900543d03fe1bc2ba0ac","type":"version_changed","date":"2026-09-25","framework_ids":["NIS_2_RO"],"note":"Version label now names Legea 123/2026 (MOf 550/03.07.2026), which completed art. 36 of OUG 155/2024 after its approval by Legea 124/2025.","batch_key":"2026-09-25-km-fix-nis2-ro-sk","from":{"NIS_2_RO":"OUG 155/2024 (cu modificările prin Legea 124/2025)"},"to":{"NIS_2_RO":"OUG 155/2024 (aprobată cu modificări prin Legea 124/2025, completată prin Legea 123/2026)"},"source_pr":3216,"registry_sha":"e32b69a9d135e83b54a2869ee84862b238e6c2a4","evidence_url":"https://legislatie.just.ro/Public/DetaliiDocument/312027"},{"id":"f195e5306555bb01d5e7c519","type":"verification_refreshed","date":"2026-09-25","framework_ids":["ECSS_E_ST_80C"],"note":"Legacy evidence backfill (K5) under K2b: ECSS-E-ST-80C (1 July 2024) still active on ecss.nl; clause and annex titles, DRL and threat headings, normative references and requirement identifier count re-verified against the official PDF.","batch_key":"2026-09-25-km-backfill-c","from":{"ECSS_E_ST_80C":"2026-09-06"},"to":{"ECSS_E_ST_80C":"2026-09-25"},"source_pr":3179,"registry_sha":"7361b2be91c1719a8bcb7281de5c1f94873936a6","evidence_url":"https://ecss.nl/standard/ecss-e-st-80c-space-engineering-security-in-space-systems-lifecycles/"},{"id":"f2d3e60d78e2cd77bdc68730","type":"metadata_changed","date":"2026-09-25","framework_ids":["IN_RBI_IT_CYBER"],"note":"Display name now names the 2026 entity-wise RBI cyber Directions and records that they replaced RBI/2023-24/107 and the 2016 Cyber Security Framework in Banks.","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","source_pr":3221,"registry_sha":"081198802bd1d317ba010c8a677f046327199cb2","evidence_url":"https://rbi.org.in/scripts/BS_ViewMasDirections.aspx?id=13643"},{"id":"f990647562a2ffc75cc5506b","type":"version_changed","date":"2026-09-25","framework_ids":["IN_SEBI_CSCRF"],"note":"Version label now names the full CSCRF clarification stack (2024/184, 2025/60, 2025/119) and the 24 August 2026 FIRE-format portal circular read with CSCRF.","batch_key":"2026-09-25-km-fix-in-sebi-cscrf","from":{"IN_SEBI_CSCRF":"SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 2024-08-20 (with clarifications 2024-12-31 and 2025-08-28; AI vulnerability-detection advisory HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated 2026-05-05 supplements CSCRF, does not amend it)"},"to":{"IN_SEBI_CSCRF":"SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 dated 2024-08-20, read with clarifications 2024/184 (2024-12-31), 2025/60 (2025-04-30) and 2025/119 (2025-08-28, re-categorising Portfolio Managers and Merchant Bankers); AI vulnerability-detection advisory HO/13/19/12(1)2026-ITD-1_CIMGI/10873/2026 dated 2026-05-05 and FIRE-format incident reporting portal circular HO/(449)2026-ITD-5_DIV1/I/19448/2026 dated 2026-08-24 are read with CSCRF, do not amend it"},"evidence_url":"https://www.sebi.gov.in/sebi_data/attachdocs/aug-2025/1756380695925.pdf","source_pr":3223,"registry_sha":"8e18f11ed3855ce3f6d20785bdfcd735d36a0cfc"},{"id":"fbeb2953083fef8c1efd3120","type":"version_changed","date":"2026-09-25","framework_ids":["CA_OSFI_B13"],"note":"OSFI Guideline B-13 foreign-branch consequential amendments dated 22 February 2024 (the date of OSFI's letter), not 20 February 2024; version label corrected, and the same date corrected in the canonical citation, overview and sources; no new edition. lastVerified unchanged.","batch_key":"2026-09-25-ip-osfi-b13","from":{"CA_OSFI_B13":"Final Guideline (released 13 July 2022, amended 20 February 2024), effective 1 January 2024"},"to":{"CA_OSFI_B13":"Final Guideline (released 13 July 2022, amended 22 February 2024), effective 1 January 2024"},"source_pr":3224,"registry_sha":"a5cd3e968936dd52aa661a693de18225179e1f0d","evidence_url":"https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/consequential-amendments-guidelines-b-10-b-13-related-foreign-branches"},{"id":"fdea720daeef48781be2a10a","type":"content_corrected","date":"2026-09-25","framework_ids":["IN_CERT_IN"],"note":"SEBI cross-reference: email to SEBI within 6 hours and the SEBI Incident Reporting Portal within 24 hours (SEBI circular of 24 August 2026, para 2).","batch_key":"2026-09-25-km-fix-in-rbi-certin-sebi","source_pr":3221,"registry_sha":"c78743cdc7c66c9730d5f687a141025ca09af89f","evidence_url":"https://www.sebi.gov.in/sebi_data/attachdocs/aug-2026/1787569463244.pdf"},{"id":"feb1e565fb027fec0538fa71","type":"verification_refreshed","date":"2026-09-25","framework_ids":["CCPA"],"note":"Every row re-verified against the CPPA consolidated statute text effective 1 January 2026 and the CPPA CPI notice, with the California Legislature open-data section histories and bill status as second authoritative source.","batch_key":"2026-09-25-km-fix-ccpa-hipaa","from":{"CCPA":"2026-07-17"},"to":{"CCPA":"2026-09-25"},"evidence_url":"https://cppa.ca.gov/pdf/20260101_ccpa_statute.pdf","source_pr":3226,"registry_sha":"f409117be208e34d3a2aea1ed42e2610a6cad729"},{"id":"0c86137efadb9ac7e68cb7ca","type":"framework_added","date":"2026-09-28","framework_ids":["NIS2_IR_2024_2690"],"note":"Commission Implementing Regulation (EU) 2024/2690 (NIS 2 technical and methodological requirements and significant-incident criteria) added: Articles 1-16 with points and all 219 