Cybersecurity on CrossGov.com

FedRAMP 20x Reaches 538 Certified Cloud Services on a $10 Million Budget, While Europe Still Has No Common Cloud Certification

Sat, 10 Oct 2026 00:00:00 +0000

FedRAMP is the US government’s security approval for cloud services. If a federal agency wants to run its work on someone’s cloud, the service generally needs FedRAMP clearance first. In fiscal 2026, which ended on 30 September, the programme issued 92 new certifications, bringing the total to 538 cloud offerings. Agencies issued 760 new authorisations to use them.

It did that with 17 federal employees, 15 contractors and a budget of $10 million, of which it spent just under $9 million.

CISA's Cyber Incident Reporting Rule Sits at OIRA as the Agency Shrinks to 2,200 Staff Without a Confirmed Director

Thu, 08 Oct 2026 00:00:00 +0000

The final rule under the Cyber Incident Reporting for Critical Infrastructure Act, known as CIRCIA, went to the White House Office of Information and Regulatory Affairs for review on 1 October 2026. It hasn’t been published. When it is, it will require critical infrastructure companies to report significant cyber incidents to the Cybersecurity and Infrastructure Security Agency within 72 hours, and ransom payments within 24 hours.

Congress passed CIRCIA in March 2022. The law gave CISA until 2025 to write the final rule. It’s more than a year late.

US Cyber Information-Sharing Law Runs on Stopgaps While the EU Cyber Resilience Act Reporting Clock Starts

Tue, 06 Oct 2026 00:00:00 +0000

On 11 September 2026 a new obligation started for every company selling software or connected hardware in the EU. If a vulnerability in one of their products is being actively exploited, they now have 24 hours to send an early warning, 72 hours to file a notification, and 14 days after a fix is available to send a final report. It applies to products already on the market too. ENISA, the EU cybersecurity agency, opened its single reporting platform the same day.

CISA's Midterm Election Security Plan Leaves States and Counties Paying for What Washington Used to Provide

Fri, 25 Sep 2026 00:00:00 +0000

On 24 September, six weeks before the midterms, the Cybersecurity and Infrastructure Security Agency released its 2026 Election Infrastructure Security Plan. It promises monthly classified threat briefings with the FBI and intelligence agencies at more than 70 secure sites, a free threat-sharing platform linked to state fusion centres, and election advice from CISA’s ten regional directors.

What it doesn’t include is the dedicated election staff and funding the agency cut in 2025. The plan gives no staffing numbers or budget, and doesn’t mention the information-sharing centre most counties used.