In 2025, organizations across all sectors navigated a significant wave of updates to cybersecurity and privacy compliance frameworks. As digital threats evolved, regulators responded with new requirements, major transition deadlines, and heightened enforcement, making swift adaptation essential. For service providers, staying proactive with compliance was the key to avoiding penalties, building resilience, maintaining stakeholder trust, and creating a foundation for growth. Key shifts included greater demands in risk management, cloud security, and executive accountability, moving the focus from mere documentation to demonstrable oversight.
The year’s most significant milestones included the accelerated adoption of NIST CSF 2.0, the publication of the revised ISO 27701:2025 privacy standard, and substantial revisions to the OMB Compliance Supplement. Evolving requirements also impacted CMMC, the FTC Safeguards Rule, and the HITRUST Common Security Framework. For CISOs and cybersecurity leaders, these changes marked a critical shift toward board-level accountability, with regulators and clients expecting clear executive ownership and ongoing risk management. Understanding and adapting to this new baseline is crucial for standardizing compliance, supporting clients effectively, and preparing for future regulatory expectations.
Below, we break down the most impactful compliance changes of 2025 and the steps you need to take as a service provider to help your clients stay ahead in 2026.
Summary of 2025 Compliance Framework Updates
In 2025, several important adjustments, transition deadlines, and enforcement trends shaped key compliance frameworks. Each had distinct implications for businesses.
GDPR and AI
In 2025, European regulators intensified their focus on how organizations use AI under the GDPR. Regulators did not introduce formal amendments to the regulation. Instead, they clarified expectations through new guidance, opinions, and enforcement activity. These developments should be viewed separately from the EU AI Act, which introduced new obligations, while GDPR enforcement in 2025 focused on applying existing principles to AI-driven processing.
Key developments include:
- Expanded regulatory guidance on AI and personal data, issued by the European Data Protection Board and national data protection authorities, clarifying how existing GDPR principles apply to AI systems. AI use cases increasingly require formal inventories, lawful basis documentation, DPIAs, and executive visibility, even where AI systems are internally developed.
- Increased expectations around Data Protection Impact Assessments (DPIAs) for AI use cases that qualify as high-risk processing, reinforcing long-standing GDPR obligations rather than introducing new ones.
- Continued reliance on modernized Standard Contractual Clauses (SCCs) for international data transfers, which became mandatory in earlier years but remained central to enforcement in 2025.
- More consistent fine-calculation methodologies across the EU, reflecting harmonization efforts adopted prior to 2025 and applied more uniformly in regulatory actions.
Together, these developments made 2025 a year of heightened scrutiny and clearer expectations for AI governance under the GDPR.
HIPAA
In 2025, HIPAA compliance continued to evolve, although comprehensive updates to the Privacy Rule had not yet been finalized.
Key areas under consideration include:
- Proposed enhancements to patient access rights, including shorter response timelines for access requests.
- Planned improvements to care coordination and case management, aimed at reducing administrative barriers to information sharing.
- Modernization of Notice of Privacy Practices (NPP) requirements, intended to improve transparency and patient understanding.
While these changes remain proposed rather than enforceable as of late 2025, healthcare organizations should monitor HHS rulemaking closely and prepare for future implementation.
PCI DSS v4.0
While PCI DSS v4.0 was released in 2022, several key requirements became mandatory in March 2025 after a lengthy transition period. These are not minor tweaks. They represent a fundamental shift toward a more security-focused, continuous compliance model.
Key changes include:
- Customized Implementation: The new standard allows organizations to meet security objectives through customized controls, but this requires robust risk analysis and documentation to demonstrate their effectiveness.
- Enhanced Authentication: Multi-factor authentication (MFA) requirements were expanded to cover all access to the cardholder data environment, not just administrator access.
- Continuous Monitoring: The focus shifted from annual, point-in-time assessments to continuous monitoring and validation of security controls throughout the year.
ISO 27001:2022
Similar to PCI DSS, the transition period for organizations to move from ISO 27001:2013 to ISO 27001:2022 ends in 2025. Since October 31, 2025, certifications issued under the 2013 standard are no longer valid.
The updated standard introduces a streamlined control set and places greater emphasis on modern cybersecurity challenges.
Key changes include:
- Updated Annex A Controls: The number of controls has been reduced from 114 to 93, consolidated into four themes. The themes are Organizational, People, Physical, and Technological.
