This is the seventh blog in a series of Covington blogs on cybersecurity policies, executive orders (“EOs”), and other actions of the Trump Administration.  The sixth blog is available here and our initial blog is available here.  This blog describes key cybersecurity developments that took place in August, September, and October 2025. 

NIST Publishes Second Draft of Foundational Cybersecurity Activities for IoT Product Manufacturers (NIST IR 8259)

On September 30, National Institute of Standards and Technology (“NIST”) released the second public draft of its NIST Internal Report (“IR”) 8259, Foundational Cybersecurity Activities for Internet of Things (“IoT”) Product Manufacturers.  This publication outlines foundational cybersecurity activities and serves as a guide for IoT manufacturers to bolster the cybersecurity of their IoT products.  The goal of the publication is to allow manufacturers to meet both regulatory standards and customer needs for secure deployment of their products.  Key updates include the inclusion of “Activity 0: Prioritize Cybersecurity and Maintain Cybersecurity Posture,” emphasizing the necessity for manufacturers to embed cybersecurity considerations throughout their product development processes.  This activity addresses the need for a robust internal cybersecurity posture to protect both IoT products and the organizational systems.  The draft also details the introduction of new activities tailored to better define IoT product cybersecurity capabilities, focusing on aligning these capabilities with customer needs and goals.  Manufacturers are encouraged to use industry frameworks, such as NIST’s Cybersecurity Framework (“CSF”) and Risk Management Framework (“RMF”), to evaluate and mitigate risks.  Additionally, guidance on secure software development and supply chain risk management has been expanded, referencing NIST Special Publication (“SP”) 800-161 Rev 1.  The draft underscores the importance of continuous communication about software updates and product support to aid customers in maintaining IoT product cybersecurity throughout its lifecycle, including guidelines for end-of-life product management and decommissioning.  

Cybersecurity Maturity Model Certification (CMMC) Program Procurement Final Rule Announced

On September 10, 2025, DoD published the final version of the Cybersecurity Maturity Model Certification (“CMMC”) Defense Federal Acquisition Regulation Supplement (“DFARS”) Procurement Rule (“Procurement Rule” or “Rule”) in the Federal Register.  We wrote about the Rule in more detail here.  This Rule imposes the contractual requirements associated with the CMMC Program Rule that was published in final form in October 2024.  The Procurement Rule will become effective sixty days after publication, on November 10, 2025 and will be implemented in a phased approach.  

The CMMC Program is expected to have significant impacts on the federal supply chain, imposing certification requirements on all contractors and subcontractors with DoD contracts that include the relevant DFARS clause (currently DFARS 252.204–7021) and under which Federal Contract Information and/or Controlled Unclassified Information is processed, stored, or transmitted on contractor information systems.  We have developed a toolkit of additional resources on CMMC available here.

CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure

The U.S. Cybersecurity and Infrastructure Security Agency (“CISA”) plans to delay the publication of its much-anticipated cybersecurity incident reporting rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (“CIRCIA”).  We wrote about this update here.  According to an entry on the Spring 2025 Unified Agenda of Regulatory and Deregulatory Actions, released on September 4, 2025, CISA currently plans to publish the Final Rule sometime in May 2026, and it likely will not go into effect until sometime afterwards.

As discussed in a previous blog post, CIRCIA established two cyber incident reporting requirements that are broadly applicable to covered entities in one of the 16 U.S. critical infrastructure sectors.  When the Final Rule goes into effect, covered entities will be required to report covered cyber incidents within 72 hours of discovery and covered ransom payments within 24 hours.  CISA published the Notice of Proposed Rulemaking (“Proposed Rule”) on April 4, 2024, and the statute required CISA to publish the Final Rule within 18 months of the Proposed Rule.  Accordingly, the Final Rule was previously expected to arrive by October 2025.

