Sector Rules: NERC CIP, TSA Pipeline Directives, CMMC, FDA and More

Rule versions described, as read October 28, 2026: NERC CIP standards in force (CIP-002-5.1a, CIP-003-9 effective April 1, 2026, CIP-005-7, CIP-010-4, CIP-013-2 and CIP-014-3), CIP-015-1 (approved by FERC Order No. 907, order effective September 2, 2025, compliance from October 1, 2028) and its replacement CIP-015-2 (approved by FERC order of August 10, 2026), the virtualization package approved by FERC Order No. 919 (effective May 26, 2026, compliance July 1, 2028) and FERC Order No. 912 on supply chain (effective November 24, 2025); FERC civil penalty maximum at 18 CFR 385.1602 (2025 adjustment); TSA Security Directive Pipeline-2021-01G (effective January 16, 2026 to January 15, 2027) and Pipeline-2021-02G (effective May 3, 2026 to May 2, 2027) and the TSA proposed rule at 89 FR 88488 (November 7, 2024); DFARS 252.204-7012 as applied by DFARS Class Deviation 2026-O0025, Revision 3 (September 3, 2026); NIST SP 800-171 Rev. 2 and Rev. 3; CMMC program rule, 32 CFR Part 170 (89 FR 83092, effective December 16, 2024) and DFARS rule (90 FR 43560, effective November 10, 2025), with the July 13, 2026 Phase 2 suspension; FD&C Act section 524B (21 U.S.C. 360n-2) and FDA's premarket cybersecurity guidance as reissued February 3, 2026; Safe Drinking Water Act section 1433 (42 U.S.C. 300i-2); CFATS (6 CFR Part 27, lapsed); Coast Guard rule at 33 CFR Part 101, subpart F (90 FR 6298, effective July 16, 2025); CIRCIA (6 U.S.C. 681 to 681g) and its proposed rule at 89 FR 23644 (April 4, 2024); SEC Form 8-K Item 1.05 and Regulation S-K Item 106 (88 FR 51896); EU Regulation 2024/2847 (Cyber Resilience Act), Directive 2022/2555 (NIS2) and Regulation 2023/1230 (Machinery); Idaho Code 28-51-104 to 28-51-107 and 2025 House Bill 35. Rules change often, some of these change every year, and several were paused or reopened in 2026. Check the regulator's current text before relying on any point.

Picture three Idaho businesses on the same Monday morning. A 60-person shop in Nampa machines brackets for a company that builds military aircraft parts. A food processor in the Magic Valley runs its own wastewater pretreatment and a small natural gas boiler plant. A utility crew outside Boise checks a substation that feeds both of them. Each one runs industrial control systems: the programmable logic controllers (PLCs, small rugged computers that run machines), human-machine interfaces (HMIs, the screens operators use) and supervisory control and data acquisition (SCADA) software that the earlier lessons in this module describe. Each one could be hit by the same ransomware. But the federal and state rules that tell each of them what to do about it are completely different.

The machine shop answers to a defense contract clause, a NIST publication and a certification program that was paused in July 2026. The food processor probably answers to no cybersecurity rule written for it at all, though its insurer, its biggest customers and the state breach law for its payroll data still matter. The utility answers to a set of mandatory standards that the Federal Energy Regulatory Commission (FERC) approves and a regional body for the West enforces, with penalties that can reach seven figures a day. That patchwork is the subject of this lesson.

This lesson is for the people who have to sort it out: plant managers, controls and automation engineers, compliance officers, owners of small and mid-size manufacturers, utility, pipeline and water operators, defense suppliers, medical device makers, and the reporters, county commissioners and legislators who ask what the rules actually require. It explains each rule that can reach a manufacturer or an industrial operator, with its version, its date and where it stands as of October 28, 2026, and ends with a single table you can use to sort out which ones apply to you.

It builds on lessons elsewhere on this site and does not repeat them. For the general federal privacy and security laws that reach any business (the FTC Act, the Safeguards Rule, HIPAA and the basics of CIRCIA), see Federal Laws That Reach Your Business. For a small contractor's step-by-step view of FAR 52.204-21, DFARS 7012, SPRS scores, CMMC levels, plans of action and the affirmation, see Government Contracts, Idaho Public Sector and Sectors. For state breach notice laws, see Breach Notification Laws in All 50 States and Idaho Privacy Law Up Close. For who regulates the power grid, see Who Regulates the Grid, and for how gas moves through pipelines, see Moving Gas. For the hospital side of medical device security, see Medical Devices and Clinical Technology. This lesson goes deeper on the industrial side: what each rule asks of the control systems on a plant floor, a pipeline or a grid.

Inside this module, the standards that most of these rules borrow from (ISA/IEC 62443 and NIST SP 800-82) are in lesson 2; the attacks that prompted them, including Colonial Pipeline, are in lesson 3; vendor remote access, which several of these rules now target, is in lesson 4; patching under the rules is in lesson 5; and network segmentation, which the TSA pipeline directive requires in so many words, is in lesson 7.

No single law: which rules apply to you

People new to industrial security often ask which federal law sets the cybersecurity requirements for factories. The short answer is that none does. Congress has never passed a general cybersecurity law for manufacturers, and no federal agency has been given general power to write one. What exists instead is a set of sector rules, each written by a different agency under a different statute for a different reason, plus contract clauses, securities rules and state laws that reach some plants and not others.

CISA, the Cybersecurity and Infrastructure Security Agency in the Department of Homeland Security, runs the federal government's page for the Critical Manufacturing Sector. It names four core industries: primary metals (steel, aluminum and other metals), machinery (engines, turbines, mining, farm and construction equipment), electrical equipment (motors, transformers, generators) and transportation equipment (vehicles, ships, aircraft, rail equipment). CISA says it "identifies, assesses, prioritizes, and protects manufacturing industries with national significance."¹¹ But for that sector CISA works through advice, free services and voluntary guidance, not rules. Other kinds of manufacturing sit in other sectors: chemical plants in the Chemical Sector, drug and device makers in Healthcare and Public Health, food processors in Food and Agriculture, defense production in the Defense Industrial Base.

The five questions that decide it

Whether a cyber rule reaches your plant usually turns on five questions:

1. What do you make? A medical device with software that can connect to the internet brings in the FDA. A product with software sold into the European Union brings in the EU Cyber Resilience Act. Most other products bring in no product cybersecurity rule in the United States.
2. Who do you sell to? A defense prime contractor or the Department of War (a name the Department of Defense has also used since late 2025) brings in DFARS clauses, NIST SP 800-171 and CMMC through your contract. Other customers bring in whatever their contracts say.
3. What do you own or operate besides the plant? A registered generator or transmission line (NERC CIP), a critical pipeline (TSA), a community water system (EPA), a regulated marine terminal (Coast Guard) or a large inventory of hazardous chemicals (EPA's Risk Management Program, and formerly CFATS) each brings its own regulator.
4. Are your shares publicly traded? Then the SEC's cyber disclosure rules apply to you, no matter what you make.
5. Whose personal information do you hold? Every employer holds some. A breach of employee or customer personal information triggers state breach notice laws, including Idaho's, even if the attack never touched a machine.

The chart below turns those questions into a first sort. It is a starting point for a conversation with your compliance officer, not a ruling. Each "yes" leads to a section later in this lesson.

What the voluntary standards do and do not do

Most manufacturers, then, are not under any cyber rule written for their plant floor. That does not leave them without guidance. ISA/IEC 62443, NIST SP 800-82 Rev. 3, the NIST Cybersecurity Framework 2.0 and CISA's Cross-Sector Cybersecurity Performance Goals, all explained in lesson 2, are voluntary for most plants. But the sector rules borrow from them constantly. TSA's pipeline directive requires segmentation between IT and operational technology (OT, the hardware and software that run physical equipment), which is the zone-and-conduit idea at the center of IEC 62443. NERC CIP builds on electronic security perimeters. CMMC is built on NIST SP 800-171. Even when a voluntary standard is not the law, it is often the yardstick an auditor, an insurer or a large customer uses to judge whether your security was reasonable.

Voluntary also does not mean free of consequences. Contract clauses from customers can impose security duties on a supplier that no regulator imposes. Insurers ask detailed questions about security controls before they write a cyber policy. And for public companies, the SEC rule discussed below makes cybersecurity governance a disclosure item whether or not any other law applies.

CISA itself: budget, staffing and the information-sharing law

CISA is the agency most manufacturers deal with: it publishes ICS advisories, runs free assessments and receives incident reports under the TSA directives. Its capacity changed sharply in 2025 and 2026, according to press reports. A Cloud Security Alliance research note, citing Axios and Nextgov reporting, said CISA had about 3,300 employees in January 2025 and about 2,400 by late 2025. The administration's fiscal 2026 budget request proposed cutting CISA's funded positions from 3,732 to 2,649 and its budget by about $500 million.¹² A lapse in Homeland Security appropriations began February 14, 2026; about 888 CISA staff (38 percent) were kept on duty and the rest furloughed until the House passed the funding bill on April 30, 2026, after what GovInfoSecurity called a "record 75-day shutdown." The final package included "$20 million to hire critical CISA positions focused on countering threats from China."¹² During the lapse, the research note said, proactive vulnerability scanning and outreach were suspended.¹² This lesson could not confirm the final enacted CISA dollar figure for fiscal 2026.

A second CISA question matters to anyone who shares threat information. The Cybersecurity Information Sharing Act of 2015 (usually called CISA 2015, a different thing from the agency) gives companies liability and antitrust protection when they share cyber threat indicators and defensive measures with the government and with each other under the law's rules. Those protections are what let a plant's security team tell a sector information sharing and analysis center (ISAC) about an intrusion without fearing a lawsuit for it. The law's ten-year sunset took effect September 30, 2025, during a government shutdown; Congress renewed it temporarily in November 2025, it lapsed again briefly, and a spending bill signed February 3, 2026 extended it through September 30, 2026.¹³ According to the Congressional Research Service, the provisions "were extended to December 11, 2026, upon enactment of the Continuing Appropriations and Extensions Act, 2027."¹³ As of October 9, 2026, Roll Call reported that long-term renewal was stalled in the Senate, with renewal bills from Sen. Gary Peters (D-Mich.) and House Homeland Security Chairman Andrew Garbarino (R-N.Y.) held up by Senate Homeland Security Chairman Rand Paul (R-Ky.), who wants a speech-protection amendment.¹⁴ If nothing passes, the protections expire December 11, 2026. Plants that share indicators through MFG-ISAC, E-ISAC, WaterISAC or ONG-ISAC should watch that date.

The rules on one timeline

The rules in this lesson arrived in waves, mostly after attacks. The first mandatory grid standards date to 2008. Most of the rest came after the Colonial Pipeline ransomware attack of May 2021, described in lesson 3. The timeline below shows the main dates from 2008 through 2027.

All the rules side by side

The table below is the whole lesson in one place. Each row is explained, with its sources, in the sections that follow. "Status" is as of October 28, 2026.

NERC CIP: the grid rules

The oldest and most detailed mandatory cybersecurity rules for industrial systems in the United States are the Critical Infrastructure Protection (CIP) reliability standards of the North American Electric Reliability Corporation (NERC). They are cybersecurity and physical security standards for the bulk electric system, the high-voltage grid and the large generators and control centers that run it. FERC approves them under section 215 of the Federal Power Act (16 U.S.C. 824o), which makes them enforceable law, not industry advice.¹⁵ FERC made the first set mandatory in January 2008 in Order No. 706, which approved CIP-002-1 through CIP-009-1.¹⁶ The basics of how FERC, NERC and the regional entities divide the work are in Who Regulates the Grid; this section goes into what the CIP standards require of the control systems themselves.

Who must comply

The CIP standards apply to "registered entities," organizations listed in NERC's Compliance Registry for one or more functions, such as balancing authority, transmission owner or operator, generator owner or operator, or distribution provider. Each entity must comply for the functions it is registered for. FERC's October 2026 paperwork notice states: "The NERC Compliance Registry, as of August 2026, identifies approximately 1,706 unique U.S. entities that are subject to mandatory compliance with CIP Reliability Standards."¹⁷

A factory is not a registered entity just because it buys a lot of electricity. As a general matter, a manufacturer comes under CIP only if it registers for a function, for example as the generator owner and operator of a large on-site cogeneration plant that meets NERC's bulk electric system thresholds. Before you describe any particular plant as covered, check the NERC Compliance Registry for its name and functions. For most manufacturers, CIP matters indirectly: the utility that feeds the plant is covered, and the plant's own controls engineers may find the CIP standards a useful model.

