US cyber regulation outlook to 2027: federal retreat, state advance

The one thing a US board should know right now: the rules written in 2023–24 still apply, but federal enforcement has shifted. The White House's March 2026 cyber strategy promises to "streamline cyber regulations to reduce compliance burdens" [1]. The SEC has dropped its landmark case against SolarWinds and its security chief [13], and trade bodies are asking it to scrap the four-day incident disclosure rule [15]. Meanwhile states are moving the other way. New York's financial regulator keeps fining firms for old breaches [22], and California set a record privacy penalty in May 2026 [24]. Expect fewer new federal duties, but not fewer obligations overall.

At a glance

• Listed companies: material cyber incidents must still be disclosed on Form 8-K within four business days of deciding they are material [3]. The SEC may propose disclosure changes this month [16].
• Critical infrastructure: the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule, with 72-hour incident and 24-hour ransom payment reporting, is still not final [28][29].
• Federal agencies: the Supreme Court ruled on 29 June 2026 that the President can remove Federal Trade Commission (FTC) commissioners at will [2].
• States: New York's cyber rule is fully phased in [6]. California's rules on automated decision-making start on 1 January 2027 [10].
• AI: a December 2025 executive order set up a federal task force to challenge state AI laws [33]. The Justice Department has already joined one such case [35].

The rulebook now

Public companies. Since 18 December 2023, listed companies must file a Form 8-K under Item 1.05 within four business days of finding that a cyber incident is material. Delay is allowed only if the US Attorney General says disclosure would put national security or public safety at serious risk. Annual reports must also describe cyber risk management and board oversight [3].

Financial firms. Amended Regulation S-P requires brokers, investment advisers and funds to run an incident response programme and tell affected customers within 30 days. Larger firms had to comply from 3 December 2025 and smaller ones from 3 June 2026 [4][5]. New York's Department of Financial Services (NYDFS) rule, 23 NYCRR Part 500, requires notice within 72 hours of a cyber incident and within 24 hours of any extortion payment. Firms must certify compliance every 15 April [6]. Non-bank lenders and other firms under the FTC's Safeguards Rule must report breaches affecting 500 or more people within 30 days [7].

Health and telecoms. Health providers and insurers covered by HIPAA must report breaches affecting 500 or more people to individuals and to the Department of Health and Human Services (HHS) within 60 days [8]. Telecoms carriers must tell the Federal Communications Commission (FCC), the FBI and the Secret Service within seven business days [9].

State privacy and defence. California's regulations on cyber audits, risk assessments and automated decision-making took effect in 2026, with deadlines running to 2030 [10]. Defence contractors face the Cybersecurity Maturity Model Certification (CMMC), phased in over four years from November 2025 [11] [CHECK: Phase 1 start date of 10 Nov 2025 taken from data/laws.json].

The regulators and how they behave

SEC (Securities and Exchange Commission). In February 2025 it replaced its crypto and cyber unit with a Cyber and Emerging Technologies Unit of about 30 staff [12]. On 20 November 2025 it dismissed its case against SolarWinds and its chief information security officer "in the exercise of its discretion" [13]. It brought 456 enforcement actions in fiscal year 2025, and its chairman said resources had moved to "fraud, market manipulation, and abuses of trust" [14]. Inspections still name cyber security as "a perennial examination priority" [5]. Posture: lighter on disclosure cases, steady on exams.

FTC. The FTC still brings data security cases, all settled by orders without fines. Illuminate Education must delete data and run a security programme after a breach of 10.1 million students' records [17]. Crypto bridge operator Nomad must return money to users after hackers stole $186m. That order was approved 2–0 [18]. After the Supreme Court ruling, commissioners can be removed by the President at will [2]. Posture: case by case, with no new privacy rules.

HHS Office for Civil Rights (OCR). OCR settles a steady stream of small cases, usually for missing risk analyses after ransomware or phishing. OSF HealthCare paid $552,250 in July 2026 [20] and Ambry Genetics $700,000 in September 2026 [19]. Posture: steady and modest.

FCC. On 20 November 2025 the FCC voted 2–1 to withdraw a January 2025 ruling that telecoms carriers must secure their networks under the Communications Assistance for Law Enforcement Act. It said voluntary commitments after the Salt Typhoon intrusions work better [21]. A court upheld its expanded breach rules in August 2025 [37]. Trade press reports the full Sixth Circuit will rehear the case, and the FCC may reverse the rules itself [36] [CHECK]. Posture: deregulatory.

NYDFS. New York's financial regulator remains the strictest state cyber regulator. On 30 April 2026 it fined Delta Dental $2.25m for failures linked to the 2023 MOVEit attack, including late reporting [22]. It will also run New York's frontier AI law [23].