numbered Annex points (1 to 13.3.3) with lettered sub-points, verified against the English OJ text from Cellar; the three corrigenda (PL, SV, NL) do not change the English text.","batch_key":"2026-09-28-p12-eu-level2","evidence_url":"http://data.europa.eu/eli/reg_impl/2024/2690/oj","source_pr":3322,"registry_sha":"114a24b2b26dca385d1fe3c3c87f5d7461b39c1c"},{"id":"4d892a4273928e2e0e6e1f22","type":"content_corrected","date":"2026-09-28","framework_ids":["NIS_2","DORA"],"note":"Cross-links to the new level-2 modules: DORA names Delegated Regulation (EU) 2024/1774 in a header note and the Art. 15 and 16(3) rows; NIS 2 names Implementing Regulation (EU) 2024/2690 in the Art. 21(5) and 23(11) rows, and status note 4 now states that its three corrigenda correct the Polish, Swedish and Dutch versions only.","batch_key":"2026-09-28-p12-eu-level2","evidence_url":"http://data.europa.eu/eli/reg_impl/2024/2690/oj","source_pr":3322,"registry_sha":"114a24b2b26dca385d1fe3c3c87f5d7461b39c1c"},{"id":"6643b278216a67a932ecd2bd","type":"framework_added","date":"2026-09-28","framework_ids":["DORA_RTS_2024_1774"],"note":"Commission Delegated Regulation (EU) 2024/1774 (DORA RTS on ICT risk management and the simplified framework) added at article, paragraph and point level: all 42 articles verified against the English OJ text from Cellar, with the corrigendum of 15.5.2025 (Art. 22(d)) applied and the Croatian-only corrigendum of 6.3.2025 recorded.","batch_key":"2026-09-28-p12-eu-level2","evidence_url":"http://data.europa.eu/eli/reg_del/2024/1774/oj","source_pr":3322,"registry_sha":"114a24b2b26dca385d1fe3c3c87f5d7461b39c1c"},{"id":"45f14e3126e759f2f1c43324","type":"content_corrected","date":"2026-09-29","framework_ids":["IE_DPA_2018"],"note":"Part 5 scope line now follows s. 70(1)(b): processing by wholly or partly automated means, or otherwise for data forming or intended to form part of a relevant filing system (was: by automated means or as part of a relevant filing system); a duplicate GDPR-exclusion sentence was dropped to stay within the 25 KB budget.","batch_key":"2026-09-29-km-ie-dpa-date-bump","source_pr":3392,"registry_sha":"14c70845f405ac7359e554f763fc2ddcf043b278"},{"id":"751dec18969f73617261bcb4","type":"version_changed","date":"2026-09-29","framework_ids":["CA_OSFI_B13"],"note":"OSFI Guideline B-13 version label: 'amended 22 February 2024' corrected to 'amended February 2024'. 22 February 2024 is the date of OSFI's consequential-amendments letter, while the B-13 guideline page shows 'Date modified: 2024-02-20'; the label no longer pins the guideline amendment to the letter date, and both dates are named in the knowledge text. No new edition; lastVerified unchanged.","batch_key":"2026-09-29-fix-osfi-gate","from":{"CA_OSFI_B13":"Final Guideline (released 13 July 2022, amended 22 February 2024), effective 1 January 2024"},"to":{"CA_OSFI_B13":"Final Guideline (released 13 July 2022, amended February 2024), effective 1 January 2024"}},{"id":"91bb85a5ce38df3e0b2de10a","type":"verification_refreshed","date":"2026-09-29","framework_ids":["IE_DPA_2018"],"note":"Re-verified after PR #3208: LRC Revised Act and eISB Legislation Directory byte-identical to the 2026-09-25 copies (up to date as of 17 September 2026), no Act signed after No. 36 of 2026 and no 2026 S.I. up to No. 497 naming the Act; fresh-context Opus find-one-error round on the final text returned NO ERROR FOUND.","batch_key":"2026-09-29-km-ie-dpa-date-bump","from":{"IE_DPA_2018":"2026-09-13"},"to":{"IE_DPA_2018":"2026-09-29"},"source_pr":3392,"registry_sha":"14c70845f405ac7359e554f763fc2ddcf043b278","evidence_url":"https://revisedacts.lawreform.ie/eli/2018/act/7/revised/en/html"},{"id":"d83147d1d78b92ed0537f326","type":"content_corrected","date":"2026-09-29","framework_ids":["CA_OSFI_B13"],"note":"OSFI Guideline B-13 directive 1: the content beneath the Principles is now described as OSFI's expectations (OSFI's own term), replacing a 'should-level recommended controls' label OSFI does not use; the amendment date lines in the canonical citation and overview name the letter date (22 February 2024) and the guideline page modification date (20 February 2024). Rows, scope and lastVerified are unchanged.","batch_key":"2026-09-29-fix-osfi-gate"},{"id":"53b88f74dc589e9e3413a5ca","type":"framework_added","date":"2026-09-30","framework_ids":["NIS_2_ES"],"note":"New NIS_2_ES module: Spain has not transposed NIS 2 (draft Ley de Coordinación y Gobernanza de la Ciberseguridad, first reading 14 January 2025, not sent to the Cortes; Court referral 8 July 2026); covers the RD-ley 12/2018 and RD 43/2021 regime still in force.","source_pr":3424,"registry_sha":"f953c8d3ea5ae7a107eadde3de4010ed3fd5a0da","evidence_url":"https://www.boe.es/eli/es/rdl/2018/09/07/12"},{"id":"656b4578c0c1ac3a5d3ee2d8","type":"content_corrected","date":"2026-09-30","framework_ids":["NIS_2"],"note":"NIS 2 status note: after the July 2026 referral of the Netherlands, the Cyberbeveiligingswet (Stb. 2026, 187) entered into force on 15 August 2026; points to NIS_2_NL. Rows, version and lastVerified unchanged.","batch_key":"2026-09-30-km-nis2-nl","source_pr":3423,"registry_sha":"f31ae7225a6e44c4e3baf2b4d8913b006ef8de19","evidence_url":"https://zoek.officielebekendmakingen.nl/stb-2026-189.html"},{"id":"c844f76c805f9750c0e60ca0","type":"framework_added","date":"2026-09-30","framework_ids":["NIS_2_LU"],"note":"New