- New Controls: Eleven new controls address emerging security needs, including threat intelligence, data leakage prevention, and cloud service security.
- Attribute Tagging: Controls can now be categorized by attributes, such as control type and security properties. This makes it easier to align an ISMS with other frameworks.
These changes better reflect cloud-first environments, SaaS dependencies, and the growing importance of third-party and supply chain risk management.
Additional Framework Developments in 2025
In addition to major changes in GDPR, HIPAA, PCI DSS, and ISO 27001, 2025 saw notable developments across other frameworks:
- NIST Cybersecurity Framework 2.0 (CSF 2.0): Although released in 2024, adoption accelerated in 2025. Organizations increasingly aligned to the new “Govern” function and integrated cybersecurity governance into enterprise risk management.
- ISO 27701:2025: ISO published a revised version of ISO 27701 in 2025. The revision strengthened privacy governance requirements and clarified how a Privacy Information Management System (PIMS) can be implemented alongside ISO 27001 or implemented more independently.
- OMB Compliance Supplement 2025: Significant updates were introduced for Single Audit requirements and federal award internal controls, affecting organizations that receive federal funding.
- Cybersecurity Maturity Model Certification (CMMC): In 2025, the U.S. Department of Defense finalized the CMMC rule. The final rule launched a phased rollout that will require defense contractors to demonstrate specific cybersecurity maturity levels for handling Controlled Unclassified Information (CUI).
- FTC Safeguards Rule: Organizations continued adjusting to strengthened Safeguards Rule requirements that took effect in 2023 and 2024. In 2025, regulators issued additional guidance and enforcement activity increased.
- HITRUST Common Security Framework (CSF): HITRUST continued its transition to CSF v11, with 2025 serving as a key milestone year for organizations migrating away from earlier versions.
- Cloud Security Alliance’s Cloud Control Matrix (CCM): The CSA released updates to the CCM in 2025. The updates refined controls to address emerging cloud security risks and evolving regulatory expectations.
What to Expect in 2026 and Beyond
Looking ahead, compliance will continue evolving toward deeper integration with core business strategy. Several trends are expected to gain momentum:
- GDPR: Regulators are likely to focus more closely on AI governance and cross-regulatory alignment with the EU AI Act. This will increase complexity for AI-driven organizations.
- HIPAA: The continued growth of telehealth and connected health technologies may drive new guidance on securing PHI outside traditional healthcare environments.
- PCI DSS: The emphasis on continuous compliance under v4.0 will mature. Additional guidance is expected around customized implementations and ongoing validation.
- ISO 27001: As adoption of the 2022 standard increases, organizations may see greater emphasis on supply chain security, cloud-native environments, and integration with broader risk management programs.
- Accountability: Across regions, governments are increasing expectations around cyber resilience and executive accountability. In the UK, the proposed Cyber Resilience Bill signals a move toward stronger security obligations for digital products and services, complementing broader EU trends in AI and cybersecurity regulation.
How to Prepare for Compliance Changes
Navigating this complex landscape requires a structured, strategic approach.
- Conduct Regular Risk Assessments: Understanding your and your clients’ current compliance posture is foundational. Regular, automated assessments help identify gaps and prioritize remediation.
- Embrace Automation: Manual compliance management is no longer scalable. Centralized platforms can automate evidence collection, policy management, and reporting while improving consistency.
- Standardize Your Advisory Services: A repeatable compliance framework enables delivery of high-quality, CISO-level services efficiently, even with lean teams.
- Adopt a Continuous Compliance Mindset: Move beyond point-in-time audits by implementing tools that provide real-time visibility into controls and compliance status.
Build a Scalable Compliance Practice
Staying informed about compliance updates is only the first step. The real opportunity lies in translating regulatory complexity into scalable, profitable services. By leveraging automation and standardized frameworks, organizations can manage compliance for more clients with fewer resources.
Platforms like Cynomi act as a CISO copilot, delivering built-in expertise and intelligent workflows that streamline cybersecurity and compliance management in order to increase recurring revenue, and improve efficiency. By automating risk assessments, remediation planning, and reporting, teams can reduce manual effort, boost productivity, and deliver high-impact services that strengthen client resilience and retention. Learn more at www.cynomi.com.