Impact ratings: high, medium and low

The first standard, CIP-002, requires each registered entity to identify its "BES Cyber Systems" (groups of computers and networked devices whose loss or misuse could affect the bulk electric system) and rate each one high, medium or low impact. Most other CIP requirements scale with that rating. A large control center is high impact; many substations and generating plants are medium; thousands of smaller sites are low. For example, CIP-015-1 applies only to high impact systems and medium impact systems with "External Routable Connectivity," meaning they can be reached over a routable network protocol from outside their electronic security perimeter.¹⁵¹⁸ The low impact category matters because it is where much of the grid's equipment sits, and two of the newest standards (CIP-003-9 and CIP-003-11) are aimed at it.

The standards and their current versions

NERC numbers each standard and adds a version number after the dash; a new version usually takes effect a year or more after FERC approves it, and the old version stays in force until then. That makes "which version is current" a real question. NERC's U.S. effective-dates page loads its table with JavaScript, and this module's researchers could not read it as text on October 28, 2026, so the versions below were rebuilt from FERC orders and NERC implementation plans. Versions marked "check" were not confirmed on NERC's page; look them up there before quoting them.

Sources for the table: FERC Orders No. 907, 912, 918 and 919 and the CIP-002-8 order in the Federal Register; NERC implementation plans; and law firm and consultant summaries for CIP-012-2 and CIP-014-4.¹⁹²¹²⁰

CIP-015-1: watching inside the network

For most of the CIP standards' history, the focus was on the perimeter: who and what can cross into the electronic security perimeter around critical systems. CIP-015-1 adds internal network security monitoring (INSM), which means watching traffic inside the perimeter for signs that an intruder is already there. FERC approved it in Order No. 907 (Docket RM24-7-000) on June 26, 2025; the order was published at 90 FR 28889 on July 2, 2025, and states, "This action is effective September 2, 2025."¹⁵

The standard has three requirements. Requirement R1 calls for collecting network data feeds using a risk-based rationale, detecting anomalous activity and evaluating it. R2 calls for keeping the monitoring data tied to anomalous activity long enough to support that evaluation. R3 calls for protecting the collected data from unauthorized changes or deletion, so an intruder cannot erase the evidence.¹⁸ The standard applies to high impact BES Cyber Systems and to medium impact systems with External Routable Connectivity.

Compliance comes later than the effective date. NERC's implementation plan makes the standard effective "the first day of the first calendar quarter that is thirty-six (36) months after the effective date" of FERC's order, which works out to October 1, 2028. Entities must comply at control centers and backup control centers on that date and extend monitoring to other covered medium impact systems within 24 months after that, by October 1, 2030.¹⁸ FERC also directed NERC, within 12 months, "to extend INSM to include EACMS and PACS outside of the electronic security perimeter" (EACMS are the systems that control electronic access, such as firewalls and jump hosts; PACS are physical access control systems, such as badge readers).¹⁵ NERC filed CIP-015-2 to do that on June 18, 2026 and asked FERC to retire CIP-015-1. FERC's October 2026 paperwork notice says the change to CIP-015-2 was "implemented through Order RD26-6-000 issued on August 10, 2026," and estimates that 360 entities will face added paperwork under the new version. This lesson could not read that order itself, so check NERC's page for the date CIP-015-2 takes effect.¹⁷

For a manufacturer, CIP-015 is a useful benchmark even where it is not required. It is the first U.S. regulation that tells operators of industrial control networks, in so many words, to watch the traffic inside their control networks and to protect the record of what they see. The plant-floor version of the same idea, passive network monitoring at the boundaries between zones, is part of the plan in lesson 7.

CIP-003-9: vendor remote access at low impact sites

Vendors and integrators often reach control systems remotely to troubleshoot, update or tune them. Lesson 4 explains why that path is one of the most common ways into industrial networks. Before 2026, the CIP rules on vendor remote access applied mainly to high and medium impact systems. CIP-003-9 extended them to low impact sites. As one trade report put it, "As of April 1, 2026, NERC Reliability Standard CIP-003-9 went into effect." It requires a vendor electronic remote access program for low impact BES Cyber Systems: entities must be able to identify active vendor remote access sessions, disable that access, and detect known or suspected malicious communications.²²

A second change is approved and on the way. FERC Order No. 918 (Docket RM25-8-000), issued March 19, 2026 and published at 91 FR 13952 on March 24, 2026, approved CIP-003-11, which changes electronic access controls for low impact BES Cyber Systems; the order took effect May 26, 2026.¹⁹ One consultant reported a mandatory compliance date of July 1, 2029 for CIP-003-11, but this lesson could not confirm that date in NERC's own implementation plan, so treat it as unconfirmed.

Virtualization and Order No. 919

Control centers, like office data centers, increasingly run software on virtual machines: many "computers" on one physical server, managed through a hypervisor. The original CIP standards were written for one device, one box. FERC Order No. 919 (Docket RM24-8-000), issued March 19, 2026, published at 91 FR 13957 on March 24, 2026 and effective May 26, 2026, approved 11 modified standards to fit virtualization: CIP-002-7, CIP-003-10, CIP-004-8, CIP-005-8, CIP-006-7.1, CIP-007-7.1, CIP-008-7.1, CIP-009-7.1, CIP-010-5, CIP-011-4.1 and CIP-013-3. It also added four new glossary terms (Cyber System, Management Interface, Shared Cyber Infrastructure and Virtual Cyber Asset) and modified 18 definitions.¹⁹

Two points in the order matter to anyone explaining it. First, FERC wrote: "The proposed modifications do not obligate entities to adopt virtualization." Utilities that keep physical servers keep complying the old way. Second, the new standards replace the old "technical feasibility exception" approach with a "per system capability" exception, and FERC directed NERC to add clear criteria, mandatory reporting to the ERO Enterprise (NERC and the regional entities) and an annual anonymized report, so that exceptions do not quietly become loopholes.¹⁹ The new versions take effect on the first day of the first calendar quarter 24 months after the order's effective date, with optional early adoption at 6, 12 or 18 months. Counting from May 26, 2026, that is July 1, 2028.¹⁹

Supply chain and Order No. 912

CIP-013-2, the supply chain risk management standard now in force, requires registered entities to have plans for assessing the cyber risks of vendors and products, and it extended those plans to EACMS and PACS. FERC Order No. 912, issued September 18, 2025, published at 90 FR 45661 on September 23, 2025 and effective November 24, 2025, directs NERC to tighten the supply chain standards (CIP-005-7, CIP-010-4 and CIP-013-2) within 18 months. The order asks NERC to cover Protected Cyber Assets (other devices inside the perimeter), set a maximum time between a vendor risk assessment and installing the equipment, require periodic reassessment of vendors and add a process to document, track and respond to supply chain risks.²¹ The order also withdrew a 2020 FERC inquiry about equipment from companies identified as national security risks, such as Huawei and ZTE.²¹

One detail matters for anyone tracking the deadline: the order states the 18 months two different ways. Paragraph 1 says 18 months "from the date of issuance," and paragraph 69 says "from the effective date." NERC opened Project 2025-06 to respond.²¹ Depending on which reading controls, NERC's filing is due in March or May 2027.

CIP-008: incident reporting

CIP-008 sets the grid's incident reporting clock, which is far shorter than any other rule in this lesson. Under CIP-008-6, which took effect January 1, 2021 after FERC approved it in 2019, a registered entity that identifies a reportable cyber security incident, or an attempt to compromise certain systems, must send an initial notice to the Electricity Information Sharing and Analysis Center (E-ISAC, run by NERC) and to the federal cyber center now part of CISA. Depending on the type of event, the first report is due within one hour or by the end of the next day.²³ The virtualization package will replace CIP-008-6 with CIP-008-7.1 in 2028.

Penalties and what enforcement looks like

Federal Power Act section 316A (16 U.S.C. 825o-1) authorizes civil penalties for violating reliability standards, adjusted for inflation each year. The current maximum in the Code of Federal Regulations reads: "16 U.S.C. 825o-1(b), Federal Power Act: $1,584,648 per violation, per day."¹ That figure is from FERC's 2025 inflation adjustment; the eCFR history of 18 CFR 385.1602 shows no 2026 change as of October 2026.¹

In practice, penalties are set by NERC and the regional entities through settlements and "Notices of Penalty" filed with FERC, and they are almost always far below the statutory maximum. The largest CIP penalty on record when it was filed in early 2019 was a $10 million settlement covering 127 CIP violations, 13 of them rated serious, which NERC said "collectively posed a serious risk to the security and reliability of the BPS" (the bulk power system). NERC's filing did not name the company; E&E News and The Wall Street Journal identified it as Duke Energy.²⁴ As that case shows, a CIP penalty filing may not name the company, so reporters sometimes have to identify it from other records (see the reporting section at the end of this lesson).

Idaho: WECC, Idaho Power and Avista

NERC delegates monitoring and enforcement to regional entities. For the Western Interconnection, which includes Idaho, that is the Western Electricity Coordinating Council (WECC). Idaho Power Company and Avista Corporation both appear in WECC's Registered Ballot Body list of April 2, 2026: Idaho Power in the transmission owner, load-serving entity and generator segments, Avista in the transmission owner, load-serving entity and generator segments. PacifiCorp and the Bonneville Power Administration, which also serve parts of Idaho, are listed too.¹⁰ Ballot body membership is a voting list for standards, so it strongly suggests but does not prove each company's exact registered functions; the NERC Compliance Registry is the place to confirm those.

The Idaho Public Utilities Commission regulates the rates and service of investor-owned electric, natural gas, water and telecommunications utilities in Idaho and handles rail and pipeline safety matters. Its website shows no commission-level cybersecurity rule; it links instead to the state's cybersecurity portal.²⁵ So the cybersecurity of Idaho Power's and Avista's grid control systems is enforced through NERC and WECC, not the state commission. The commission's role is indirect but real: the cost of meeting CIP standards shows up in the utilities' rate cases, which are public.

TSA pipeline security directives

Pipelines are regulated for safety by the Pipeline and Hazardous Materials Safety Administration, but their security, including cybersecurity, falls to the Transportation Security Administration (TSA). For years TSA's pipeline security guidelines were voluntary. That changed in May 2021, after a ransomware attack on Colonial Pipeline's business network led the company to shut down its fuel pipeline as a precaution. Lesson 3 tells that story. For how gas pipelines and compressor stations work, see Moving Gas.

How the directives began

TSA issued Security Directive Pipeline-2021-01 on May 26, 2021, effective May 28, 2021. It required covered owners and operators to "Report cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 12 hours," name a cybersecurity coordinator available around the clock, and assess their practices against TSA's guidelines.²⁷ A second directive, Pipeline-2021-02, followed on July 19, 2021 (effective July 26, 2021), as a Sensitive Security Information document not released to the public. In July 2022 TSA rewrote it in a performance-based format, and it is now published openly.²⁸

Security directives are emergency tools. They are issued under 49 U.S.C. 114(l)(2)(A), which lets the TSA Administrator issue a directive immediately "without providing notice or an opportunity for comment."²⁸ That speed is why TSA could act within weeks of Colonial. It is also why the directives expire after a year and must be renewed, and why TSA has said it wants to replace them with a permanent rule written through ordinary notice and comment.

Pipeline-2021-01G: coordinators and reporting

The current version of the first series is Security Directive Pipeline-2021-01G, "Enhancing Pipeline Cybersecurity," effective January 16, 2026 through January 15, 2027. It cancels and replaces 01F. Its transmittal memo is dated January 9, 2026, and its one substantive change concerns vetting: a non-U.S. citizen serving as primary or alternate Cybersecurity Coordinator must be a current member of NEXUS, Global Entry or a comparable TSA-recognized program.²

The directive requires three things:

• A Cybersecurity Coordinator and alternates who must "Be accessible to TSA and CISA 24 hours a day, seven days a week, including when the U.S. Government is closed."
• Incident reporting. Owners and operators "must report the information required by Section II.C., as soon as practicable, but no later than 72 hours after the Owner/Operator identifies a cybersecurity incident." Reports go to CISA Central (www.cisa.gov/report), and supplemental information is due within 24 hours of becoming available.
• A Cybersecurity Vulnerability Assessment completed on a TSA form.²

The reporting clock: 12 to 24 to 72 hours

The reporting window doubled in 2022, then tripled in 2025. In TSA's own words from its 2024 proposed rule: "As originally issued, the directive required notification within 12 hours of identification. In May 2022, TSA revised this requirement to require notification within 24 hours of identification."²⁹ Then, in Pipeline-2021-01F, effective October 25, 2025, TSA's October 22, 2025 transmittal memo said the revision "modifies the cybersecurity incident reporting timeframe from 24 to 72 hours after the owner identifies an incident."³⁰ 01G kept the 72-hour window.²

The change brought TSA in line with the 72 hours in DFARS 252.204-7012 and in the CIRCIA statute, which matters to companies that answer to more than one regulator. Supporters of the change point to that alignment; the counterargument is that a longer window delays the government's view of an attack that could be spreading to other pipelines. The evidence on which window works better is thin: no public study compares the two periods.

