Resources · Published ledger
Industry-facing editions promoted from the published ledger. Each card links to the canonical article on the Governance Frame — not a separate marketing copy of the body.
Canonical reader: https://research.ironframegrc.com
On **13 July 2026**, the Department of War suspended **CMMC Phase II** requirements that had been scheduled to begin **10 November 2026**. That pause is real. It is not a waiver of Phase I self-assessment duties, SPRS…
Read on Governance Frame →**Signal (21 August 2026):** Phase II of CMMC was suspended on **13 July 2026**. Phase I self-assessment duties and **DFARS 252.204-7012** did not take the day off. If your mid-August plan was \"wait for November cert…
Read on Governance Frame →On **18 August 2026**, CISA added four actively exploited vulnerabilities to the Known Exploited Vulnerabilities (KEV) Catalog, with a federal civilian remediation due date of **21 August 2026** under Binding Operatio…
Read on Governance Frame →**Signal (20 August 2026):** On Tuesday, CISA added four actively exploited flaws to the KEV catalog. Federal civilian agencies face a remediation due date of **21 August 2026** under BOD 22-01. [1][2] If your “critic…
Read on Governance Frame →Mid-August prep window before a September 2026 Unified Agenda contracting-cyber cluster (standardization + incident reporting), alongside CIRCIA. August DFARS NPRM remains an Agenda watch item; DFARS 7012 stays live d…
Read on Governance Frame →Two-plus years into the SEC’s cybersecurity disclosure rules, the useful August 2026 question is not what Item 1.05 says in the abstract—it is what recent filings show about materiality without operational shutdown, t…
Read on Governance Frame →Two weeks after Article 50 transparency obligations became applicable (2 August 2026), this desk note records the operating question for GRC teams: which in-scope interactive and generative systems have disclosure/mar…
Read on Governance Frame →10 August 2026 is the commonly cited federal remediation due date for Fortinet FortiOS CVE-2025-68686 (KEV-added 27 July) and Progress LoadMaster CVE-2026-8037 (KEV-added 7 August). The governance question this week i…
Read on Governance Frame →7 August 2026 is widely treated as the first major compliance milestone for CISA Binding Operational Directive 26-04 (issued 10 June 2026): Federal Civilian Executive Branch agencies must have vulnerability-management…
Read on Governance Frame →On 7 August 2026 CISA added Progress LoadMaster CVE-2026-8037 (command injection) to the KEV catalog amid an already dense early-August exploited-vulnerability week. Edge/load-balancer appliances remain high-value tar…
Read on Governance Frame →In the early-August 2026 KEV wave, CISA listed actively exploited flaws in IBM Langflow (CVE-2026-9198) and Apache Tomcat clustering (CVE-2026-34486), with short federal remediation pressure commonly cited around 7 Au…
Read on Governance Frame →On 5 August 2026 CISA added CVE-2026-63077 (JetBrains TeamCity deserialization of untrusted data) to the KEV catalog based on evidence of active exploitation. Compromised CI/CD servers expose credentials, build config…
Read on Governance Frame →In early August 2026 CISA added N-able N-central authentication-bypass vulnerabilities to the KEV catalog (including CVE-2026-18577 and related CVE-2026-18556). Public reporting describes an incomplete first fix that…
Read on Governance Frame →On 2 August 2026, Article 50 transparency obligations under the EU AI Act (Regulation (EU) 2024/1689) became applicable for providers and deployers of certain AI systems—including interactive systems, synthetic-conten…
Read on Governance Frame →August 2, 2026 is a major EU AI Act application threshold—especially for Article 50 transparency obligations—while high-risk system timelines have been reshaped through the AI Omnibus / Digital Omnibus process. This b…
Read on Governance Frame →On 29 July 2026 CISA added Cisco Secure Firewall Management Center (FMC) hard-coded credential vulnerability CVE-2026-20316 to the KEV catalog. Public trackers commonly list a federal remediation due date of 1 August…
Read on Governance Frame →On 27 July 2026 CISA added Arista VeloCloud Orchestrator on-prem OS command injection (CVE-2026-16812, CVSS 10.0) and Fortinet FortiOS sensitive-information exposure (CVE-2025-68686) to the KEV catalog. Public reporti…
