openskills.info
← Chief Information Security Officer career guide

Executive and leadership

Chief Information Security Officer timeline

How the field of a Chief Information Security Officer got here: the sourced milestones from every published course of this career, on one axis.

1975 to 2026

373 milestones across 39 courses

  • Core
  • Supporting
  • Specialization

The axis stretches toward recent years, where most milestones fall. Bars count milestones per year; dots are single milestones.

Before 1990

19 milestones

  1. 1975 Sep

    Saltzer and Schroeder publish eight protection principles

    The paper organized recurring protection choices into eight design principles, including fail-safe defaults, complete mediation, open design, and least privilege.

  2. 1979

    FIPS 65 offers early risk analysis guidance

    NIST publishes FIPS 65 as one of the earliest federal pieces of guidance for analyzing risk to information technology systems, establishing that security decisions should rest on a structured estimate of exposure rather than on intuition.

  3. 1980

    OECD Privacy Guidelines adopted

    The OECD issued privacy principles for personal-data protection and transborder data flows. The principles gave later engineering and regulatory work a shared vocabulary for collection, use, safeguards, openness, participation, and accountability.

  4. 1981

    FIPS 87 addresses ADP contingency planning

    NIST's history records FIPS 87 as an early guideline for automatic data processing contingency planning. It established continuity planning as a defined concern for computerized operations.

  6. 1981

    NIST publishes FIPS 87

    NIST published Guidelines for ADP Contingency Planning. It established federal guidance for planning recovery of automatic data processing systems.

  11. 1985 Dec

    The Orange Book formalizes trusted-system evaluation criteria

    The final Trusted Computer System Evaluation Criteria connected security features with assurance requirements and defined graded evaluation classes for computer systems.

  12. 1987

    Computer Security Act establishes federal responsibility

    The Act assigned NBS, later NIST, responsibility for computer security standards for unclassified federal systems. It established a durable public role for program guidance and training.

  13. 1987

    FISSEA begins as a practitioner community

    NIST established the Federal Information Systems Security Educators' Association to help agencies improve cybersecurity awareness and training programs. The community created an exchange point for people running those programs.

  14. 1988

    The Morris worm makes fix distribution a discipline

    The Morris worm exploited a sendmail buffer overflow and spread across thousands of hosts in hours. The cleanup effort showed how unprepared operators were to deploy fixes quickly, making fast, coordinated fix distribution an operational necessity.

  15. 1988 Nov

    CERT Coordination Center is created after the Morris Worm

    The Morris Worm disrupted the early Internet on November 2, 1988. DARPA asked the Software Engineering Institute to establish the coordination center that became CERT/CC so incident analysis and communication could be coordinated.

  16. 1988 Nov

    Morris Worm prompts the CERT Coordination Center

    After the Internet worm disrupted connected systems, DARPA asked the Software Engineering Institute to establish a coordination point for computer-security incidents. Incident response gained a dedicated function for sharing analysis and mitigation information.

  17. 1988 Nov 2

    Morris Worm and CERT/CC formation

    The Morris Worm disrupted the early Internet. DARPA asked the Software Engineering Institute to establish the CERT Coordination Center to coordinate vulnerability reporting and incident response.

  18. 1989

    NIST publishes SP 500-172

    Computer Security Training Guidelines documented early federal training guidance. Later NIST guidance identifies it as the publication superseded by the role- and performance-based model.

  19. 1989

    PC Cyborg, also called the AIDS Trojan, appears

    The first ransomware attack used infected diskettes and a ransom demand after repeated system reboots. It established the extortion pattern before modern internet-scale delivery.

1990s

20 milestones

  1. 1990

    FIRST forms to connect incident response teams

    The Forum of Incident Response and Security Teams formed after separate response teams encountered coordination problems across constituencies, languages, and time zones. Security response gained a continuing international coordination forum.

  2. 1990

    FIRST is formed

    The Forum of Incident Response and Security Teams formed after isolated responses produced duplicated effort and conflicting solutions. It made cross-team communication and cooperation a durable part of the practice.

  3. 1991 Nov

    NIST publishes SP 800-3

    NIST documented how to establish a computer security incident response capability. The guide framed centralized, skilled response as a way to react quickly and prevent recurring problems.