Pipeline-2021-02G: what operators must do

The second series carries the technical requirements. The current version, Security Directive Pipeline-2021-02G, "Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing," is effective May 3, 2026 through May 2, 2027 and cancels 02F. The May 1, 2026 transmittal memo, signed by Ha Nguyen McNeill, Senior Official Performing the Duties of the Administrator, says: "There are no substantive revisions to the SD Pipeline-2021-02 series through this renewal."²⁸

It applies to owners and operators of TSA-designated critical hazardous liquid and natural gas pipelines or liquefied natural gas (LNG) facilities "notified before July 26, 2022," plus any TSA notifies later.²⁸ Covered companies must do three things: establish and carry out a TSA-approved Cybersecurity Implementation Plan; keep an up-to-date Cybersecurity Incident Response Plan; and maintain a Cybersecurity Assessment Plan, updated annually for TSA's approval, with an annual report of results. The plan must address these areas:²⁸

• Segmentation. Owners must "Implement network segmentation policies and controls designed to prevent operational disruption to the Operational Technology system if the Information Technology system is compromised or vice versa." That includes lists of IT and OT interdependencies, all external connections to OT and zone boundaries, and controls "To prohibit Operational Technology system services from traversing the Information Technology system, unless the content of the Operational Technology system is encrypted while in transit." This is the clearest federal statement anywhere of the IT/OT separation that lesson 7 builds for a plant.
• Access control. Multi-factor authentication or other controls with comparable risk reduction; if multi-factor authentication is not used on control-room industrial control workstations regulated under 49 CFR parts 192 or 195, the owner must specify compensating controls. Owners must also set a schedule for password resets and document mitigations for components that cannot meet it.
• Patching. The patch strategy must include a risk method for prioritizing patches and "Prioritization of all security patches and updates on CISA's Known Exploited Vulnerabilities Catalog." Where OT cannot be patched without "severe degradation of operational capability," the plan must describe other mitigations and a timeline. Lesson 5 explains why that exception exists.
• Testing. The assessment schedule "must ensure at least one-third (1/3) of the policies, procedures, measures, and capabilities in the TSA-approved Cybersecurity Implementation Plan are assessed each year, with 100 percent assessed over any three-year period," and may include red and purple team testing.
• Contractors. "Both Owner/Operators and Authorized Representatives are liable for non-compliance on the part of the Authorized Representative," and an owner that hands work to a managed security service provider "retains sole responsibility" for compliance. Outsourcing does not outsource the duty.

If you work on a covered pipeline and plan any change to segmentation, access or patching to meet these terms, plan it with the equipment vendor, your safety lead and qualified controls engineers, and test it first; a firewall rule that blocks a safety signal is a safety problem.

Rail directives, briefly

TSA runs a parallel set of directives for railroads. Security Directive 1580/82-2022-01E, "Rail Cybersecurity Mitigation Actions and Testing," is effective May 3, 2026 through May 2, 2027, with no substantive revisions; it applies to freight railroads identified in 49 CFR 1580.101 and other TSA-designated freight and passenger railroads.³⁰ Security Directive 1580-21-01E, "Enhancing Rail Cybersecurity," runs January 16, 2026 through January 15, 2027, with the same coordinator vetting change as Pipeline 01G. For a manufacturer, the rail directives matter mostly through the railroad that serves the plant's spur.

The stalled permanent rule

On November 7, 2024, TSA proposed a permanent rule, "Enhancing Surface Cyber Risk Management," at 89 FR 88488 (RIN 1652-AA74). It would write cyber risk management requirements for certain pipeline and rail owners and operators into the Code of Federal Regulations, and add incident reporting for certain over-the-road bus operators. Comments closed February 5, 2025.²⁹ TSA estimated "the preliminary 10-year total costs of the proposed rule to be about $2.6 billion discounted at a 3 percent discount rate and $2.2 billion discounted at 7 percent discount rate, with preliminary annualized costs of about $307.8 million."²⁹

The rule has not moved since. The federal Unified Agenda lists it as a "Long-Term Action" with a final rule date "To Be Determined," and no final rule has been published as of October 28, 2026.³ The 02G directive itself still says TSA "intends to permanently codify these requirements through notice-and-comment rulemaking."²⁸ Until then, the industry lives year to year under directives that can be renewed, changed or dropped with a signature.

What GAO found

The Government Accountability Office has reviewed TSA's pipeline work several times. In testimony on November 19, 2024 (GAO-25-107947), GAO's Tina Won Sherman said TSA had issued five cybersecurity directives since May 2021, but its directives "did not align with National Institute of Science and Technology's Ransomware leading practices," TSA had "not developed qualitative or quantitative metrics" for its work on internet-connected devices, and of six GAO recommendations to DHS and TSA, only one had been implemented, one had been partially addressed and four had not been implemented as of November 2024. Government-wide, GAO had made 126 critical infrastructure cybersecurity recommendations since 2010, and 64 were not fully put in place as of May 2024.³¹

Defense suppliers: DFARS, NIST SP 800-171 and CMMC

Thousands of small manufacturers, including machine shops, cable assembly makers, electronics assemblers and coating shops, make parts for defense contractors. For them, cybersecurity rules arrive through the contract. Government Contracts, Idaho Public Sector and Sectors walks a small contractor through FAR 52.204-21, SPRS scores, plans of action, the affirmation and flow-down. This section covers the rules' current status and what they mean on a plant floor.

DFARS 252.204-7012: the baseline that never paused

The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012, "Safeguarding Covered Defense Information and Cyber Incident Reporting," remains the baseline. Contractors that handle covered defense information must implement NIST SP 800-171 and "rapidly report" cyber incidents, which the clause defines as "within 72 hours of discovery of any cyber incident," directly to the Department at https://dibnet.dod.mil. Subcontractors report to the Department too and pass the incident report number up the chain. Filing a report requires a DoD-approved medium assurance certificate, which a small shop should get before it needs one, not during an incident.⁵

Which NIST revision? NIST published SP 800-171 Revision 3 on May 14, 2024, replacing Revision 2.³² But the Department of Defense issued Class Deviation 2024-O0013 on May 2, 2024, requiring contractors under DFARS 7012 to keep complying with Revision 2, to "provide industry time for a more deliberate transition."³² DFARS Class Deviation 2026-O0025, Revision 3, dated September 3, 2026, again "Requires baseline compliance with NIST SP 800-171 Rev 2 in accordance with the clause at DFARS 252.204-7012."⁵ A DoD interim final rule to move CMMC to Revision 3 is listed on the Unified Agenda but has not been published.³³ So as of October 28, 2026, Revision 2 and its 110 requirements are the standard defense suppliers are measured against.

One caution for anyone reading contracts in 2026: the class deviation carries out the "Revolutionary FAR Overhaul" ordered by Executive Order 14275 and OMB memo M-25-26 of May 2, 2025, and some clause numbers in new contracts differ from the codified DFARS text in 48 CFR. For example, the NIST SP 800-171 assessment requirement now appears in deviation contracts as clause 252.240-7997.⁵ Cite clause numbers "as of the 2026 class deviation" and read the contract in front of you.

The CMMC rules

The Cybersecurity Maturity Model Certification (CMMC) program exists because, for years, DFARS 7012 relied on contractors saying they complied. CMMC adds checking. It rests on two rules:

• The program rule, 32 CFR Part 170, published at 89 FR 83092 on October 15, 2024: "This rule is effective December 16, 2024." It defines the levels, the assessments and the phases.³⁴
• The DFARS acquisition rule, "Assessing Contractor Implementation of Cybersecurity Requirements," published at 90 FR 43560 on September 10, 2025: "This rule is effective November 10, 2025." It added solicitation provision 252.204-7025, contract clause 252.204-7021 and a 10-character CMMC unique identifier assigned in the Supplier Performance Risk System (SPRS).³⁵

The levels, in short: Level 1 (Self) covers the 15 basic requirements of FAR 52.204-21 for federal contract information (FCI), with an annual self-assessment and affirmation. Level 2 covers controlled unclassified information (CUI) with "the 110 security requirements from the NIST SP 800-171 R2," either by self-assessment every three years or by a Certified Third-Party Assessment Organization (C3PAO) every three years. Level 3 adds 24 selected requirements from NIST SP 800-172 (the February 2021 version), assessed by the Defense Contract Management Agency's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). Conditional status is possible at Levels 2 and 3 with a minimum score of 80 percent and a plan of action that must be closed within 180 days.³⁴ NIST updated SP 800-172 to Revision 3 on May 13, 2026, but CMMC Level 3 still points to the 2021 version.³³

CMMC on the plant floor: "specialized assets"

A question every defense machine shop eventually asks: does a CNC machine that loads a part program drawn from a controlled drawing have to meet all 110 requirements? The CMMC rule answers it with a category called "Specialized Assets," defined in the Level 2 scoping table at 32 CFR 170.19(c) as assets "that can process, store, or transmit CUI but are unable to be fully secured." The list of examples names "Operational Technology (OT)," along with Internet of Things and industrial Internet of Things devices, government-furnished equipment, restricted information systems and test equipment.³⁶

For Level 2, the contractor must record specialized assets in its asset inventory, describe how they are handled in its System Security Plan, show them on the network diagram of the assessment scope, and "Show these assets are managed using the contractor's risk-based security policies, procedures, and practices." Assessors review the plan but "Do not assess against other CMMC security requirements."³⁶ In plain terms, a controller that cannot run antivirus or take multi-factor sign-in is not failed for that, but it must be known, documented and walled off. That is why a good asset inventory and segmentation (the subject of lesson 7) do double duty for defense suppliers: they cut the number of systems inside the assessment scope and they protect the machines that can never be fully secured. Plan any network change on production machines with the machine builder, your safety lead and qualified controls engineers, and test it before it goes live.

The four phases and the July 2026 suspension

CMMC was designed to phase in over three years under 32 CFR 170.3(e). Phase 1 began on the effective date of the DFARS rule, November 10, 2025: the Department may require Level 1 (Self) or Level 2 (Self) as a condition of award. "Phase 2 begins one calendar year after the start date of Phase 1," which would have been November 10, 2026, adding Level 2 (C3PAO) certification as a condition of award. Phase 3 (planned November 10, 2027) would extend third-party certification to option periods and add Level 3, and Phase 4, "full implementation," would follow a year later (planned November 10, 2028).³⁴

That schedule broke in July 2026. On July 13, 2026, the Department of War suspended the move to Phase 2, which had been "scheduled to take effect" November 10, 2026, and created a CMMC Review and Reform Task Force with 60 days for a "top-to-bottom" review. The Department's chief information officer, Kirsten Davies, signed the memorandum. In the Department's release, Davies said strong cybersecurity "remains a critical, nonnegotiable priority," while the program was "creating prohibitive compliance costs and unacceptable bureaucratic burdens, especially to small businesses." Under Secretary for Acquisition and Sustainment Michael Duffey said industry was "drowning in peacetime paperwork and administrative bureaucracy." The release also said the pool of available assessors was too small to finish the needed evaluations before November.⁴

What is confirmed, and what is not

Because the suspension came by memo rather than by rule, it is easy to overstate or understate. Here is what the record shows as of October 28, 2026.