California and state attorneys general. California's attorney general secured $12.75m from General Motors on 8 May 2026 for selling driving data [24]. Texas finalised a $1.375bn privacy settlement with Google on 31 October 2025 [25]. The California Privacy Protection Agency (CalPrivacy) issues frequent, smaller decisions, mostly against data brokers [26]. In September 2026, 44 attorneys general settled with Labcorp for $2.3m over a 2019 breach at its debt collector [27]. Posture: active, and press releases on both sides often carry a political message [23][25].

What's coming in the next 12 months

• October 2026 (expected): SEC proposal on "Rationalization of Disclosure Practices" [16]. Whether it touches the cyber rules is unknown [CHECK].
• Late 2026 (expected): the CIRCIA final rule. CISA says it "continues to work on the final rule" [28]. The federal regulatory agenda listed September 2026 [29]. A trade report says it is under White House review [30] [CHECK].
• 10 November 2026: CMMC phase 2 begins, one year after phase 1. Defence contracts can then require third-party Level 2 certification [11] [CHECK: date depends on the phase 1 start].
• November 2026 (expected): SEC exam priorities for fiscal year 2027. The 2026 priorities came out on 17 November 2025 [5][38].
• November 2026: large AI developers start registering with New York ahead of the Responsible AI Safety and Education (RAISE) Act [23].
• 11 December 2026: the Cybersecurity Information Sharing Act 2015, which protects firms that share threat data, expires unless renewed again [32] [CHECK enactment].
• 1 January 2027: California's automated decision-making rules apply [10]. RAISE Act duties start, including reporting safety incidents within 72 hours [23]. Colorado's rewritten automated decision-making law (SB 26-189) also starts [34].
• July 2027 (expected): earliest date listed for the HIPAA Security Rule overhaul, now a "long-term action" [31].

What it means for organisations

• Keep the 8-K process. Item 1.05 still applies until the SEC changes it. By May 2026, 29 companies had reported under Item 1.05 and 50 under the voluntary Item 8.01 [39]. Document how each materiality decision was made.
• Map deadlines to one playbook. The SEC, NYDFS, the FTC, HHS and the FCC each set different deadlines. Build CIRCIA's 72 hours and 24 hours in now [28].
• Plan for state enforcement. State attorneys general and CalPrivacy are bringing the larger privacy cases [24][25]. Data minimisation and opt-out mechanics are now enforcement themes [24][26].
• Expect old breaches to resurface. NYDFS and OCR are fining for incidents from 2021 to 2023 [20][22].
• Track AI law case by case. Federal pre-emption efforts and state laws pull in opposite directions [33][34][35].