NIS_2_LU module: loi du 5 mai 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité (Mémorial A n° 225 du 6 mai 2026, in force 10 May 2026), ILR and CSSF competences, registration, reporting clocks and fines.","source_pr":3425,"registry_sha":"dfeb78c898cbc67b9573a19f2e40dd8b77077579","evidence_url":"https://legilux.public.lu/filestore/eli/etat/leg/loi/2026/05/05/a225/jo/fr/html/eli-etat-leg-loi-2026-05-05-a225-jo-fr-html.html"},{"id":"e5ff77f4538a0e033e3ced47","type":"framework_added","date":"2026-09-30","framework_ids":["NIS_2_NL"],"note":"Netherlands NIS 2 transposition added: Cyberbeveiligingswet (Stb. 2026, 187; in force 15 August 2026 per art. 35 Cyberbeveiligingsbesluit, Stb. 2026, 189), with the decree and the seven Staatscourant 2026 regulations; verified against the Staatsblad and Staatscourant texts on officielebekendmakingen.nl.","batch_key":"2026-09-30-km-nis2-nl","source_pr":3423,"registry_sha":"f31ae7225a6e44c4e3baf2b4d8913b006ef8de19","evidence_url":"https://zoek.officielebekendmakingen.nl/stb-2026-187.html"},{"id":"05a981970e994b280400c0c1","type":"content_corrected","date":"2026-10-06","framework_ids":["ISO_9001"],"note":"ISO 9001 entry stays on the 2015 edition (name, version, lastVerified and clause rows unchanged); edition metadata re-sourced from ISO Open Data (ISO 9001:2026 Edition 6 current, 2015 and Amd 1:2024 withdrawn, no 2026 supplements); Global ACI-TECH-3-TR 2029-09-30 (M) transition mechanics completed (scope, AB discretion per section 5.1, actor per milestone, after 31 March 2028 for new certifications, CAB transitions before 30 September 2029, non-transition path); the 2026 changes are cited (ISO 9001:2026 and Global ACI section 3), not summarized.","batch_key":"2026-10-06-km-iso-9001","evidence_url":"https://sys.global-aci.org/uploads/documents/TECH-3-TR_2029-09-30_(M)_ISO_9001_2026_Transition_v1_03.pdf","source_pr":3696,"registry_sha":"fe7c3081"},{"id":"092f67a334573b56edb90001","type":"content_corrected","date":"2026-10-06","framework_ids":["UK_DPA_2018"],"note":"UK DPA 2018 updated for the Information Commission transition in force 30 September 2026: s. 114 and Sch. 12 rows removed as omitted, regulator note restated in the present tense, s. 21, s. 28 and Sch. 3 headings aligned to the official text; module moved to its own file.","batch_key":"km-verify-uk-dpa-2018-2026-10-06","source_pr":3699,"registry_sha":"8e6c5e3ecdb859c99f16004a4a9b03ee43af68fe","evidence_url":"https://www.legislation.gov.uk/uksi/2026/1015/made"},{"id":"465cff6228117d7d1f84b635","type":"verification_refreshed","date":"2026-10-06","framework_ids":["UK_DPA_2018"],"note":"UK DPA 2018 re-verified row by row against the legislation.gov.uk revised text valid from 30 September 2026 after the Information Commission transition (DUA 2025 ss. 118-119, S.I. 2026/1015).","batch_key":"km-verify-uk-dpa-2018-2026-10-06","from":{"UK_DPA_2018":"2026-09-23"},"to":{"UK_DPA_2018":"2026-10-06"},"source_pr":3699,"registry_sha":"8e6c5e3ecdb859c99f16004a4a9b03ee43af68fe","evidence_url":"https://www.legislation.gov.uk/ukpga/2018/12/contents"},{"id":"63b8804ba546ab7325989086","type":"content_corrected","date":"2026-10-06","framework_ids":["DIGID_ASSESSMENT"],"note":"NOREA Handreiking ICT-beveiligingsassessment DigiD Versie 2026 (1.0, 23 September 2026, for audits with an oordeelsdatum for opzet and bestaan from 1 October 2026) replaces the stale in-development note; added the Logius operational rules (annual cycle and deadlines, migration requests, report form and submission, follow-up letters, escalation, verscherpt toezicht, RSO age and yearly renewal, meervoudig assessment, Non-Occurrence correction, expired B.01 exception); ENSIA kept as a submission channel separate from the phased-out Attest/3000A method; NOREA scope text described as auditor guidance, not a binding definition.","batch_key":"2026-10-06-km-digid-assessment","source_pr":3694,"registry_sha":"5de8a3c77857a8e0b08638f60f6898dcb508f984"},{"id":"6f2c809b4265b8a7f74cf189","type":"verification_refreshed","date":"2026-10-06","framework_ids":["JP_JIS_Q_27001"],"note":"Source-page watch on the ISMS-AC scheme page: page byte-identical to the 2026-09-25 fetch and already reflected in the module (criterion JIS Q 27001 (ISO/IEC 27001); ISO/IEC 27001:2022 + Amd 1:2024 and JIS Q 27001:2025 applied with JIS Q 27001:2023). ISMS-AC notices, METI JIS Q 27002 notice, JIPDEC 27000 family overview (2026-05-18) and ISO Open Data rechecked unchanged; no newer JIS or ISO edition. Content unchanged.","batch_key":"2026-10-06-km-jp-jis-q-27001","from":{"JP_JIS_Q_27001":"2026-09-25"},"to":{"JP_JIS_Q_27001":"2026-10-06"},"source_pr":3697,"registry_sha":"3742f949107a59530932748c1fa9e8508dc0d574","evidence_url":"https://isms.jp/isms/about.html"},{"id":"dbfc982eb90c22ed11aba7dd","type":"verification_refreshed","date":"2026-10-06","framework_ids":["DIGID_ASSESSMENT"],"note":"Re-verified against the Logius norm page (Normenkader 3.0, versie 3.0, ingangsdatum 1 augustus 2022, 21 norms unchanged), the Logius ICT-beveiligingsassessments DigiD sub-pages and the Aansluitvoorwaarden DigiD en DigiD Machtigen 1.0; the 2026-10-01 source-watch hit was the separate IT-assessmentrapportage