Confirmed. The memorandum is titled "Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements" and dated July 13, 2026. DFARS Class Deviation 2026-O0025, Revision 3, signed September 3, 2026 by John M. Tenaglia, Principal Director of Defense Pricing, Contracting, and Acquisition Policy, replacing Revision 2 of July 16, 2026, carries it out. As restated there, the memo permits Level 1 (Self) or Level 2 (Self) requirements in procurements; requires baseline NIST SP 800-171 Rev. 2 compliance under DFARS 252.204-7012; "Suspends the November 2026 CMMC Phase 2 transition"; directs amendments to active solicitations "as soon as practicable"; and directs removal of Level 2 (C3PAO) and Level 3 requirements from existing contracts "prior to the exercise of the next option period or through the next scheduled administrative modification."⁵ Phase 1 self-assessment requirements stayed in place, DFARS 7012 stayed in force, and where Level 1 (Self) or Level 2 (Self) applies, clause 252.204-7021 still requires a current self-assessment posted in SPRS.⁴³⁷

Also confirmed. No court ruling or lawsuit caused the suspension; it was an administrative decision tied to cost, burden and assessor capacity. A Federal Register search on October 28, 2026 found no amendment to 32 CFR Part 170: the rule is still on the books, and the change works through the contracting deviation. The Department's request for information, "Reforming CMMC and Reducing Compliance Burden for the Defense Industrial Base," posted July 13 to 14, 2026, closed August 14, 2026, and drew more than 1,100 responses, according to Davies as reported by trackers.³⁷

Not known. No public task force report and no restart date for Phase 2 existed as of October 28, 2026. The memorandum itself could not be downloaded by this module's researchers (the server refused access), so its terms are known only as restated in the class deviation and the Department's release. Federal News Network reported on October 27, 2026 that it had obtained an early-September summary of the task force's findings, which suggests restarting Phase 2 within 90 days with a narrower population of covered companies and names clearer marking of CUI as having the "greatest potential" to shrink the number of companies subject to NIST SP 800-171; the Department "declined to comment."³⁸ Treat that as a reported draft direction, not a decision. A related federal-wide rule on controlled unclassified information, proposed January 15, 2025 at 90 FR 4278 and re-proposed in June 2026 as part of the FAR overhaul, is also not final.³⁸

What CMMC costs, by DoD's own estimates

The cost argument drove the suspension, so the government's own numbers are worth knowing. In the 2024 program rule, DoD estimated how many entities would need each kind of assessment: 139,201 at Level 1 self-assessment (63 percent; 103,010 of them small), 4,000 at Level 2 self-assessment (2 percent), and 76,598 at Level 2 certification (35 percent; 56,689 small). It also estimated "8,350 medium and large entities will require CMMC Level 2 certification assessments."³⁴ Its per-assessment cost estimates for a small entity were about $5,977 a year for Level 1, about $37,196 per three-year cycle for a Level 2 self-assessment, about $104,670 per three-year cycle for Level 2 C3PAO certification, and about $10,933 for the Level 3 assessment portion. For larger entities the figures were $4,042, $48,827, $117,768 and $41,050.³⁴ Those figures cover assessments only. They do not include the cost of actually putting the NIST controls in place, which for a shop starting from scratch is usually the larger bill. DoD's estimate of annualized costs to industry and government together was about $4.0 billion a year at a 7 percent discount rate (about $4.23 billion at a 3 percent rate).³⁴ The DFARS rule counted 28,164 unique entities a year with contracts above the micro-purchase threshold, after removing 4,592 awardees with only commercial off-the-shelf contracts.³⁵

The False Claims Act: the risk that did not pause

The suspension did not suspend liability. The Justice Department's Civil Cyber-Fraud Initiative, announced October 6, 2021 by then Deputy Attorney General Lisa O. Monaco, "will utilize the False Claims Act to pursue cybersecurity related fraud by government contractors and grant recipients."³⁹ The False Claims Act lets the government recover damages and penalties from companies that bill it while falsely claiming to meet contract terms, and lets whistleblowers (called relators) share in the recovery. These cases rest on DFARS 7012 and on SPRS self-assessment scores, both still required, so the suspension of Phase 2 did not lower that risk.³⁷

Other 2025 resolutions listed by trackers include Health Net Federal Services and Centene ($11,253,400, February 18, 2025), Hill ASC (at least $14,750,000, July 14, 2025) and Illumina ($9,800,000, July 31, 2025, over product cybersecurity in genomic sequencers).⁴⁰ The trackers reviewed for this lesson showed no cyber False Claims Act resolution after September 1, 2026.⁴⁰ The common lesson in these cases is not that the companies were hacked; most were not. It is that they told the government their security score was higher than it was, and kept billing.

FDA section 524B for device makers

Medical device makers carry a product cybersecurity duty that most manufacturers do not. Section 524B of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360n-2), "Ensuring Cybersecurity of Devices," was added by section 3305 of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328, signed December 29, 2022). It took effect March 29, 2023 for premarket submissions for "cyber devices."⁴⁴

A "cyber device" under section 524B(c) is one that includes software validated, installed or authorized by the sponsor; can connect to the internet; and has technological characteristics that could be vulnerable to cybersecurity threats. For those devices, section 524B(b) requires a plan to monitor, identify and address postmarket vulnerabilities and exploits, including coordinated vulnerability disclosure; processes that "provide a reasonable assurance that the device and related systems are cybersecure," including updates and patches; and a software bill of materials (SBOM, a list of the software components inside the product). FDA's guidance puts it plainly: "For cyber devices, an SBOM is required."⁴⁴

FDA's guidance, "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions," was first issued in final form September 27, 2023, updated June 27, 2025, and reissued February 3, 2026 to align its references with FDA's new Quality Management System Regulation (QMSR).⁴⁵ The QMSR, published February 2, 2024 at 89 FR 7496, amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference; FDA says "The rule became effective, February 2, 2026."⁴⁵ Postmarket, FDA's December 2016 final guidance on postmarket cybersecurity management is still the framework.

Device makers therefore have two separate cyber duties: one for the product they ship (section 524B) and one for the quality system that designs and builds it (QMSR). Neither one, by its terms, sets requirements for the plant-floor control systems in the factory that makes the device; those fall under the general practices in the rest of this module. The hospital side, where these devices are used and patched, is covered in Medical Devices and Clinical Technology.

Water and wastewater

Many plants treat their own process water or pretreat wastewater before it goes to a city system, and some manufacturers own a water system that serves a town. The federal cyber rule for water is narrow. America's Water Infrastructure Act of 2018 (AWIA), section 2013, amended Safe Drinking Water Act section 1433 (42 U.S.C. 300i-2). In EPA's words: "Section 1433 of the SDWA requires all CWSs serving more than 3,300 people to conduct Risk and Resilience Assessments (RRAs), develop Emergency Response Plans (ERPs) and certify their completion to EPA. Additionally, systems must review their RRA and ERP every five years, revise them if necessary, and certify completion of these steps to EPA."⁴⁶

A factory that treats water only for its own process use is generally not a "community water system," so section 1433 usually does not reach it. A plant that supplies drinking water to a resident population, or a manufacturer that owns a utility, could be covered; check the Safe Drinking Water Act definitions for the specific facility. Wastewater systems are not covered by section 1433 at all.

The 2023 memo and its withdrawal

EPA tried to go further in 2023. Its March 3, 2023 interpretive memorandum, "Addressing Public Water System Cybersecurity in Sanitary Surveys or an Alternate Process," would have required states to evaluate cybersecurity during the periodic sanitary surveys of public water systems. Missouri, Arkansas and Iowa, joined by water associations, challenged it, and the U.S. Court of Appeals for the Eighth Circuit paused it on July 12, 2023 in State of Missouri, et al. v. U.S. EPA. EPA rescinded the memo on October 11, 2023; the rescission memo, signed by Radhika Fox, Assistant Administrator for Water, says it acted "Due to litigation (State of Missouri, et al v. U.S. EPA)."⁴⁷

The May 2024 enforcement alert

Without new authority, EPA turned to enforcing the requirement it had. Its "Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities," issued May 2024, reported: "Over 70% of the systems inspected by EPA since September 2023 are in violation of basic SDWA Section 1433 requirements including missing specific sections of the RRA and ERP." Inspectors found systems that "failed to change default passwords, use single logins for all staff, or failed to curtail access by former employees."⁴⁶ In July 2025 EPA issued non-regulatory recommendations, and on August 5, 2025 it opened about $9 million in grants for systems serving 10,000 or more people. Recertification deadlines for assessments came due December 31, 2025 for systems serving 50,000 to 99,999 people and June 30, 2026 for systems serving 3,301 to 49,999.⁴⁸

The threat did not wait. In late July 2026 a coordinated attack hit more than 30 municipal water systems in Minnesota, taking one treatment plant offline for hours, and utilities in at least seven states reported incidents to the FBI after July 27, 2026. Federal guidance in 2026 told operators to take PLCs off direct internet exposure, route remote access through a VPN or secure gateway, change default passwords, restrict PLC access with firewall rules, secure cellular modems and keep the ability to run manually with tested backups.⁴⁸ Lesson 3 covers those attacks.

Congress has bills pending. The Water Cybersecurity Enhancement Act of 2025 (S. 1549) and the Water Cyber Shield Act of 2026 (S. 5368, introduced by Sen. Adam Schiff) are among them; the second would require cyber in the risk assessments and emergency plans, have EPA set risk-based baseline standards with CISA and NIST, sample-inspect systems each year, and authorize $300 million each for the drinking water and clean water state revolving funds for cyber.⁴⁹ Neither had become law as of this lesson's research, though this lesson could not check the final status on congress.gov.

Chemical plants: CFATS and the Risk Management Program

Until 2023, chemical facilities with large amounts of "chemicals of interest" had a security rule with a cyber component: the Chemical Facility Anti-Terrorism Standards (CFATS), 6 CFR Part 27. It is gone, at least for now. CISA's program page states: "As of July 28, 2023, Congress allowed the statutory authority for the Chemical Facility Anti-Terrorism Standards (CFATS) program (6 CFR Part 27) to expire. Therefore, CISA cannot enforce compliance with the CFATS regulations at this time."⁷ CISA lists what the lapse means: about 3,200 facilities that had been designated high-risk; about 7,000 schools, colleges and universities within a mile of such facilities; about 160 inspections a month not done; about 9,000 names a month not vetted against terrorist databases; and CISA "cannot require the implementation of cyber and physical security measures." It points facilities to its voluntary ChemLock program instead.⁷

As of October 28, 2026, CFATS remains lapsed, and CISA's fiscal 2026 budget justification proposed phasing out the chemical security inspector positions and program.⁵⁰ When CFATS was in force, one of its risk-based performance standards addressed cyber; this lesson did not re-read that standard's text.

The rule that does still apply to many chemical, refining and food plants with large ammonia or chlorine systems is EPA's Risk Management Program under Clean Air Act section 112(r). It is an accident prevention rule, not a security rule, and it has no explicit cybersecurity controls. EPA's 2024 "Safer Communities by Chemical Accident Prevention" rule (89 FR 17622, March 11, 2024, effective May 10, 2024) added requirements, and on February 24, 2026 EPA proposed rolling parts of it back in the "Common Sense Approach to Chemical Accident Prevention" (91 FR 8970). The proposal would drop the safer technology and alternatives analysis requirement, rescind or limit third-party audits, and restrict the RMP Public Data Tool to county-level search without maps; no final rule had been published as of October 28, 2026.⁵¹ The provisions on natural hazards and power loss are where a loss of control systems is most relevant. A cyber incident that defeats the controls on a hazardous process is a process safety event, which is why lesson 5 treats safety and security together.

Maritime: the Coast Guard cyber rule

A chemical plant, refinery, steel mill or grain terminal with its own regulated dock is a "facility" under the Maritime Transportation Security Act (MTSA), and that brings in a newer rule. The Coast Guard's final rule "Cybersecurity in the Marine Transportation System," 90 FR 6298, published January 17, 2025, says: "This final rule is effective July 16, 2025." It adds 33 CFR Part 101, subpart F, and applies to U.S.-flagged vessels, Outer Continental Shelf facilities and MTSA-regulated facilities under 33 CFR parts 104, 105 and 106.⁵²

The deadlines, from the Coast Guard's implementation timeline:⁵²

• From July 16, 2025: report reportable cyber incidents to the National Response Center "without delay."
• By January 12, 2026, and every year after: cybersecurity training for all personnel under 33 CFR 101.650.
• By July 16, 2027: designate a Cybersecurity Officer, complete a Cybersecurity Assessment, and submit a Cybersecurity Plan for Coast Guard approval (the plan is due "within 24 months of the effective date").
• Ongoing: two cybersecurity drills every 12 months; plans renewed every five years.