Cybersecurity Information Sharing Act of 2015 Allowed to Sunset

The Cybersecurity Information Sharing Act of 2015 (“CISA 2015”), which provided protections for sharing cybersecurity threat information with the federal government and others, officially sunset on September 30, 2025 pursuant to the law’s original sunset date after efforts to re-authorize it did not succeed.  We wrote about this update here.  The law created a cybersecurity information sharing framework and established certain protections – including disclosure under FOIA, limits to liability, and limits to waiver of legal privilege – for sharing that information with private parties and the federal government.  While the expiration does not prohibit industry participants from ongoing or future sharing of cyber threat information with the federal government and others, private sector companies can no longer rely on the liability protections in CISA 2015 when doing so. 

Although several bills had been introduced in recent months to re-authorize CISA 2015’s protections, including some that would have adjusted or altered CISA 2015’s provisions, none of the bills significantly progressed before the current U.S. government shutdown.  Going forward, organizations that share cyber threat information should consider how the absence of CISA 2015’s protections might impact their sharing practices and monitor for future legislative efforts to re-authorize CISA 2015 or create a similar replacement framework for information sharing. 

NIST Releases Long Awaited Revision to the Digital Identity Guidelines

On August 1, NIST announced the release of SP 800-63 Revision 4, Digital Identity Guidelines, which can be found here.  This update comes after four years of drafting and thousands of public comments. The stated goal of the release is for the updated guidelines to “make navigating the digital world more secure and convenient.”  It explains that “a digital identity is intended to establish trust between the holder of the digital identity and the person, organization, or system interacting with the online service” and notes that online services require secure digital identity solutions to be secure themselves. 

NIST explained that the new guidelines intend to “respond to the changing digital landscape” since its last revision in 2017.  NIST intends for this revision to focus on risk management adapted from real-world lessons learned.  Some of the major changes include expanded fraud requirements, identity proofing processes, controls for deep fakes, and changes to the password composition and rotation expectations.  It is possible that agencies could choose to incorporate some or all aspects of these guidelines into contracts for the acquisition of software services and, ultimately, contractors who are required to comply with the Digital Identity Guidelines will need to ensure their services comply with the requirements of Revision 4. 

CISA Updates Guidance for Minimum Elements of Software Bills of Materials

On August 25, CISA announced the release of draft guidance for 2025 Minimum Elements for a Software Bill of Materials (“SBOM”).  This has initially been released as a draft here.  As background, the first SBOM minimum elements guide was released in 2021 in response to a Biden administration EO.  CISA was seeking feedback on the draft guidance and published its request for comment here.  The new minimum elements aim to reflect expanded capabilities and advancement of SBOM tooling since the inception of the guidance in 2021.  Although not required by law, CISA hopes that these new minimum elements will continue to promote SBOMs as a way to provide information to software users and to better inform supply chain risk management in their software supply chains.

NIST Internet of Things Internal Report

On August 25, the NIST National Cybersecurity Center published the final version of the NIST IR 8349, Methodology for Characterizing Network Behavior of IoT Devices that it announced here.  The report works in tandem with the Cybersecurity Center’s project Securing Home IoT Devices Using Manufacturer Usage Description (“MUD”), through which companies create MUD profiles for their IOT devices and a companion “MUD-PD” tool released by NIST to help with the characterization of IoT devices.  The goal of the report is to create a system for characterizing IoT devices to enable a better understanding of IoT device network behavior, which will allow for the more effective implementation of appropriate network access controls, such as firewall rules or access control lists.  The report walks through the new network traffic capture methodology that is used for the MUD profile, then discusses the various use cases, network communications, and privacy implications of devices.

New NIST Cryptography Standard for Small Devices

On August 13, NIST finalized SP 800-232, Ascon-Based Lightweight Cryptography Standards for Constrained Devices: Authenticated Encryption, Hash, and Extendable Output Functions, here.  This document identifies four recommended cryptography standards specifically adapted for small devices, which NIST describes as ready for use to protect data created and transmitted by IoT devices.  These algorithms require less computing power and time than more conventional cryptographic methods.  NIST envisions that this will protect information created and transmitted by billions of devices of IoT devices as well as other small electronics, such as RFID tags and medical implants.