page.","batch_key":"2026-10-06-km-digid-assessment","from":{"DIGID_ASSESSMENT":"2026-09-25"},"to":{"DIGID_ASSESSMENT":"2026-10-06"},"source_pr":3694,"registry_sha":"5de8a3c77857a8e0b08638f60f6898dcb508f984","evidence_url":"https://www.logius.nl/onze-dienstverlening/toegang/digid/ict-beveiligingsassessments-digid/documentatie/norm-ict-beveiligingsassessments-digid"},{"id":"df59465a1324caf62cd4f58d","type":"content_corrected","date":"2026-10-06","framework_ids":["NCSC_CAF"],"note":"NCSC CAF: the Information Commission is now stated as the NIS competent authority for RDSPs (NIS reg. 3(2) as amended by SI 2026/386 Sch. 3 para. 24, in force 30 September 2026 via SI 2026/1015 reg. 2), with the Information Commissioner until 29 September 2026; official Source block added.","batch_key":"2026-10-06-km-ncsc-caf","evidence_url":"https://www.legislation.gov.uk/uksi/2018/506/regulation/3","source_pr":3698,"registry_sha":"1168d85836259a8ec525513dc48f5a8cbc6d172f"},{"id":"fa0250200f0a06965587cf99","type":"verification_refreshed","date":"2026-10-06","framework_ids":["NCSC_CAF"],"note":"NCSC CAF re-verified after the 30 September 2026 Information Commission transition: v4.0 (4 August 2025) still the latest NCSC release; 4 objectives, 14 principles and 41 contributing outcomes re-checked against the v4.0 PDF; NIS reg. 3(2) and Schedule 1 re-checked on legislation.gov.uk.","batch_key":"2026-10-06-km-ncsc-caf","from":{"NCSC_CAF":"2026-09-25"},"to":{"NCSC_CAF":"2026-10-06"},"evidence_url":"https://www.ncsc.gov.uk/collection/cyber-assessment-framework/changelog","source_pr":3698,"registry_sha":"1168d85836259a8ec525513dc48f5a8cbc6d172f"},{"id":"ffe132c22b7416138269feb1","type":"content_corrected","date":"2026-10-06","framework_ids":["JP_JIS_Q_27001"],"note":"Version note completed from ISMS-AC notices: the 2022-2025 transition applied to organizations certified against JIS Q 27001:2014 (ISO/IEC 27001:2013), initial and recertification audits on the old edition could start only until 2024-04-30, and ISMS-AC read ISO/IEC 27001:2022 in its transition plan as JIS Q 27001:2023 except for the start of the period; separately, its JIS Q 27001:2025 notice refers certificate notation questions to the certification body.","batch_key":"2026-10-06-km-jp-jis-q-27001","source_pr":3697,"registry_sha":"6f2e0831cb86674e430318887b8c010ccf1fc1fc","evidence_url":"https://isms.jp/topics/news/20230227.html"},{"id":"0187728989d0a274fd3fa173","type":"metadata_changed","date":"2026-10-07","framework_ids":["BSI_C5"],"note":"Display name now identifies both editions carried in the rows (BSI C5:2026 and C5:2020).","batch_key":"2026-10-07-bsi-c5-2026","source_pr":3717},{"id":"14cd9e51e3f21f0776a94dcc","type":"content_corrected","date":"2026-10-07","framework_ids":["UK_EIR_2004"],"note":"Navigation note added: DUA 2025 s. 88(11)-(12)(c), in force 5 September 2025 (S.I. 2025/996 reg. 2(1)(b)), changes the DPA 2018 cross-reference in reg. 13(3A)(b) and (5B)(d) and is still an outstanding change on legislation.gov.uk; no heading changes.","batch_key":"2026-10-07-km-uk-eir-2004","evidence_url":"https://www.legislation.gov.uk/ukpga/2025/18/section/88","source_pr":3701,"registry_sha":"5d7844f641388c1274a3f8f62e36f9c6dc58bb24"},{"id":"29cb2edc7f76e03d8ae7e2e0","type":"verification_refreshed","date":"2026-10-07","framework_ids":["UK_FOIA_2000"],"note":"Full re-verification of all 101 current section and Schedule headings, the Sch. 4 entry and the 8 Part headings against the legislation.gov.uk revised text valid from 30 September 2026, plus Royal Assent, the 1 January 2005 commencement (S.I. 2004/3122) and the applied S.I. 2026/386 Sch. 2 para. 12 effects.","batch_key":"2026-10-07-km-uk-foia-2000","from":{"UK_FOIA_2000":"2026-09-25"},"to":{"UK_FOIA_2000":"2026-10-07"},"evidence_url":"https://www.legislation.gov.uk/ukpga/2000/36/contents","source_pr":3702,"registry_sha":"44603220d894e3aa58c068e30edc0c58040a3536"},{"id":"4e78f9949845d56b1eced134","type":"content_corrected","date":"2026-10-07","framework_ids":["UK_EIR_2004"],"note":"Post-transition state: the Information Commission is the regulator since 30 September 2026 (DUA 2025 ss. 118-119, S.I. 2026/1015 reg. 2); the reg. 16 row now carries only the substituted heading (S.I. 2026/386 Sch. 3 para. 8(3)(a)) and the regulator note is restated in the past tense.","batch_key":"2026-10-07-km-uk-eir-2004","evidence_url":"https://www.legislation.gov.uk/uksi/2004/3391/contents","source_pr":3701,"registry_sha":"5d7844f641388c1274a3f8f62e36f9c6dc58bb24"},{"id":"5aac2964748fdf0ec1ac861d","type":"verification_refreshed","date":"2026-10-07","framework_ids":["BSI_C5"],"note":"C5:2026 rows extracted from and C5:2020 rows re-matched against the official BSI PDFs; edition facts re-checked on the C5:2026 page and the BSI C5 FAQ.","batch_key":"2026-10-07-bsi-c5-2026","from":{"BSI_C5":"2026-07-15"},"to":{"BSI_C5":"2026-10-07"},"source_pr":3717,"evidence_url":"https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/CloudComputing/ComplianceControlsCatalogue/2026/C5_2026.pdf"},{"id":"62821718cf9ba3c2a8c511fd","type":"verification_refreshed","date":"2026-10-07","framework_ids":["NIS_2_LV"],"note":"Every row re-verified against the likumi.lv consolidated text in force from 1 October 2026, with the Latvijas Vēstnesis amending act OP 2026/115.1 