The final rule sought comments, due March 18, 2025, on "a potential 2-to-5-year delay for the implementation periods for U.S.-flagged vessels." A Federal Register search on October 28, 2026 found no later rule delaying the deadlines, and the Coast Guard's timeline page still lists January 12, 2026 and July 16, 2027.⁵² A vessel-only delay could still come, so check before relying on the vessel dates.

CIRCIA: the reporting rule still waiting

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), signed March 15, 2022 (6 U.S.C. 681 to 681g), will be the first federal law to require incident reports from a wide range of critical infrastructure companies, including some manufacturers. Once its rule takes effect, covered entities must report covered cyber incidents to CISA "within 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred" and ransom payments "within 24 hours after the ransom payment has been made."⁵³ The basics are in Federal Laws That Reach Your Business; here is what matters for manufacturers.

CISA's proposed rule, published April 4, 2024 at 89 FR 23644, would cover "any entity that owns or has business operations that engage in one or more of the listed categories of manufacturing, which are the four manufacturing industries that together currently constitute the Critical Manufacturing Sector": primary metal manufacturing (NAICS 331), machinery (NAICS 333), electrical equipment, appliances and components (NAICS 335), and transportation equipment (NAICS 336). The proposal also has a general size-based test for entities in a critical infrastructure sector that exceed the Small Business Administration's size standard, which could reach other manufacturers.⁵³ CISA estimated "316,244 entities potentially affected by the proposed rule" submitting about 210,525 reports over the analysis period, at a total cost of $2.6 billion undiscounted ($1.4 billion for industry and $1.2 billion for government).⁵³

The statute required a final rule within 18 months of the proposal, about October 2025. CISA missed that date and set internal targets of May 2026, then September 2026.⁶ Town halls announced in February 2026 to refine "the scope and burden" were canceled by the DHS appropriations lapse and rescheduled as virtual sessions June 15 to 18, 2026, with the Critical Manufacturing Sector heard on June 18.⁵⁴ CISA sent the draft final rule to OMB's Office of Information and Regulatory Affairs (OIRA) for review on October 1, 2026, according to law firm and trade press reports. It had not been published as of October 28, 2026. OIRA review can take up to 90 days, so publication may slip into early 2027, and the rule is expected to take effect no sooner than 60 days after publication.⁶ The White House's March 6, 2026 cyber strategy said CIRCIA is being aligned to reduce burden and harmonize reporting, so the final rule may differ from the proposal.⁵⁵ Until it takes effect, CIRCIA reporting is not mandatory; CISA encourages voluntary reports.

SEC rules for public manufacturers

A publicly traded manufacturer has a disclosure duty that has nothing to do with what it makes. The SEC's final rule "Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure," 88 FR 51896, published August 4, 2023 and effective September 5, 2023, created two requirements. Form 8-K Item 1.05: "An Item 1.05 Form 8-K must be filed within four business days of determining an incident was material." A delay is allowed only if "the United States Attorney General" determines that immediate disclosure "would pose a substantial risk to national security or public safety." And Regulation S-K Item 106 requires an annual description in the 10-K of the company's cyber risk management, strategy and governance, including the board's oversight.⁵⁶ Item 1.05 compliance began December 18, 2023 for most companies and June 15, 2024 for smaller reporting companies.⁵⁶

The four-day clock starts at the materiality decision, not at the attack, and the company must make that decision "without unreasonable delay after discovery of the incident."⁵⁶ For a manufacturer, materiality often turns on operations: a plant that cannot ship, a production line down for weeks, or lost orders. On May 21, 2024, the SEC's Director of Corporation Finance, Erik Gerding, said "Item 1.05 is not a voluntary disclosure." Companies disclosing an incident that is immaterial or not yet assessed should use "a different item of Form 8-K (for example, Item 8.01)," and if the incident is later found material, the company should "file an Item 1.05 Form 8-K within four business days."⁵⁷

Manufacturers that have filed

This module's researchers checked SEC EDGAR filing indexes for three manufacturers that filed under Item 1.05: Sensata Technologies (filed April 9, 2025), Nucor (filed May 14, 2025, amended June 20, 2025) and Stryker (an amended 8-K/A under Item 1.05, filed April 9, 2026).⁵⁸ A 2026 tracker by Cherry Hill Advisory lists other manufacturers among Item 1.05 filers and counted 47 Item 1.05 filings and 31 voluntary Item 8.01 cyber filings from December 2023 to May 2026; this lesson did not check each of those on EDGAR.⁵⁹

A common mistake in news coverage is to call the 2023 Clorox and Johnson Controls disclosures Item 1.05 filings. They were not. Both companies had major attacks in 2023 but filed under Item 8.01, before Item 1.05 took effect: EDGAR shows Clorox 8-Ks on August 14 and September 18, 2023, and Johnson Controls 8-Ks on September 27 and November 13, 2023, all using Item 8.01.⁵⁸

The rule is under review

Five financial trade groups petitioned the SEC in May 2025 to rescind Item 1.05, and the National Association of Manufacturers backed the petition on June 18, 2025, urging the SEC to eliminate the four-business-day requirement and return to "a more flexible approach."⁶⁰ On January 13, 2026, SEC Chairman Paul Atkins announced a broad review of Regulation S-K and requested comment, with comments due April 13, 2026.⁶¹ As of October 28, 2026, no amendment had been proposed or adopted, so Item 1.05 and Item 106 remain in effect. Public manufacturers should plan to file as the rule now reads.

Exporters: the EU Cyber Resilience Act, NIS2 and machinery

An Idaho company that ships controllers, sensors, machines or software to Europe may face stricter product cyber rules there than at home. Three EU laws matter most.

The Cyber Resilience Act

Regulation (EU) 2024/2847, the Cyber Resilience Act (CRA), covers "products with digital elements" placed on the EU market, including industrial and OT products, wherever they are made. It entered into force December 10, 2024, and its main obligations apply from December 11, 2027.⁶² Its reporting duties under Article 14 started earlier, on September 11, 2026, and apply even to products placed on the market before December 2027. Manufacturers must report actively exploited vulnerabilities and severe incidents: an early warning within 24 hours of becoming aware, a notification within 72 hours, and a final report no later than 14 days after a fix is available (for vulnerabilities) or within one month (for severe incidents).⁸ ENISA, the EU cybersecurity agency, launched the CRA Single Reporting Platform on September 11, 2026; one report goes to the coordinating national computer security incident response team and to ENISA.⁸

Fines can reach EUR 15 million or 2.5 percent of worldwide annual turnover, whichever is higher, for breaches of the essential requirements; microenterprises and small enterprises are not fined for missing the 24-hour early warning.⁶² Manufacturers must handle vulnerabilities for a support period that "should be no less than five years" unless the product's expected use is shorter, and the regulation's recitals note that longer periods may suit products such as industrial control systems, which often run for decades.⁶² As of early September 2026, no harmonised CRA standard had been cited in the EU's Official Journal.

NIS2

Directive (EU) 2022/2555 (NIS2) replaced the first EU network security directive; member states "had until 17 October 2024 to transpose" it into national law, and it added manufacturing of critical products to the covered sectors.⁶³ Incident reporting follows the same pattern: an early warning "within 24 hours," an incident notification "within 72 hours of becoming aware of the significant incident," and a final report "not later than one month after the incident notification."⁶³ Transposition has been uneven: Germany's law took effect December 6, 2025, the Netherlands' lower house approved its law April 15, 2026, and the European Commission had open proceedings against several states, including Spain, Ireland and Poland, in 2026.⁶⁴ NIS2 duties generally fall on organizations established or providing services in the EU, such as a European subsidiary or plant, while the CRA follows the product wherever it is made.

The Machinery Regulation

Regulation (EU) 2023/1230 replaces the Machinery Directive 2006/42/EC and applies from January 20, 2027. Its essential requirements include protection against corruption (Annex III section 1.1.9) and safety and reliability of control systems (section 1.2.1), and Article 20(9) lets manufacturers use EU cybersecurity certificates to presume conformity with those sections.⁶⁵ Machinery makers' associations asked the European Commission in January 2026 to postpone the cyber provisions to December 11, 2027, to line up with the CRA; the European Trade Union Confederation opposed the delay, and as of the latest report read no postponement had been adopted.⁶⁵ For a U.S. builder of packaging lines or food-processing machines sold into Europe, January 20, 2027 is the date to plan around.

Idaho law

Idaho has no cybersecurity rule for private industrial plants. What it has is a breach notice law, a security law for state agencies and a short list of failed bills.

The breach notice law

Idaho Code 28-51-104 to 28-51-107, enacted in 2006, applies to any "city, county or state agency, individual or a commercial entity that conducts business in Idaho and that owns or licenses computerized data that includes personal information about a resident of Idaho." On learning of a breach, the business must "conduct in good faith a reasonable and prompt investigation," and if misuse "has occurred or is reasonably likely to occur," it must notify affected residents "in the most expedient time possible and without unreasonable delay."⁹ "Personal information" means an Idaho resident's first name or first initial and last name plus a Social Security number, driver's license or Idaho ID number, or a financial account or card number with any required code or password, when not encrypted.⁹

For a manufacturer, the law covers employee and customer personal information, such as HR and payroll files, not trade secrets, drawings or production data. A ransomware attack on a plant triggers it only if personal information was illegally acquired and misuse is reasonably likely, and because ransomware attacks often involve copying files as well as locking them, a plant should check whether HR or payroll data was taken. A vendor that holds data it does not own must notify the owner "immediately following discovery of a breach" when misuse is reasonably likely.⁹ State agencies (not private businesses) must notify the Idaho Attorney General within 24 hours.⁹ Anyone who "intentionally fails to give notice" faces "a fine of not more than twenty-five thousand dollars ($25,000) per breach of the security of the system," and for most private businesses the enforcing "primary regulator" is the Idaho Attorney General.⁹ The full law is explained in Idaho Privacy Law Up Close, and other states' laws, which apply when you employ people who live elsewhere, in Breach Notification Laws in All 50 States.

House Bill 35 and state agencies

House Bill 35 (2025), Session Law Chapter 6, signed February 24, 2025 and effective July 1, 2025, amended Idaho Code 67-827A, which sets the powers and duties of the Office of Information Technology Services, to "require the implementation of cybersecurity best practices" and multifactor identification. It also amended section 67-831 and added section 67-2362, applying multifactor identification to the legislative and judicial branches and elected constitutional officers.⁶⁶ It does not reach private companies, but it shapes what state agencies may ask of vendors, including manufacturers that sell to the state.

The bills that did not pass

Idaho lawmakers have introduced bills to create crimes of "impeding critical infrastructure" and "critical infrastructure trespass" (Senate Bill 1090 in 2019 and House Bill 519 in 2024) and "strategic facility" trespass (House Bill 155 in 2025). Each was referred to committee with no further action shown. Idaho has no general ban on drone flights over critical infrastructure; its 2026 drone law (House Bill 522, Idaho Code 20-251, effective July 1, 2026) covers Idaho Department of Correction facilities only.⁶⁷ An Insurance Data Security Act (House Bill 117, 2025) also failed, returned to committee March 20, 2025.⁶⁷

The Idaho PUC

As described above, the Idaho Public Utilities Commission regulates investor-owned electric, gas, water and telecommunications utilities but has no commission-level cybersecurity rule; cyber reliability for Idaho Power and Avista is enforced through NERC and WECC.²⁵ The commission still matters because utilities recover security costs through rates, and those filings are public.

The reporting clocks side by side

A plant that answers to several rules can owe several reports for one incident, each with its own clock and its own recipient. The chart below lines them up. Build these into your incident response plan before you need them, with the name, phone number and portal for each recipient.

Putting it together for one plant

Go back to the three Idaho businesses from the start of this lesson and run them through the chart.

The Nampa machine shop answers yes to the defense question and the Idaho breach question. Its contract almost certainly carries DFARS 252.204-7012 if it touches covered defense information, so it needs NIST SP 800-171 Rev. 2 in place, a current score in SPRS, a medium assurance certificate for 72-hour reporting and an incident plan that includes its prime. Phase 2's suspension means it may not need a third-party certificate on its next award, but its self-assessment score is still a statement to the government, and the False Claims Act cases above show what happens when that score is wrong. Its CNC machines and coordinate measuring machine are likely "specialized assets": inventoried, documented and segmented, not tested against every control. If it is part of a public company's supply chain, its customer's SEC disclosures may ask about it too.