Read on Governance Frame →On 27 July 2026, Regulation (EU) 2026/1744 amending the EU AI Act entered into force. It preserves near-term transparency duties (Article 50 from 2 August 2026) while deferring much of the high-risk Annex III regime—c…
Read on Governance Frame →On 22 July 2026 CISA added Check Point SmartConsole improper authentication (CVE-2026-16232) and another Microsoft SharePoint deserialization RCE (CVE-2026-50522) to the KEV catalog—management-plane and collaboration-…
Read on Governance Frame →On 21 July 2026 CISA added four KEVs including WordPress Core interpretation-conflict and SQL-injection flaws (CVE-2026-63030, CVE-2026-60137), Langflow untrusted-control-sphere inclusion (CVE-2026-0770), and a DD-WRT…
Read on Governance Frame →On 16 July 2026 CISA added three actively exploited vulnerabilities to the KEV catalog: Fortinet FortiSandbox OS command injection (CVE-2026-25089, CVE-2026-39808) and Microsoft SharePoint deserialization RCE (CVE-202…
Read on Governance Frame →On 3 July 2026 the European Commission adopted revised European Sustainability Reporting Standards under the Omnibus I simplification programme. Scope and datapoints are being reduced; governance duties for entities t…
Read on Governance Frame →DORA has applied since 17 January 2025. By August 2026, competent authorities are conducting active, authority-specific supervision—not one EU-wide examination programme. Financial entities need examination-ready evid…
Read on Governance Frame →Organisations continue to face control risks when evidence is manually assembled, risk estimates conceal uncertainty, external data enters trusted workflows without validation, tenant boundaries depend only on applica…
Read on Governance Frame →Governance, risk and compliance practices have evolved from formal internal-control assessment and document-centred assurance toward integrated cyber governance, operational resilience and automation-supported evidenc…
Read on Governance Frame →Ironframe Governance Frame briefing — Desk Note — Unified Agenda: CIRCIA final rule targeted for September 2026
Read on Governance Frame →Ironframe Governance Frame briefing — Desk Note — ECB SSM-2026-0301: AI-enabled cybersecurity action plans (7 July 2026)
Read on Governance Frame →Ironframe Governance Frame briefing — Desk Note — Illinois enacts AI Safety Measures Act (6 July 2026)
Read on Governance Frame →Ironframe Governance Frame briefing — Desk Note — Federal AI cybersecurity clearinghouse deadline hits 2 July 2026
Read on Governance Frame →Ironframe Governance Frame briefing — Desk Note — Navient Item 1.05 filing (2 July 2026): materiality without registrant outage
Read on Governance Frame →Ironframe Governance Frame briefing — Desk Note — CISA KEV: SharePoint RCE added 1 July 2026
Read on Governance Frame →Australia’s expanded AML/CTF regime is now in force for newly regulated designated services. This August newsletter reads the post–July 29 landscape: who is actually covered, what enrolment did and did not achieve, ho…
Read on Governance Frame →APRA’s final targeted amendments to CPS 230 and CPG 230 commence 1 July 2026. For many APRA-regulated entities, the same date closes the transitional window for pre-existing material service provider contracts. This b…
Read on Governance Frame →A PE roll-up opens one GRC login for twelve legal entities and celebrates the connector count. Tonight an auditor for Clinic East can see more than Clinic East. This briefing keeps the connector-count thesis while anc…
Read on Governance Frame →A regional health system's perimeter monitoring produces eight validation signals before shift change. This briefing traces those signals from technical validation to executive governance, showing how boards can evalu…
Read on Governance Frame →Modern governance operates under shorter reporting timelines, wider technology dependencies, operational-resilience requirements, and growing use of generative AI. Point-in-time questionnaires and color-coded dashboar…
Read on Governance Frame →As infrastructure and business applications moved into hosted and cloud environments, compliance teams gained access to more machine-generated evidence. APIs and integrations reduced some manual collection work, while…
Read on Governance Frame →The Sarbanes-Oxley Act transformed internal-control reporting from a largely managerial concern into a formal legal and audit obligation. Organizations responded by documenting controls, assigning owners, collecting a…
Read on Governance Frame →