as second source; no later amendment published as of 2026-10-07.","batch_key":"2026-10-07-km-nis2-lv","from":{"NIS_2_LV":"2026-09-25"},"to":{"NIS_2_LV":"2026-10-07"},"evidence_url":"https://likumi.lv/ta/id/353390-nacionalas-kiberdrosibas-likums","source_pr":3734,"registry_sha":"cc047384baef259d31713679c9bc56e3828623ac"},{"id":"67adbce20a5a3241a2a8bede","type":"content_corrected","date":"2026-10-07","framework_ids":["UK_FOIA_2000"],"note":"Post-transition state: the Information Commission is the regulator since 30 September 2026 (DUA 2025 ss. 118-119, S.I. 2026/1015 reg. 2); the s. 18, Part III, s. 47, s. 50, s. 76 and s. 76A rows now carry only the headings substituted by S.I. 2026/386 Sch. 2 para. 12, and the regulator note is restated in the past tense.","batch_key":"2026-10-07-km-uk-foia-2000","evidence_url":"https://www.legislation.gov.uk/ukpga/2000/36/contents","source_pr":3702,"registry_sha":"44603220d894e3aa58c068e30edc0c58040a3536"},{"id":"773603bacf4c63023e9d29e6","type":"content_corrected","date":"2026-10-07","framework_ids":["NIS_2_LV"],"note":"Article 20 point 11 extension now stated as in force; Articles 20-22, 25, 26.1, 34, 45 and 46 restated precisely against the consolidated text; chapter table dropped to stay within the module length budget.","batch_key":"2026-10-07-km-nis2-lv","source_pr":3734,"registry_sha":"cc047384baef259d31713679c9bc56e3828623ac"},{"id":"8622ac0a803110b439bf82e2","type":"content_corrected","date":"2026-10-07","framework_ids":["NIS_2_EE"],"note":"Bill 897 SE is now law: published RT I, 06.10.2026, 1, in force 16 October 2026 (new incident definition narrows the mandatory § 8 trigger, near-miss voluntary reporting, § 7 lg 7 repealed, RIA security audits); consolidated-text windows to 15 and from 16 October 2026; added § 6¹ and § 7 duties and VV määrus nr 121 (Eesti infoturbestandard, ISO/IEC 27001 alternative, audits); corrected § 3¹/§ 4¹ wording (information duty, not registration), § 8 lg 1¹, lg 3, lg 5-6, § 18⁴ legal-person cap, NCSC-EE as an RIA centre, size-independent and electronic-communications categories, KORKS five-year cap.","batch_key":"2026-10-07-km-nis2-ee","source_pr":3706,"registry_sha":"12f119e3fa122abe8731a9e9bdede04030ad916d"},{"id":"b647d0d94e1097ea8e02b82e","type":"content_corrected","date":"2026-10-07","framework_ids":["BSI_C5"],"note":"C5:2020 DEV-04 title restored to the official text (trailing period); C5:2026 IAM-xx and GC-xx IDs detected only next to an explicit C5 cue.","batch_key":"2026-10-07-bsi-c5-2026","source_pr":3717},{"id":"bfb0b43055d4fb6998b1044c","type":"verification_refreshed","date":"2026-10-07","framework_ids":["UK_EIR_2004"],"note":"Full re-verification of all 21 regulation and 5 Part headings against the legislation.gov.uk revised contents valid from 30 September 2026 (0 mismatches), plus made and in-force dates, enabling power, Directive reference and the applied S.I. 2026/386 Sch. 3 para. 8 effects.","batch_key":"2026-10-07-km-uk-eir-2004","from":{"UK_EIR_2004":"2026-09-25"},"to":{"UK_EIR_2004":"2026-10-07"},"evidence_url":"https://www.legislation.gov.uk/uksi/2004/3391/contents","source_pr":3701,"registry_sha":"5d7844f641388c1274a3f8f62e36f9c6dc58bb24"},{"id":"c4ada4887fa939708f3be4fb","type":"content_corrected","date":"2026-10-07","framework_ids":["UK_FOIA_2000"],"note":"Rows for ss. 49 and 59 (omitted), ss. 71 and 80A (repealed) and Sch. 4 (omitted) were listed as live provisions; they now name the omitting or repealing provision, its date and commencement instrument, per the legislation.gov.uk revised text.","batch_key":"2026-10-07-km-uk-foia-2000","evidence_url":"https://www.legislation.gov.uk/ukpga/2000/36/data.xml","source_pr":3702,"registry_sha":"44603220d894e3aa58c068e30edc0c58040a3536"},{"id":"cb75db2e9bdb29d10529aee3","type":"version_changed","date":"2026-10-07","framework_ids":["BSI_C5"],"note":"Version now names both editions with rows: C5:2026 v1.0.1 (168 criteria, 17 areas, GC-01 to GC-06) added as Part A next to the C5:2020 rows (Part B).","batch_key":"2026-10-07-bsi-c5-2026","from":{"BSI_C5":"C5:2020 (January 2020)"},"to":{"BSI_C5":"C5:2026 v1.0.1 (1.0.0 published 07.04.2026); C5:2020 (January 2020)"},"source_pr":3717},{"id":"f3ec503b88f72a94bcebc2f3","type":"version_changed","date":"2026-10-07","framework_ids":["NIS_2_LV"],"note":"Version now names the consolidated edition in force from 1 October 2026, when the Article 20 point 11 amendment of the 4 June 2026 law took effect.","batch_key":"2026-10-07-km-nis2-lv","from":{"NIS_2_LV":"Nacionālās kiberdrošības likums (2024), ar grozījumiem, kas izdarīti ar 04.06.2026. likumu (LV Nr. 115, 17.06.2026.)"},"to":{"NIS_2_LV":"Nacionālās kiberdrošības likums (2024), ar grozījumiem, kas izdarīti ar 04.06.2026. likumu (LV Nr. 115, 17.06.2026.), redakcija no 01.10.2026."