The Magic Valley food processor answers yes only to the Idaho breach question, unless it holds enough anhydrous ammonia for its refrigeration system to fall under EPA's Risk Management Program, in which case that program's accident prevention duties apply (with no explicit cyber controls). No federal rule sets cyber requirements for its PLCs or its wastewater pretreatment. Its insurer, its large grocery customers and voluntary standards will set its bar, and the water sector advisories of 2026 are a good guide for its treatment controls even though it is not a water utility.

The utility answers yes to NERC CIP and, if publicly traded, to the SEC rules. It has the most detailed duties of the three, and the shortest reporting clock.

Whatever your plant's answers, the practical steps are similar: keep an inventory of control system assets, segment control networks from business networks, control vendor remote access, have an incident plan that names every regulator and customer you must notify and by when, and assign one person to track rule changes. Make changes to production systems only after planning them with the equipment vendor, your safety lead and qualified controls engineers, and test them first.

Common mistakes

• Posting a security score you cannot back up. MORSECORP reported a NIST SP 800-171 score of 104 in January 2021; a consultant later found -142, and the company did not update the score until June 2023, after a subpoena. It paid $4.6 million.⁴¹ Georgia Tech Research Corporation submitted what the government called a "fictitious" campus-wide score of 98.⁴² LOGZONE billed Navy contracts for nearly four years without required controls; an assessment scored it -170.⁴² The score in SPRS is a statement to the government. Treat it like one.
• Reading the CMMC suspension as a pause on everything. The July 13, 2026 memo suspended only the move to Phase 2. DFARS 7012, NIST SP 800-171 Rev. 2, 72-hour reporting and SPRS self-assessments all continue, and the Honeywell settlement came seven weeks after the suspension.⁵⁴³
• Implementing Rev. 3 and assuming that settles it. NIST SP 800-171 Rev. 3 is the newer document, but defense contracts still require Rev. 2 under the September 3, 2026 class deviation. Map your controls to Rev. 2 for the contract, even if you also use Rev. 3 as a guide.⁵
• Leaving the basics undone at a regulated system. EPA found that over 70 percent of water systems it inspected after September 2023 violated basic section 1433 requirements, and inspectors found default passwords, shared logins and former employees who still had access.⁴⁶ None of those takes special technology to fix.
• Thinking a managed service provider takes the duty with it. TSA's 02G directive says an owner that hands security work to a managed security service provider "retains sole responsibility" for compliance.²⁸ The same logic runs through DFARS flow-down and NERC CIP.
• Calling an 8.01 filing an 1.05 filing, or the reverse. Clorox and Johnson Controls disclosed their 2023 attacks under Item 8.01, before Item 1.05 took effect. Reports that call those Item 1.05 filings are wrong.⁵⁸ For your own company, the SEC staff has said Item 1.05 is for material incidents only.⁵⁷
• Planning for CIRCIA as if it were already law, or ignoring it. As of October 28, 2026 its rule is at White House review and not in force. But a manufacturer in NAICS 331, 333, 335 or 336 may be covered when it arrives, with 72-hour and 24-hour clocks.⁵³
• Assuming a long list of violations means a small fine. The 2019 Duke Energy settlement covered 127 CIP violations, 13 rated serious, and cost $10 million, the largest CIP penalty on record at the time.²⁴ Small, repeated lapses add up.
• Treating an annual directive as permanent. TSA directives expire after a year and are renewed, sometimes with changes, such as the 2025 move from 24 to 72 hours. Check the version number, not last year's binder.³⁰

Questions people ask

We are a small manufacturer with no defense work and no public shares. Does any federal cyber rule apply to us?

Probably not one written for your plant floor, unless you own a regulated water system, a regulated dock, hazardous chemicals above EPA thresholds, or sell into the EU. CIRCIA may reach you if you are in a Critical Manufacturing industry once its rule takes effect. Idaho's breach notice law applies to the personal information you hold about employees and customers. Your customers' contracts and your insurer may impose more than any regulator does, so read them.

Does the CMMC suspension mean we can stop working on NIST SP 800-171?

No. DFARS 252.204-7012 still requires NIST SP 800-171 Rev. 2 for covered defense information, and Level 1 or Level 2 self-assessments still go in SPRS where they apply.⁵ The suspension removed the near-term requirement for a third-party certificate. Federal News Network reported that the task force's draft direction is to restart Phase 2 within 90 days with a narrower population, though the Department has not announced that.³⁸ A shop that stops now may find itself starting over on short notice.

Our plant runs a gas-fired cogeneration unit. Are we under NERC CIP?

Only if you are registered with NERC for a function such as generator owner or operator, which depends on whether the unit meets the bulk electric system thresholds and how it connects to the grid. Check the NERC Compliance Registry and ask your interconnecting utility. If you are registered, your systems would be rated under CIP-002 and most likely be low impact, which brings in CIP-003-9's vendor remote access program.²²

Who do we report to if we are hit by ransomware and no rule applies?

Voluntary reporting to CISA (cisa.gov/report) and to the FBI is encouraged, and CISA 2015 currently protects good-faith sharing of threat indicators, at least until December 11, 2026 unless Congress renews it.¹³ If personal information was taken, Idaho's breach law may require notice to affected residents.⁹ Tell your insurer promptly; policies usually set their own notice terms. If you supply a regulated customer, your contract may require you to tell them within a set time.

Does the Idaho Public Utilities Commission set cyber rules for Idaho Power?

No. The commission has no commission-level cybersecurity rule. Grid cybersecurity for Idaho Power and Avista is set by the NERC CIP standards and enforced by WECC under FERC's oversight. The commission sees cybersecurity mainly through rate cases, where utilities seek to recover what they spend.²⁵¹⁰

We sell controllers to a German customer. What do we owe under the CRA right now?

Since September 11, 2026, a manufacturer of a product with digital elements on the EU market must report actively exploited vulnerabilities and severe incidents: 24-hour early warning, 72-hour notification and a final report, through ENISA's Single Reporting Platform. The full secure-design and vulnerability-handling duties apply from December 11, 2027.⁸ If your products are machinery, the Machinery Regulation's cyber-related requirements apply from January 20, 2027.⁶⁵

Is the SEC rule going away?

Maybe, but not yet. The SEC opened a review of Regulation S-K in January 2026, and business groups including the National Association of Manufacturers asked it to drop the four-business-day 8-K. As of October 28, 2026, no amendment has been proposed, so the rule applies as written.⁶¹⁶⁰

Hard questions

Should TSA's pipeline directives become a permanent rule?

The case for a permanent rule: Security directives are issued without notice and comment and expire every year, so pipeline operators cannot plan multi-year investments with confidence and the public has no formal say. A rule written through notice and comment would be more durable, more open and more defensible in court. TSA itself says it "intends to permanently codify these requirements."²⁸ GAO found gaps in TSA's directives and its metrics, which a careful rulemaking could address.³¹

The case against, or for waiting: TSA estimated the proposed rule would cost about $2.6 billion over 10 years at a 3 percent discount rate.²⁹ Directives can be adjusted every year to match the threat, as the 2025 change to 72-hour reporting shows, while a codified rule is slow to change. Some operators argue the performance-based directives already work and that a permanent rule would add paperwork without adding security.

What the evidence shows: No public study measures whether pipeline security improved under the directives. GAO's 2024 testimony found TSA lacked metrics to tell, which is itself the strongest point both sides can agree on: without measurement, neither side's claim can be proven.³¹

Is CMMC worth its cost to small shops?

The case for CMMC: For years DFARS 7012 relied on contractors' own word, and the False Claims Act cases show that some of those words were false: a score of 104 that should have been -142, a "fictitious" 98, a contractor at -170 billing the Navy.⁴¹⁴² Adversaries target small suppliers because they are the weakest link to defense programs. Independent checks are how other high-stakes industries verify safety claims.

The case against the current design: DoD's own estimates put a small company's Level 2 certification at about $104,670 per three-year cycle for the assessment alone, before the cost of putting controls in place.³⁴ The Department's own leaders said in July 2026 that the program was "creating prohibitive compliance costs and unacceptable bureaucratic burdens, especially to small businesses," and that there were not enough assessors.⁴ Small shops may leave the defense supply base, which could weaken it more than a breach would.

What the evidence shows: The cost figures are DoD's estimates, not measured outcomes. The FCA cases show that self-attestation failed in specific, documented instances; they do not show how common false scores are. The reported task force direction, narrowing who must comply by marking CUI more clearly, would address both sides' concern if it holds.³⁸

Regulation or voluntary standards: which works better for industrial security?

The case for regulation: Voluntary approaches left gaps: EPA found over 70 percent of inspected water systems violating even the basic section 1433 requirements, and inspectors found default passwords and shared logins.⁴⁶ The grid, which has had mandatory standards since 2008, has detailed public enforcement records, and Congress responded to Colonial with mandatory pipeline rules.

The case for voluntary standards: Rules lag threats and lock in yesterday's practices. They can push companies to buy compliance instead of security. The suspension of CMMC Phase 2, the SEC's review of its disclosure rules and the March 2026 national cyber strategy's call for "common-sense regulation" all reflect a view that burdens had grown faster than benefits.⁵⁵ Standards such as IEC 62443 are written by engineers and updated by them.

What the evidence shows: There is no controlled comparison. What is documented is that regulators repeatedly found basic failures (passwords, access, inventory) at regulated operators, which suggests that neither approach alone gets the basics done without inspection.

Who should pay to secure small water systems?

The case for federal money: Small water systems have tiny budgets and no security staff, and the 2026 attacks hit municipal systems in several states.⁴⁸ The Water Cyber Shield Act would authorize $300 million each for the drinking water and clean water revolving funds for cyber, and EPA's 2025 grants were about $9 million.⁴⁹⁴⁸

The case for ratepayers and states: Federal grants are small relative to the need and can come with strings; utilities that charge rates are best placed to fund their own basics, many of which (changing passwords, removing former employees' access) cost little. The states that challenged EPA's 2023 memo argued that EPA had overstepped its authority.⁴⁷

What the evidence shows: The most common findings were low-cost failures, which money alone does not fix. Larger investments, such as replacing old PLCs or adding monitoring, do cost real money that small systems often lack. Both points are documented.

Where to go next

• CISA ICS advisories: Free. CISA's running list of vulnerabilities in industrial control products by vendor and model. Plant engineers can check their equipment; reporters can see which products are affected.
• CISA incident reporting portal: Free. Where TSA-covered pipelines must send 72-hour reports and where any organization can report an incident voluntarily. Bookmark it in your incident response plan.
• NERC Reliability Standards (United States): Free. NERC's table of U.S. standards and effective dates. Open it in a browser (it loads with JavaScript) to confirm which CIP version is in force before quoting one.
• TSA Security Directives and Emergency Amendments: Free. TSA's page of public security directives for pipelines and rail, with transmittal memos. Check it each January and May for renewals.
• DoD CIO CMMC program page: Free. The Department's official CMMC information, including program documents and updates. Check here first for any Phase 2 restart announcement.
• NIST SP 800-171 Rev. 2 and Rev. 3 (NIST CSRC): Free. The NIST publications behind DFARS 7012 and CMMC Level 2. Defense contracts still require Rev. 2; Rev. 3 is useful as a guide.
• SEC EDGAR full-text search: Free. Search 8-K filings for "Item 1.05" to find material cyber incident disclosures by public manufacturers.
• ENISA CRA Single Reporting Platform news: Free. Explains the EU platform exporters use for 24-hour and 72-hour Cyber Resilience Act reports since September 11, 2026.

Still being checked (14 items)

These points could not be fully confirmed against a primary source when this lesson was written and fact checked in October 2026. The text above states each one as uncertain.

