Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The regulatory and compliance landscape evolved rapidly in 2025, with changes key changes affecting cybersecurity, privacy, and protective security. This review breaks down key compliance changes, offering insights into new requirements and how to ensure compliance in 2026.

Data security in 2025 was less about reacting to breaches and more about surviving in a world where data is everywhere, attackers are faster, and trust is fragile. While the core goal of protecting sensitive information hasn’t changed, how organizations approach security has evolved significantly.

In today’s high-turnover work environment, we’re watching something unusual happen: record numbers of security cleared, experienced professionals are re-entering the job market. They’re leaving shuttered programs, reorganised agencies, downsized contractors, and sometimes entire departments caught in a budget reshuffle. Conventional wisdom says these people are an asset anywhere they land.

Data governance and protection are crucial in safeguarding sensitive information. Proper classification and data labeling are essential to ensure that the right people access the right information. Failure to implement these practices can result in data breaches, financial losses, and reputational harm. To help with this, Microsoft offers sensitivity labels that classify and protect data as part of the compliance and security capabilities of Microsoft Purview Information Protection in Microsoft 365.

Starting November 10, Phase 1 of the US Department of Defense’s CMMC 2.0 program went into effect, marking the start of a phased three-year rollout. Phase 1 begins with Level 1 and 2 self-assessments and culminates with the full implementation of program requirements in Phase 4. Organizations that fail to demonstrate compliance will not be eligible to bid on U.S. Defense contracts.

Earlier this week, The Australian broke the news that the Cyber Touhan hacking group stole classified plans for Australia’s new infantry fighting vehicles, a $7B AUD procurement program, in a massive cyber-attack targeting 17 Israeli defence contractors in the supply chain. The attack was carried out by targeting a downstream supplier, MAYA Technologies, exploiting vulnerabilities in their network and peripherals to gain access to sensitive data.

In response to evolving digital risks and growing concerns about data misuse, Australia has introduced a substantial privacy reform via the Privacy and Other Legislation Amendment Act 2024 (POLA Act) passed on December 10, 2024 Designed to modernise the country’s privacy framework and better align it with international standards like the General Data Protection Regulation (GDPR), the POLA Act marks a pivotal shift in how personal information is defined, managed, and protected.

Historically, secure communication across allied nations has been hindered by disparate standards and manual tagging processes. The challenge: each nation and its respective defense agencies have their own data classification and security standards and protocols, making interoperability between allies a constant struggle.

Australia’s updated Protective Security Policy Framework (PSPF) now mandates the adoption of Zero Trust principles. Australia’s Protective Security Policy Framework (PSPF) Annual Release 2025 now formally mandates the adoption of zero trust principles to improve cybersecurity posture. Government organisations must now align their cybersecurity strategies with the Information Security Manual and the Guiding Principles to Embed a Zero Trust Culture.

As organizations move to the cloud, ensuring robust data security and privacy controls has become a top priority. Encryption is crucial for any organization’s cloud security and data sovereignty strategy; however, who controls the encryption keys can significantly affect the effectiveness of these measures.