},"source_pr":3734,"registry_sha":"cc047384baef259d31713679c9bc56e3828623ac"},{"id":"559e77cec372cff523d89493","type":"version_changed","date":"2026-10-12","framework_ids":["JP_APPI"],"note":"APPI version statement rebased on the e-Gov revision in force since 2026-10-01 (Science Council of Japan Act, Act No. 70 of 2025, Appended Table 1 only); the Disaster Management Agency stage of Act No. 62 of 2026 is now dated 2026-11-02 under Cabinet Order No. 303 of 2026 (e-Gov showed 2026-12-31 before), with its Art. 2(8) and Art. 63 changes; PPC basic approach part 2 (2026-10-01) recorded.","batch_key":"2026-10-12-km-jp-appi","from":{"JP_APPI":"Act No. 57 of 2003, consolidated text in force on 2026-09-24 (e-Gov revision of 2026-07-17); Act No. 56 of 2026 promulgated 2026-07-17, main provisions not yet in force"},"to":{"JP_APPI":"Act No. 57 of 2003, consolidated text in force on 2026-10-12 (e-Gov revision of 2026-10-01); Act No. 56 of 2026 promulgated 2026-07-17, main provisions not yet in force"},"source_pr":3846,"registry_sha":"999dcb2edcd8f6b0f5ba5b059d85ab663c408310"},{"id":"65460ffc8e322cec415212e6","type":"content_corrected","date":"2026-10-12","framework_ids":["CH_ICT_MIN_STD"],"note":"Detection only: bare NESA activates the Swiss ICT Minimum Standard only next to a Swiss cue, so UAE NESA questions no longer load it. Knowledge text unchanged.","batch_key":"2026-10-12-w6-detection-collisions"},{"id":"d9f13599a0311a95ea536caa","type":"verification_refreshed","date":"2026-10-12","framework_ids":["JP_APPI"],"note":"APPI chapter, section and article map and Japanese captions re-checked against the current e-Gov consolidated text (law API v2, revision 415AC0000000057_20261001_507AC0000000070; identical structure to the 2026-07-17 text) and the scheduled revisions; Disaster Management Agency commencement corroborated on the Cabinet Secretariat page.","batch_key":"2026-10-12-km-jp-appi","from":{"JP_APPI":"2026-09-24"},"to":{"JP_APPI":"2026-10-12"},"evidence_url":"https://laws.e-gov.go.jp/law/415AC0000000057","source_pr":3846,"registry_sha":"999dcb2edcd8f6b0f5ba5b059d85ab663c408310"},{"id":"2de234630d8a57a2de716bf9","type":"framework_added","date":"2026-10-13","framework_ids":["JP_NCO_COMMON_STANDARDS"],"note":"New JP_NCO_COMMON_STANDARDS module: Common Standards for Cybersecurity Measures for Government Agencies and Related Agencies, FY2025 edition (2025-06-27, revised 2026-09-14), 8 parts, 27 sections and 59 subsections, IDs and headings only (copyrighted, NCO).","batch_key":"2026-10-13-japan-batch2","to":{"JP_NCO_COMMON_STANDARDS":"2026-10-13"},"evidence_url":"https://www.cyber.go.jp/policy/group/general/kijun.html","source_pr":3851,"registry_sha":"d7170955262ad2079f08b9c2ec299a27aa2f4845"},{"id":"6f7a3dc6cc7d14917eecf6b9","type":"content_corrected","date":"2026-10-13","framework_ids":["JP_MY_NUMBER_ACT"],"note":"Added current article numbers for leak reporting (Art. 29-4; Art. 33 is guidance and advice) and the PPC Rules No. 5 of 2015 thresholds and deadlines; Act No. 87 of 2025 recorded as in force since 2026-10-01. Article rows, version and lastVerified unchanged.","batch_key":"2026-10-13-japan-batch2","evidence_url":"https://laws.e-gov.go.jp/law/425AC0000000027","source_pr":3851,"registry_sha":"d7170955262ad2079f08b9c2ec299a27aa2f4845"},{"id":"9cd054c809000833b174419d","type":"content_corrected","date":"2026-10-13","framework_ids":["JP_APPI"],"note":"Added the leak-reporting table from PPC Rules Arts. 7-10: more than 1,000 individuals, notice to individuals in all four reportable cases, final report in 30 days or 60 days for wrongful-purpose cases, preliminary report promptly (PPC benchmark 3 to 5 days). Version and lastVerified unchanged.","batch_key":"2026-10-13-japan-batch2","evidence_url":"https://laws.e-gov.go.jp/law/428M60020000003","source_pr":3851,"registry_sha":"d7170955262ad2079f08b9c2ec299a27aa2f4845"},{"id":"e11f889e566db0598a390762","type":"framework_added","date":"2026-10-13","framework_ids":["FR_CONTRACT_LAW"],"note":"New FR_CONTRACT_LAW module: Code civil contract law after ordonnance n° 2016-131 (formation, adhesion contracts and unfair clauses, liability limits incl. Art. 1231-3, electronic form and signature) and Code de commerce art. L. 442-1 (wording in force 2026-08-20), with Cass. com. 26 janvier 2022 n° 20-16.782; official text from DILA bases LEGI and CASS (Licence Ouverte).","batch_key":"2026-10-13-km-fr-contract-law","to":{"FR_CONTRACT_LAW":"2026-10-13"},"evidence_url":"https://www.data.gouv.fr/datasets/legi-codes-lois-et-reglements-consolides","source_pr":3897,"registry_sha":"c5c24e94cf1450f44af3f555bfce696a33e0fa0c"},{"id":"f16bcca1ae3e007aa0988009","type":"framework_added","date":"2026-10-13","framework_ids":["JP_CYBERSECURITY_BASIC_ACT"],"note":"New JP_CYBERSECURITY_BASIC_ACT module: Basic Act on Cybersecurity (Act No. 104 of 2014) as restructured by Act No. 43 of 2025, all 38 articles with official English and Japanese captions, Headquarters duties and the NISC to NCO change of 2025-07-01.","batch_key":"2026-10-13-japan-batch2","to":{"JP_CYBERSECURITY_BASIC_ACT":"2026-10-13"},"evidence_url":"https://laws.e-gov.go.jp/law/426AC1000000104","source_pr":3851,"registry_sha":"d7170955262ad2079f08b9c2ec299a27aa2f4845"},{"id":"fe71e1973670010e1cf92fc9","type":"framework_added","date":"2026-10-13","framework_ids":["JP_ACTIVE_CYBER_DEFENSE"],"note":"New JP_ACTIVE_CYBER_DEFENSE module: Act No. 42 of 2025 (active cyber defense law), in force 2026-10-01 for operator registration and incident reporting (4-month registration, prompt and 30-day reports), communications-information chapters pending; English captions are our own translation, flagged in the