• NERC's U.S. effective-dates page could not be read as text; the in-force versions of CIP-004 (CIP-004-7), CIP-006 to CIP-009 (CIP-006-6, CIP-007-6, CIP-008-6, CIP-009-6) and CIP-011 (CIP-011-3) are inferred, and the CIP-012-2 effective date of July 1, 2026 is a calculation from NERC's 24-month implementation plan.
• The CIP-003-11 compliance date reported by one consultant (July 1, 2029) was not confirmed in NERC's implementation plan; the lesson calls it unconfirmed.
• CIP-015-2 was approved by a FERC order in Docket RD26-6-000 issued Aug. 10, 2026, according to FERC's paperwork notice at 91 FR 64921; the order itself and CIP-015-2's effective date were not read.
• The CIP-008-6 reporting deadlines are taken from a 2019 law firm summary, not re-read in the standard's text.
• The DoW CIO memorandum of July 13, 2026 could not be downloaded (HTTP 403); its terms are stated as restated in DFARS Class Deviation 2026-O0025 Rev. 3 and the Department's release.
• The CMMC task force findings reported by Federal News Network (Oct. 27, 2026) are a reported draft direction; DoD declined to comment, and no restart date or final report exists.
• The Raytheon/RTX/Nightwing settlement amount is reported as $8.4 million or $8.5 million.
• The CIRCIA OIRA receipt date (Oct. 1, 2026) rests on law firm and trade press reports; the reginfo.gov record could not be loaded.
• The final enacted fiscal 2026 CISA appropriation figure was not found; CISA staffing figures rest on press reports.
• The status of the water bills S. 1549 and S. 5368 was not checked on congress.gov.
• Whether any particular manufacturer is a NERC registered entity must be checked against the NERC Compliance Registry; WECC ballot body membership is not proof of registered functions.
• The exact day of EPA's May 2024 water enforcement alert (reported as May 20) is not on EPA's page; the lesson says May 2024.
• The Honeywell settlement: DOJ's Sept. 1, 2026 release refers to one network; Bass Berry & Sims' summary of the settlement agreement names two (Grey and Gold) and gives the $972,628 restitution figure, which is not in the DOJ release.
• The date the President signed the fiscal 2026 DHS funding bill was not confirmed; GovInfoSecurity reports House passage on April 30, 2026.

Last verified October 28, 2026. General education, not legal, engineering, safety or compliance advice; rule versions and dates are stated in the text, and the sources used are listed in the Notes and Sources below. Check the regulator's current text before relying on any point.