Sources

1. White House, President Trump's Cyber Strategy for America (Mar 2026): https://www.whitehouse.gov/wp-content/uploads/2026/03/President-Trumps-Cyber-Strategy-for-America.pdf
2. Supreme Court, Trump v. Slaughter, No. 25-332 (decided 29 Jun 2026): https://www.supremecourt.gov/opinions/25pdf/25-332_qn12.pdf
3. SEC, Fact sheet: Public Company Cybersecurity Disclosures; Final Rules (Jul 2023): https://www.sec.gov/files/33-11216-fact-sheet.pdf
4. Sidley Austin, "U.S. SEC Regulation S-P: Compliance Deadline Approaching for Smaller Entities" (30 Apr 2026): https://datamatters.sidley.com/2026/04/30/u-s-sec-regulation-s-p-compliance-deadline-approaching-for-smaller-entities/
5. SEC Division of Examinations, Fiscal Year 2026 Examination Priorities: https://www.sec.gov/files/2026-exam-priorities.pdf
6. 23 NYCRR 500.17 (notices to superintendent), via Cornell LII: https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.17
7. FTC, "FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches" (Oct 2023): https://www.ftc.gov/news-events/news/press-releases/2023/10/ftc-amends-safeguards-rule-require-non-banking-financial-institutions-report-data-security-breaches
8. HHS, Breach Notification Rule: https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html
9. FCC, Data Breach Reporting Requirements, 89 FR 9968 (12 Feb 2024): https://www.federalregister.gov/documents/2024/02/12/2024-01667/data-breach-reporting-requirements
10. CalPrivacy, CCPA regulation updates and compliance dates: https://cppa.ca.gov/regulations/ccpa_updates.html
11. 32 CFR 170.3 (CMMC implementation phases), eCFR: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170/subpart-A/section-170.3
12. SEC, "SEC Announces Cyber and Emerging Technologies Unit to Protect Retail Investors" (20 Feb 2025): https://www.sec.gov/newsroom/press-releases/2025-42
13. SEC, Litigation Release No. 26423, SolarWinds Corp. and Timothy G. Brown (20 Nov 2025): https://www.sec.gov/enforcement-litigation/litigation-releases/lr-26423
14. SEC, "SEC Announces Enforcement Results for Fiscal Year 2025" (7 Apr 2026): https://www.sec.gov/newsroom/press-releases/2026-34
15. SIFMA, ABA, BPI, ICBA and IIB, joint letter on reforming Regulation S-K's cybersecurity disclosures (10 Apr 2026): https://www.sifma.org/advocacy/letters/reforming-regulation-s-ks-cybersecurity-disclosures-joint-trades
16. Unified Agenda, SEC, Rationalization of Disclosure Practices (RIN 3235-AN43): https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=3235-AN43
17. FTC, "FTC Takes Action Against Education Technology Provider for Failing to Secure Students' Personal Data" (1 Dec 2025): https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-takes-action-against-education-technology-provider-failing-secure-students-personal-data
18. FTC, "FTC Will Require Illusory Systems to Return Money Stolen by Hackers and Implement an Information Security Program" (16 Dec 2025): https://www.ftc.gov/news-events/news/press-releases/2025/12/ftc-will-require-illusory-systems-return-money-stolen-hackers-implement-information-security-program
19. HHS OCR, Resolution Agreements and Civil Money Penalties: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html
20. HHS OCR, OSF Healthcare System Resolution Agreement (Jul 2026): https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/ra-cap-with-osf-healthcare-system/index.html
21. FCC, "FCC Corrects Course, Outlines Improved Cybersecurity Measures" (20 Nov 2025): https://docs.fcc.gov/public/attachments/DOC-415455A1.pdf
22. NYDFS, "DFS Secures $2.25 Million Cybersecurity Settlement with Delta Dental" (30 Apr 2026): https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20260430
23. NYDFS / Governor of New York, "AI Safety: Governor Hochul Announces Next Steps to Regulate Major AI Developers" (21 Sep 2026): https://www.dfs.ny.gov/reports_and_publications/press_releases/pr20260921
24. California Attorney General, "Attorney General Bonta, Partners Secure $12.75 Million General Motors Privacy Settlement" (8 May 2026): https://oag.ca.gov/node/622991
25. Texas Attorney General, "Attorney General Ken Paxton Finalizes Historic Settlement with Google" (31 Oct 2025): https://www.texasattorneygeneral.gov/news/releases/attorney-general-ken-paxton-finalizes-historic-settlement-google-and-secures-1375-billion-big-tech
26. CalPrivacy, Board enforcement decisions: https://privacy.ca.gov/about-us/board-decisions/
27. Delaware Department of Justice, "AG Jennings announces $2.3 million multistate settlement with Labcorp over AMCA Data Breach" (24 Sep 2026): https://news.delaware.gov/2026/09/24/ag-jennings-announces-2-3-million-multistate-settlement-with-labcorp-over-amca-data-breach/
28. CISA, Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA): https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia
29. Unified Agenda, DHS/CISA, CIRCIA Reporting Requirements (RIN 1670-AA04): https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=1670-AA04
30. HIPAA Journal, "CISA Sends CIRCIA Final Rule for White House Review" (5 Oct 2026): https://www.hipaajournal.com/cisa-circia-final-rule-white-house-review/
31. Unified Agenda, HHS/OCR, HIPAA Security Rule (RIN 0945-AA22): https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=0945-AA22
32. Nextgov/FCW, "Stopgap funding bill temporarily extends key cyber info-sharing law" (Sep 2026): https://www.nextgov.com/policy/2026/09/stopgap-funding-bill-temporarily-extends-key-cyber-info-sharing-law/415756/
33. White House, Executive Order 14365, "Ensuring a National Policy Framework for Artificial Intelligence" (11 Dec 2025): https://www.whitehouse.gov/presidential-actions/2025/12/eliminating-state-law-obstruction-of-national-artificial-intelligence-policy/
34. Colorado General Assembly, SB26-189 Automated Decision-Making Technology (signed 14 May 2026): https://leg.colorado.gov/bills/sb26-189
35. Proskauer, "Federal Government Intervenes in Case Seeking To Invalidate Colorado AI Law" (Apr 2026): https://www.proskauer.com/blog/federal-government-intervenes-in-case-seeking-to-invalidate-colorado-ai-law
36. Broadband Breakfast, "Sixth Circuit to Rehear Case on FCC Data Breach Rules" (31 Jul 2026): https://broadbandbreakfast.com/sixth-circuit-to-rehear-case-on-fcc-data-breach-rules-case/
37. CyberScoop, "Court upholds FCC data breach reporting rules on telecom sector" (Aug 2025): https://cyberscoop.com/court-upholds-fcc-data-breach-regulations-pii/
38. Mayer Brown, "SEC Division of Examinations Announces 2026 Exam Priorities" (Nov 2025): https://www.mayerbrown.com/en/insights/publications/2025/11/sec-division-of-examinations-announces-2026-exam-priorities
39. Debevoise & Plimpton, "Cybersecurity Incident Disclosure: Form 8-K Tracker (Two-Year Update)" (21 May 2026): https://www.debevoisedatablog.com/2026/05/21/cybersecurity-incident-disclosure-form-8-k-tracker-two-year-update/

This article is for information only and is not legal advice.