text.","batch_key":"2026-10-13-japan-batch2","to":{"JP_ACTIVE_CYBER_DEFENSE":"2026-10-13"},"evidence_url":"https://laws.e-gov.go.jp/law/507AC0000000042","source_pr":3851,"registry_sha":"d7170955262ad2079f08b9c2ec299a27aa2f4845"},{"id":"c689308ac96cb7402dcf54aa","type":"content_corrected","date":"2026-10-14","framework_ids":["UK_EIR_2004"],"note":"Regulator naming corrected to the ICO notes to editors of 30 September 2026: the legal entity is the Information Commission, overseen by its Board, and the organisation is referred to as the Information Commission's Office (ICO).","batch_key":"2026-10-07-km-uk-eir-2004","evidence_url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/","source_pr":3701},{"id":"e355b48a5ab58eb4e0f1e615","type":"content_corrected","date":"2026-10-15","framework_ids":["UK_FOIA_2000"],"note":"Regulator naming corrected to the ICO notes to editors of 30 September 2026: the legal entity is the Information Commission, overseen by its Board, and the organisation is referred to as the Information Commission's Office (ICO).","batch_key":"2026-10-07-km-uk-foia-2000","source_pr":3702,"evidence_url":"https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2026/09/ico-welcomes-transition-to-new-information-commission-and-marks-new-chapter-with-manchester-head-office-opening/"},{"id":"2385b348db7fd6c37ab30fff","type":"content_corrected","date":"2026-10-16","framework_ids":["NIS_2_EE"],"note":"Amending act RT I, 06.10.2026, 1 (bill 897 SE) entered into force on 16 October 2026: stated as in force; the § 8¹ voluntary-reporting row and the §§ 18²-18³ offence list now follow the in-force text (near-miss incidents for all reporters, ordinary incidents for non-providers; § 7 lg 7 dropped from the offence list); the VV määrus nr 121 SME exemption now says the thresholds are measured under Recommendation 2003/361/EC with partner and linked enterprises unless the entity is independent in its systems (§ 3 lg 2³); the 2022 amending act note now records its 1 January 2027 provision and the not-in-force consolidated text RT I, 06.08.2022, 19 (2022 state).","batch_key":"2026-10-16-km-nis2-ee","source_pr":3706,"registry_sha":"4a9741c7dbca178456694e1cc4eef7504977ff53"},{"id":"8bd5a8e9055639e8fc795e85","type":"content_corrected","date":"2026-10-16","framework_ids":["UK_DPA_2018"],"note":"UK DPA 2018 regulator note: S.I. 2026/1015 reg. 3 continuity restated to cover any act, omission or other thing (including legal proceedings), continued by or in relation to the Information Commission.","batch_key":"km-verify-uk-dpa-2018-2026-10-16-rework","source_pr":3699,"registry_sha":"9a5a5119de9850c0bba342f97e3ac3f30a435ac7","evidence_url":"https://www.legislation.gov.uk/uksi/2026/1015/regulation/3/made"},{"id":"b477e2f77db6d5d8cd27e727","type":"verification_refreshed","date":"2026-10-16","framework_ids":["NIS_2_EE"],"note":"Re-verified on 7 October 2026 and again on 16 October 2026, the day RT I, 06.10.2026, 1 entered into force, against the Riigi Teataja public API (consolidated texts RT I, 30.06.2026, 131 and RT I, 06.10.2026, 2, version list, amending acts, KORKS, VV määrus nr 121 and nr 79); second sources Riigikogu API (bill 897 SE) and CERT-EE RFC 2350.","batch_key":"2026-10-16-km-nis2-ee","from":{"NIS_2_EE":"2026-09-25"},"to":{"NIS_2_EE":"2026-10-16"},"evidence_url":"https://www.riigiteataja.ee/public-api/api/v1/akt/106102026002/xml","source_pr":3706,"registry_sha":"4a9741c7dbca178456694e1cc4eef7504977ff53"},{"id":"b752230b649fc0198c13a633","type":"content_corrected","date":"2026-10-16","framework_ids":["UK_DPA_2018"],"note":"UK DPA 2018 regulator note: S.I. 2026/386 Sch. 2 para. 23 Commission substitutions now name the two items given no effect by reg. 1(4) (s. 26(2)(f)(ai) and s. 165(1)), because DUA 2025 s. 103 came fully into force first on 19 June 2026.","batch_key":"km-merge-uk-dpa-2018-2026-10-16","source_pr":3699,"registry_sha":"c0e67d81a737d7b26d205749f5ab74a7df07c4aa","evidence_url":"https://www.legislation.gov.uk/uksi/2026/386/regulation/1/made"},{"id":"bec770ef8486aefea8e3608b","type":"version_changed","date":"2026-10-16","framework_ids":["NIS_2_EE"],"note":"Version string now names the KüTS consolidated text in force from 16 October 2026 (RT I, 06.10.2026, 2, after RT I, 30.06.2026, 131 for 1 to 15 October 2026) alongside the NIS 2 amending act RT I, 30.12.2025, 4.","batch_key":"2026-10-16-km-nis2-ee","from":{"NIS_2_EE":"KüTS muudatus 2025 (RT I, 30.12.2025, 4)"},"to":{"NIS_2_EE":"KüTS terviktekst RT I, 06.10.2026, 2 (NIS 2 muudatus RT I, 30.12.2025, 4)"},"source_pr":3706,"registry_sha":"4a9741c7dbca178456694e1cc4eef7504977ff53"},{"id":"0ecc1fe5a90e4d59e80870f8","type":"verification_refreshed","date":"2026-10-17","framework_ids":["NIS_2_BG"],"note":"Re-verified on 17 October 2026 against the State Gazette (ДВ бр. 17/2026, 43/2026, 55/2026 texts and the issue contents of бр. 18-95/2026) and the Council of Ministers agendas on gov.bg; no further ЗКС amendment and no § 47 implementing act found.","batch_key":"2026-10-17-km-nis2-bg","from":{"NIS_2_BG":"2026-09-25"},"to":{"NIS_2_BG":"2026-10-17"},"evidence_url":"https://dv.parliament.bg/DVWeb/showMaterialDV.jsp?idMat=241234","source_pr":4114,"registry_sha":"42c77034713572f9f9bd5ef05c48fd72ae488b00"},{"id":"fa458a92e5fee6b75b1955c4","type":"content_corrected","date":"2026-10-17","framework_ids":["NIS_2_BG"],"note":"Effective-date check of the § 47 deadlines: adds § 47, т. 3 (alignment