Notes

1. 18 CFR 385.1602(d), civil monetary penalty inflation adjustments, eCFR text as of Oct. 26, 2026: "16 U.S.C. 825o-1(b), Federal Power Act: $1,584,648 per violation, per day"; last changed by FERC's 2025 adjustment (Jan. 14, 2025, Federal Register document 2025-00516), with no 2026 adjustment found in eCFR or the Federal Register (read Oct. 28, 2026). Read it online. ↩
2. Transportation Security Administration, Security Directive Pipeline-2021-01G, "Enhancing Pipeline Cybersecurity," effective Jan. 16, 2026 to Jan. 15, 2027, with transmittal memo dated Jan. 9, 2026 (read Oct. 28, 2026). Read it online. ↩
3. Office of Information and Regulatory Affairs, Unified Agenda entry, RIN 1652-AA74, "Enhancing Surface Cyber Risk Management" (listed as a Long-Term Action, final rule date To Be Determined), and Federal Register search showing no final rule (read Oct. 28, 2026). Read it online. ↩
4. U.S. Department of War, "War Department Changes Cybersecurity Maturity Model Certification Requirements," news release, July 13, 2026 (read Oct. 28, 2026). Read it online. ↩
5. Defense Pricing, Contracting, and Acquisition Policy, DFARS Class Deviation 2026-O0025, Revision 3, signed by John M. Tenaglia, Sept. 3, 2026 (superseding Revision 2 of July 16, 2026), with attached DFARS Part 240 clause text including 252.204-7012 and 252.240-7997, restating the DoW CIO memorandum "Suspension of the Advancement to Cybersecurity Maturity Model Certification Phase 2 Requirements" (July 13, 2026) (read Oct. 28, 2026). Read it online. ↩
6. Covington & Burling, Inside Privacy, "CISA Submits Final CIRCIA Rule for OMB Review" (OIRA receipt Oct. 1, 2026); HIPAA Journal, "CISA CIRCIA Final Rule Sent for White House Review," Oct. 5, 2026; Hunton Andrews Kurth, "CISA Plans to Finalize Cyber Incident Reporting Regulations in September 2026," July 17, 2026, https://www.hunton.com/privacy-and-cybersecurity-law-blog/cisa-plans-to-finalize-cyber-incident-reporting-regulations-in-september-2026. The OIRA record on reginfo.gov could not be loaded (read Oct. 28, 2026). Read it online. ↩
7. Cybersecurity and Infrastructure Security Agency, "Chemical Facility Anti-Terrorism Standards (CFATS)" program page, describing the July 28, 2023 lapse and its effects (read Oct. 28, 2026). Read it online. ↩
8. European Commission, "Cyber Resilience Act: reporting obligations" (Article 14 duties from Sept. 11, 2026); ENISA, "The CRA Single Reporting Platform is launched," Sept. 11, 2026, https://www.enisa.europa.eu/news/the-cra-single-reporting-platform-is-launched (read Oct. 28, 2026). Read it online. ↩
9. Idaho Code 28-51-104 (definitions, including "personal information," "breach" and "primary regulator"), 28-51-105 (notice duties, including agencies' 24-hour notice to the Attorney General and vendors' duty to notify owners), 28-51-106 and 28-51-107 (enforcement and the $25,000 fine), Idaho Legislature (read Oct. 28, 2026). Read it online. ↩
10. Western Electricity Coordinating Council, Registered Ballot Body list, Apr. 2, 2026 (listing Idaho Power Company, Avista Corporation, PacifiCorp and Bonneville Power Administration by segment). Ballot body membership does not by itself prove NERC Compliance Registry functions (read Oct. 28, 2026). Read it online. ↩
11. Cybersecurity and Infrastructure Security Agency, "Critical Manufacturing Sector" page (read Oct. 28, 2026). Read it online. ↩
12. Cloud Security Alliance Labs, research note on the CISA funding lapse ("CISA at 38%"), Apr. 23, 2026, citing Axios, Nextgov and Federal News Network reporting; GovInfoSecurity, "DHS Shutdown Ends as CISA Faces Long Recovery," 2026, https://www.govinfosecurity.com/dhs-shutdown-ends-as-cisa-faces-long-recovery-a-31563. Press reports (read Oct. 28, 2026). Read it online. ↩
13. Congressional Research Service, "The Cybersecurity Information Sharing Act of 2015: Expiring Provisions," IF12959, updated Sept. 3, 2026; Davis Wright Tremaine, "Congress Extends CISA 2015 Through September 2026," Feb. 2026, https://www.dwt.com/blogs/privacy--security-law-blog/2026/02/congress-extends-cisa-2015-thru-september (read Oct. 28, 2026). Read it online. ↩
14. Roll Call, "Cyber information-sharing law stuck in Senate stalemate," Oct. 9, 2026 (read Oct. 28, 2026). Read it online. ↩
15. Federal Energy Regulatory Commission, Order No. 907, "Critical Infrastructure Protection Reliability Standard CIP-015-1, Cyber Security, Internal Network Security Monitoring," Docket RM24-7-000, 90 FR 28889 (July 2, 2025), approved June 26, 2025, effective Sept. 2, 2025, citing section 215 of the Federal Power Act, 16 U.S.C. 824o (read Oct. 28, 2026). Read it online. ↩
16. Federal Energy Regulatory Commission, "Mandatory Reliability Standards for Critical Infrastructure Protection," 74 FR 12544 (Mar. 25, 2009), describing Order No. 706, 122 FERC 61,040 (January 2008), which approved CIP-002-1 through CIP-009-1 (read Oct. 28, 2026). Read it online. ↩
17. Federal Energy Regulatory Commission, "Commission Information Collection Activities (FERC-725B); Comment Request; Extension," 91 FR 64921 (Oct. 13, 2026), Docket RD26-6-000, including the NERC Compliance Registry count, NERC's June 18, 2026 CIP-015-2 petition and the statement that CIP-015-2 changes were "implemented through Order RD26-6-000 issued on August 10, 2026" (read Oct. 28, 2026). Read it online. ↩
18. North American Electric Reliability Corporation, CIP-015-1 Implementation Plan, Project 2023-03, Feb. 2024; Dragos, "NERC CIP-015-1 Is Approved: What Asset Owners Need to Do" (summary of Requirements R1 to R3 and the Oct. 1, 2028 effective date), https://www.dragos.com/blog/nerc-cip-015-is-approved-what-asset-owners-need-to-do (read Oct. 28, 2026). Read it online. ↩
19. Federal Energy Regulatory Commission, Order No. 919, "Virtualization Reliability Standards," Docket RM24-8-000, 91 FR 13957 (Mar. 24, 2026), issued Mar. 19, 2026, effective May 26, 2026. Same day: Order No. 918, CIP-003-11, Docket RM25-8-000, 91 FR 13952 (Mar. 24, 2026), https://www.federalregister.gov/d/2026-05711; and order approving CIP-002-8, 91 FR 14013 (Mar. 24, 2026), https://www.federalregister.gov/d/2026-05715 (read Oct. 28, 2026). Read it online. ↩
20. Troutman Pepper, "FERC Approves NERC's CIP Reliability Standard on Cyber Security," June 2024 (CIP-012-2, approved May 23, 2024, Docket RD24-3); Davis Wright Tremaine, "FERC Approves New Reliability Standard for Bulk-Power System Physical Security," Sept. 2026 (CIP-014-4), https://www.dwt.com/blogs/energy--environmental-law-blog/2026/09/nerc-cip-014-4-bps-physical-security. The July 1, 2026 CIP-012-2 date is a calculation from NERC's 24-month implementation plan, not confirmed on NERC's page (read Oct. 28, 2026). Read it online. ↩
21. Federal Energy Regulatory Commission, Order No. 912, "Supply Chain Risk Management Reliability Standards Revisions," 90 FR 45661 (Sept. 23, 2025), issued Sept. 18, 2025, effective Nov. 24, 2025 (see paragraphs 1 and 69 on the 18-month deadline); NERC opened Project 2025-06 in response (read Oct. 28, 2026). Read it online. ↩
22. pv magazine USA, article on the new NERC requirements for vendor remote access (CIP-003-9), Apr. 22, 2026. Press report (read Oct. 28, 2026). Read it online. ↩
23. Morgan Lewis, "FERC Approves Expanded Cyber Incident Reporting Requirements for Electric Utilities," July 2019 (CIP-008-6: initial reports within an hour or by the end of the next day, depending on the type of event, to E-ISAC and the National Cybersecurity and Communications Integration Center, effective Jan. 1, 2021) (read Oct. 28, 2026). Read it online. ↩
24. SecurityWeek, "U.S. Energy Firm Fined $10 Million for Security Failures," Feb. 2019; E&E News, "Duke agreed to pay record fine for lax security" (identifying Duke Energy), https://www.eenews.net/articles/duke-agreed-to-pay-record-fine-for-lax-security-sources/. Press reports (read Oct. 28, 2026). Read it online. ↩
25. Idaho Public Utilities Commission, agency website (no commission-level cybersecurity rule shown; links to cybersecurity.idaho.gov) (read Oct. 28, 2026). Read it online. ↩
26. Federal Energy Regulatory Commission, "FERC Staff Issues Final Supplemental Environmental Impact Statement (SEIS)," Hells Canyon Hydroelectric Project No. 1971 (Brownlee, Oxbow and Hells Canyon developments, 1,222.3 megawatts) (read Oct. 28, 2026). Read it online. ↩
27. Transportation Security Administration, "Ratification of Security Directive," 86 FR (Sept. 24, 2021), describing Security Directive Pipeline-2021-01, issued May 26, 2021, effective May 28, 2021, and Security Directive Pipeline-2021-02, issued July 19, 2021, effective July 26, 2021 (read Oct. 28, 2026). Read it online. ↩
28. Transportation Security Administration, Security Directive Pipeline-2021-02G, "Pipeline Cybersecurity Mitigation Actions, Contingency Planning, and Testing," effective May 3, 2026 to May 2, 2027, with transmittal memo of May 1, 2026 (sections II.A, III.B, III.C, III.E and III.G, footnotes 1 and 2) (read Oct. 28, 2026). Read it online. ↩
29. Transportation Security Administration, "Enhancing Surface Cyber Risk Management," notice of proposed rulemaking, 89 FR 88488 (Nov. 7, 2024), RIN 1652-AA74, including footnote 71 on the reporting history and the regulatory cost estimate (read Oct. 28, 2026). Read it online. ↩
30. Transportation Security Administration, Security Directive Pipeline-2021-01F and transmittal memo of Oct. 22, 2025 (reporting window changed from 24 to 72 hours, effective Oct. 25, 2025); also Security Directive 1580/82-2022-01E, "Rail Cybersecurity Mitigation Actions and Testing," effective May 3, 2026 to May 2, 2027, https://www.tsa.gov/sites/default/files/signed_security_directive_1580_82-2022-01e_and_transmittal_memo_508c.pdf (read Oct. 28, 2026). Read it online. ↩
31. U.S. Government Accountability Office, "Surface Transportation: TSA Is Taking Steps to Enhance Cybersecurity, but Additional Actions Are Needed," GAO-25-107947, testimony of Tina Won Sherman, Nov. 19, 2024 (read Oct. 28, 2026). Read it online. ↩
32. Crowell & Moring, client alert on DoD Class Deviation 2024-O0013 (May 2, 2024) linking DFARS 252.204-7012 to NIST SP 800-171 Rev. 2, May 2024; NIST, SP 800-171 Rev. 3, "Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations," May 14, 2024, https://csrc.nist.gov/pubs/sp/800/171/r3/final (read Oct. 28, 2026). Read it online. ↩
33. Secureframe, "CMMC News 2026" (entry of July 4, 2026 on the unpublished interim final rule, RIN 0790-AM01; a Federal Register search on Oct. 28, 2026 found no such rule); NIST, SP 800-172 Rev. 3, published May 13, 2026, https://csrc.nist.gov/pubs/sp/800/172/r3/final (read Oct. 28, 2026). Read it online. ↩
34. Department of Defense, "Cybersecurity Maturity Model Certification (CMMC) Program," final rule, 32 CFR Part 170, 89 FR 83092 (Oct. 15, 2024), effective Dec. 16, 2024, including 170.3(e) (phases), 170.14 and Table 1 (levels), and the regulatory impact analysis (Tables 5, 9 and 10 and the annualized cost table) (read Oct. 28, 2026). Read it online. ↩
35. Department of Defense, "Defense Federal Acquisition Regulation Supplement: Assessing Contractor Implementation of Cybersecurity Requirements," 90 FR 43560 (Sept. 10, 2025), effective Nov. 10, 2025 (read Oct. 28, 2026). Read it online. ↩
36. 32 CFR 170.19(c), CMMC Level 2 scoping, Table 3, "Specialized Assets," eCFR (read Oct. 28, 2026). Read it online. ↩
37. Crowell & Moring, "Department of War Immediately Suspends CMMC Phase II Requirements, Launches 60-Day Reform Review," July 13 to 14, 2026; ISI Defense, CMMC compliance status page (last reviewed Oct. 19, 2026), https://isidefense.com/compliance-status/cmmc, on the request for information and its responses. Law firm and press reports (read Oct. 28, 2026). Read it online. ↩
38. Jason Miller, Federal News Network, "RFI offers path forward for DoD with CMMC," Oct. 27, 2026; on the FAR CUI rule, "Controlled Unclassified Information," proposed rule, 90 FR 4278 (Jan. 15, 2025), https://www.federalregister.gov/d/2024-30437, re-proposed as FAR Case 2026-001 (June 23, 2026) per press reports (read Oct. 28, 2026). Read it online. ↩
39. U.S. Attorney's Office, Eastern District of California, "Aerojet Rocketdyne Agrees to Pay $9 Million to Resolve False Claims Act Allegations," July 8, 2022; Department of Justice, "Deputy Attorney General Lisa O. Monaco Announces New Civil Cyber-Fraud Initiative," Oct. 6, 2021, https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative (read Oct. 28, 2026). Read it online. ↩
40. The Defense Compliance Report, cyber False Claims Act settlement tracker (corrections dated Oct. 12, 2026); Mintz, "Cybersecurity-Related Enforcement Under the False Claims Act," Jan. 13, 2026, https://www.mintz.com/insights-center/viewpoints/2406/2026-01-13-cybersecurity-related-enforcement-under-false-claims-act. Trackers and law firm reports; the Raytheon amount is reported as $8.4 million or $8.5 million (read Oct. 28, 2026). Read it online. ↩
41. Department of Justice, "Defense Contractor MORSECORP Inc. Agrees to Pay $4.6 Million to Settle Cybersecurity Fraud Allegations," Mar. 26, 2025 (read Oct. 28, 2026). Read it online. ↩
42. Department of Justice, "Georgia Tech Research Corporation Agrees to Pay $875,000 to Resolve Civil Cyber-Fraud Litigation," Sept. 30, 2025; Department of Justice, release on LOGZONE Inc. ($507,144), June 18, 2026, https://www.justice.gov/opa/pr/alabama-defense-contractor-agrees-pay-507144-resolve-false-claims-act-liability-relating (read Oct. 28, 2026). Read it online. ↩
43. Bass Berry & Sims, Inside the False Claims Act, "DOJ's $2 Million Honeywell Settlement Under Civil Cyber-Fraud Initiative," Sept. 21, 2026, citing the Justice Department release of Sept. 1, 2026, https://www.justice.gov/opa/pr/honeywell-aerospace-inc-agrees-pay-over-2m-settle-false-claims-act-allegations-failing (read Oct. 28, 2026). Read it online. ↩
44. U.S. Food and Drug Administration, "Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions," final guidance, June 27, 2025 (section 524B of the FD&C Act, 21 U.S.C. 360n-2, added by section 3305 of Pub. L. 117-328) (read Oct. 28, 2026). Read it online. ↩
45. U.S. Food and Drug Administration, "Quality Management System Regulation: Final Rule Amending the Quality System Regulation, Frequently Asked Questions" (89 FR 7496, Feb. 2, 2024, effective Feb. 2, 2026); DLA Piper, "FDA issues revised cybersecurity premarket submission guidance," Feb. 27, 2026 (guidance reissued Feb. 3, 2026), https://www.dlapiper.com/en-us/insights/publications/2026/02/fda-issues-revised-cybersecurity-premarket-submission-guidance (read Oct. 28, 2026). Read it online. ↩
46. U.S. Environmental Protection Agency, "Enforcement Alert: Drinking Water Systems to Address Cybersecurity Vulnerabilities," issued May 2024, page last updated July 10, 2026 (read Oct. 28, 2026). Read it online. ↩
47. U.S. Environmental Protection Agency, action memorandum rescinding the Mar. 3, 2023 memorandum "Addressing Public Water System Cybersecurity in Sanitary Surveys or an Alternate Process," signed by Radhika Fox, Oct. 2023 (read Oct. 28, 2026). Read it online. ↩
48. Foley Hoag, "Rising Cyberattacks on U.S. Water Infrastructure: Federal Guidance and Next Steps for Operators," Aug. 17, 2026; Business Law Today, "EPA Warns Water Utilities Against Cyberattacks," Nov. 7, 2025 (2025 EPA recommendations, grants and recertification deadlines), https://businesslawtoday.org/2025/11/epa-warns-water-utilities-against-cyberattacks/. Press reports (read Oct. 28, 2026). Read it online. ↩
49. Office of Sen. Adam Schiff, summary of the Water Cyber Shield Act of 2026 (S. 5368), Aug. 2026. Status on congress.gov not checked (read Oct. 28, 2026). Read it online. ↩
50. Congressional Research Service, "Critical Infrastructure: Emerging Trends and Policy Considerations for Congress," R48878, Mar. 10, 2026 (read Oct. 28, 2026). Read it online. ↩
51. U.S. Environmental Protection Agency, "Accidental Release Prevention Requirements: Risk Management Programs Under the Clean Air Act; Common Sense Approach to Chemical Accident Prevention," proposed rule, 91 FR 8970 (Feb. 24, 2026); comment period extended 91 FR 16621 (Apr. 2, 2026); 2024 rule at 89 FR 17622 (Mar. 11, 2024) (read Oct. 28, 2026). Read it online. ↩
52. U.S. Coast Guard, "Cybersecurity in the Marine Transportation System," final rule, 90 FR 6298 (Jan. 17, 2025), effective July 16, 2025; Coast Guard Maritime Commons, "Final Rule: Cybersecurity in the Marine Transportation System Implementation Timeline," https://www.news.uscg.mil/maritime-commons/Article/4247529/final-rule-cybersecurity-in-the-marine-transportation-system-implementation-tim/ (read Oct. 28, 2026). Read it online. ↩
53. Cybersecurity and Infrastructure Security Agency, "Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements," proposed rule, 89 FR 23644 (Apr. 4, 2024) (read Oct. 28, 2026). Read it online. ↩
54. Cybersecurity and Infrastructure Security Agency, "Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act," 91 FR 30498 (May 26, 2026), revising the schedule announced at 91 FR 6794 (Feb. 13, 2026) (read Oct. 28, 2026). Read it online. ↩
55. Covington & Burling, Inside Privacy, "White House Releases New National Cyber Strategy and Executive Order," Mar. 10, 2026, on "President Trump's Cyber Strategy for America" (Mar. 6, 2026) (read Oct. 28, 2026). Read it online. ↩
56. Securities and Exchange Commission, "Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure," final rule, 88 FR 51896 (Aug. 4, 2023), effective Sept. 5, 2023, including Form 8-K Item 1.05 and its Instruction 1, Regulation S-K Item 106 and the compliance dates in Section II.I (read Oct. 28, 2026). Read it online. ↩
57. Erik Gerding, Director, SEC Division of Corporation Finance, "Disclosure of Cybersecurity Incidents Determined To Be Material and Other Cybersecurity Incidents," May 21, 2024 (read Oct. 28, 2026). Read it online. ↩
58. SEC EDGAR submissions data for Sensata Technologies (CIK 0001477294), Nucor (CIK 0000073309), Stryker (CIK 0000310764), Clorox (CIK 0000021076) and Johnson Controls (CIK 0000833444), checked by this module's researchers and rechecked by the fact checker on Oct. 28, 2026 (Clorox's Nov. 16, 2023 8-K under Item 8.01 concerns a board chair change, not the cyberattack). Read it online. ↩
59. Cherry Hill Advisory, "SEC Cybersecurity Disclosure Rule: Two Years of 8-K Filings (2026 Review)." Tracker; individual filings not checked on EDGAR (read Oct. 28, 2026). Read it online. ↩
60. Securities and Exchange Commission, joint petition for rulemaking to amend the cybersecurity disclosure rules, May 2025; National Association of Manufacturers, "NAM: SEC Must Make Changes to Cybersecurity Disclosure Rule," June 18, 2025, https://nam.org/nam-sec-must-make-changes-to-cybersecurity-disclosure-rule/ (read Oct. 28, 2026). Read it online. ↩
61. Harvard Law School Forum on Corporate Governance, "Statement by Chair Atkins on Reforming Regulation S-K," Jan. 15, 2026 (request for comment, File No. CLL-15, comments due Apr. 13, 2026); a Federal Register search on Oct. 28, 2026 found no proposed amendment (read Oct. 28, 2026). Read it online. ↩
62. Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex, including recitals 60 and 120; Jones Day, "EU Cyber Resilience Act: 24-Hour Reporting Duties Start September 11, 2026," July 2026 (fines and dates), https://www.jonesday.com/en/insights/2026/07/eu-cyber-resilience-act-24hour-reporting-duties-start-september-11-2026; CRA Facts, Sept. 2026 news (no harmonised standard cited) (read Oct. 28, 2026). Read it online. ↩
63. European Commission, "NIS2 Directive" policy page; Directive (EU) 2022/2555, EUR-Lex, recital 102 (reporting stages), https://eur-lex.europa.eu/eli/dir/2022/2555/oj (read Oct. 28, 2026). Read it online. ↩
64. Jacar, "NIS2 Transposition Status Across Member States," updated Sept. 6, 2026. Press report (read Oct. 28, 2026). Read it online. ↩
65. Regulation (EU) 2023/1230 (Machinery Regulation), EUR-Lex, recital 85 and Article 20(9); IBF Solutions, report on the requested postponement of the cybersecurity requirements, 2026, https://www.ibf-solutions.com/en/news-and-knowledge/technical-papers-and-news-on-ce-marking/postponement-of-mr-requirements-for-cybersecurity-and-ai; joint industry position of Jan. 19, 2026 (read Oct. 28, 2026). Read it online. ↩
66. Idaho Legislature, House Bill 35 (2025), Session Law Chapter 6, signed Feb. 24, 2025, effective July 1, 2025, amending Idaho Code 67-827A and 67-831 and adding 67-2362 (read Oct. 28, 2026). Read it online. ↩
67. Idaho Legislature bill status pages for S. 1090 (2019), H. 519 (2024), H. 155 (2025) and H. 117 (2025); Idaho Business Review, "Idaho's 350 new laws," Aug. 28, 2026 (H. 522 drone law, Idaho Code 20-251), https://idahobusinessreview.com/2026/08/28/idaho-350-new-laws-drone-restrictions-jury-duty/ (read Oct. 28, 2026). Read it online. ↩