of the чл. 3, ал. 2 наредба) and § 46, states that the § 47, т. 1 decision and the чл. 3, ал. 2 and ал. 3 acts were not found in ДВ бр. 18-95/2026 or the Council of Ministers agendas, so the § 48 classification clock has not been shown to start; corrects чл. 6а, 21, 23 (ал. 5, т. 5; ал. 6-8), 28 and 4а, ал. 1, т. 7 wording, the МЕУ merger date reference and the ДАНС anti-hallucination line.","batch_key":"2026-10-17-km-nis2-bg","source_pr":4114,"registry_sha":"42c77034713572f9f9bd5ef05c48fd72ae488b00"},{"id":"0a7370028b119759256358db","type":"content_corrected","date":"2026-10-18","framework_ids":["EN_18286"],"note":"EN 18286:2026 is cited in the Official Journal by Commission Implementing Decision (EU) 2026/2274 (OJ L, 14.10.2026); status, OJEU row and presumption paragraph corrected, Art. 43(1) and Annex VI point 2 anchors added.","batch_key":"2026-10-18-ai-gov-standards","evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202602274"},{"id":"3083c2c81cf70101fc31641c","type":"content_corrected","date":"2026-10-18","framework_ids":["NIST_800_171"],"note":"SP 800-171 Rev. 2 re-checked (NIST PDF and CSV unchanged, 32 CFR Part 170 not amended since 2024-12-16); adds the Sec. 1.1 CUI-category applicability condition, the Ch. 3 alternative-measures and SSP/plan-of-action exception rules, the 170.14(d) organization-defined rule and the DFARS 252.204-7012 Rev. 2 baseline under Class Deviations 2024-O0013 and 2026-O0025 Rev. 3; lastVerified unchanged (prior-edition carry-forward).","batch_key":"2026-10-18-km-nist-800-171","evidence_url":"https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final","source_pr":4131,"registry_sha":"1f70f4c1adc709d8630f0eaccfdaa9620f2f8381"},{"id":"49c693cd404ce77ba94ae928","type":"verification_refreshed","date":"2026-10-18","framework_ids":["EN_18286"],"note":"EN 18286:2026 status and AI Act anchors re-verified against Decision (EU) 2026/2274 and the consolidated text 02024R1689-20260727 on EUR-Lex.","batch_key":"2026-10-18-ai-gov-standards","from":{"EN_18286":"2026-09-25"},"to":{"EN_18286":"2026-10-18"},"evidence_url":"https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202602274"},{"id":"6681db19c191d325672e9596","type":"framework_added","date":"2026-10-18","framework_ids":["ISO_27090"],"note":"ISO/IEC 27090 (AI cybersecurity, edition 1) added from ISO Open Data record 56581: reference, official title, edition, stage, committee and ICS only.","batch_key":"2026-10-18-ai-gov-standards","evidence_url":"https://isopublicstorageprod.blob.core.windows.net/opendata/_latest/iso_deliverables_metadata/json/iso_deliverables_metadata.jsonl"},{"id":"811c49afc92ea6c66c12b8d9","type":"framework_added","date":"2026-10-18","framework_ids":["IEEE_2863"],"note":"IEEE 2863-2026 (organizational governance of AI, recommended practice) added from the IEEE SA standard record: number, title, class, status, committee and dates only, under the new IEEE row of the IP guidelines.","batch_key":"2026-10-18-ai-gov-standards","evidence_url":"https://standards.ieee.org/ieee/2863/10142/","source_pr":4128,"registry_sha":"cf9e539af63ea4a83a58dad9b9841a0ad7c55e3e"},{"id":"13aacd52770930f0b133553f","type":"content_corrected","date":"2026-10-20","framework_ids":["SOC_2"],"note":"SOC 2 knowledge text carries a dated notice that the current-release check is pending a person check, because the AICPA & CIMA website terms object to AI use of site content (IP guidelines section 4.4 AICPA row, added in v1.3, current version 1.5); lastVerified unchanged.","batch_key":"2026-10-20-km-soc-2","evidence_url":"https://github.com/better-isms/isms-copilot/blob/26ffd15f987dcc71f8195794ee45faacd5256796/grc/intellectual-property/INTELLECTUAL-PROPERTY-GUIDELINES.md","source_pr":4132,"registry_sha":"35e1cb6d3db2431adde071841c80c10c4496b3cf"},{"id":"55c21d5c9c48533862b1d0b6","type":"framework_added","date":"2026-10-22","framework_ids":["CN_PIPL","CN_CSL","CN_DSL","CN_MLPS_2_0","CN_GB_T_22080","CN_CROSS_BORDER"],"note":"China batch 1: PIPL, the revised Cybersecurity Law (2025 amendment, in force 2026-01-01), the Data Security Law, GB/T 22239-2019 (MLPS 2.0 baseline), GB/T 22080-2025 (ISMS requirements pointer), and the cross-border transfer regime (2024 Provisions + Security Assessment Measures). Official CAC/gov.cn/SAMR texts fetched 2026-10-22; GB/T modules are IDs + titles + summaries only.","batch_key":"2026-10-22-china-batch1","evidence_url":"https://www.cac.gov.cn/2021-08/20/c_1631050028355286.htm","source_pr":4350,"registry_sha":"230b0806d7ccc9e9df39f9f66ba7035acb5b27e6"},{"id":"dbd2f40fd0cd6215de9cdd7e","type":"content_corrected","date":"2026-10-23","framework_ids":["CN_CSL","CN_DSL","CN_MLPS_2_0","CN_CROSS_BORDER"],"note":"Detection-pattern corrections folded from the independent release review: CJK cue alternatives that sat inside ASCII word-boundary groups (which never match next to CJK text) were REMOVED from those groups, not activated, because every candidate cue is either not China-specific (a game-level or modem collision) or already covered by a bare anchor; the ASCII cues are unchanged, the four modem and grading collision phrasings are pinned negative, and a source-shape regression fails if a CJK alternative returns inside a word-boundary group.","batch_key":"2026-10-23-release-fix-4371","source_pr":4371}]}