  4. 1992 Jan

    Balanced Scorecard introduced in Harvard Business Review

    Kaplan and Norton presented a framework that balanced financial measures with customer, internal-process, and learning perspectives. Executive reporting gained a broader structure than financial results alone.

  5. 1992 Apr

    SAS 70 issued

    The AICPA issued Statement on Auditing Standards No. 70 for reporting on controls at service organizations, which became the dominant US mechanism for those examinations for nearly two decades.

  6. 1994 Apr

    WTO Government Procurement Agreement adopted

    The Agreement established international rules for covered government procurement. It made procurement transparency and non-discrimination part of a multilateral framework.

  7. 1995

    NIST SP 800-12 introduces computer security guidance

    NIST published a general computer security handbook. It provided a public foundation before later risk-specific guidance.

  8. 1995 Feb

    BS 7799-1 published by BSI

    The British Standards Institution published BS 7799-1, a code of practice for information security management. It gave practitioners a shared vocabulary for security controls, which later fed the international standard.

  9. 1995 Oct

    EU Data Protection Directive adopted

    Directive 95/46/EC established a European legal framework for personal-data processing. It made system processing practices a sustained regulatory concern rather than a policy-only topic.

  10. 1995 Oct

    NIST publishes the original SP 800-12 handbook

    The handbook introduced information security fundamentals, including the concept of controls and the management, operational, and technical classes. It gave practitioners a durable vocabulary for connecting safeguards to protection objectives.

  11. 1995 Oct

    NIST SP 800-12 establishes a broad security handbook

    The original Introduction to Computer Security organized foundational security principles and management concerns for organizations.

  13. 1996

    NIST SP 800-14 publishes security principles

    NIST published generally accepted principles and practices for securing information technology systems. Security practice gained defined management expectations.

  14. 1996 Aug 21

    HIPAA becomes United States law

    HIPAA established a statutory basis for standards governing electronic health information. Its later Security Rule made information-system activity controls relevant to databases containing electronic protected health information.

  15. 1998 Apr

    NIST SP 800-16 defines a role- and performance-based model

    SP 800-16 updated training guidance for distributed computing and connected training requirements to job function and risk decisions. It distinguished awareness from deeper role-based preparation.

  16. 1999

    CVE List launches

    MITRE launched the Common Vulnerabilities and Exposures List. Shared identifiers made it possible to correlate vendor, tool, and advisory references to the same public weakness.

  17. 1999

    STRIDE is introduced at Microsoft

    Loren Kohnfelder and Praerit Garg's internal paper introduced STRIDE. The taxonomy gave software teams a repeatable way to enumerate threats during design analysis.

  18. 1999

    The CVE project gives every flaw a shared name

    MITRE launched the Common Vulnerabilities and Exposures project so each publicly known vulnerability received one canonical identifier. The numbering scheme became the identity layer that CNAs, advisories, and the KEV catalog build on.

  19. 1999

    Traffic Light Protocol established

    The UK NISCC established TLP to express how far sensitive security information may be shared. It gave operational communities a compact handling vocabulary for exchange.

  20. 1999 Sep

    CVE List launches publicly

    The CVE Program launched its public list with a common set of identifiers for known vulnerabilities. Security teams and products gained a shared reference for exchanging vulnerability information.

2000s

75 milestones

  1. 2000

    ICAT becomes a vulnerability index

    NIST changed ICAT from an attack catalog into the ICAT Metabase for vulnerabilities. It linked vulnerability information with public advisories, bulletins, and patch sites.

  2. 2000 Dec

    ISO/IEC 17799:2000 published

    The first international edition of the code of practice, ISO/IEC 17799:2000, made the BS 7799 approach available globally. It established the control-catalog tradition that became Annex A.

  3. 2001

    NIST SP 800-26 supports self-assessment

    NIST published a questionnaire-based self-assessment guide. Assessment became a repeatable control-management activity.

  4. 2001

    Vontu founded to build policy-based leak prevention

    Vontu launched in San Francisco to detect and block disclosure of sensitive data by policy. Its product was later described as the first to combine endpoint and network coverage for data at rest, in motion, and in use, the three-state framing DLP still uses.

  5. 2001 Jun

    NIST publishes its baseline IT security engineering principles

    NIST SP 800-27 moved system-level principles into federal guidance for the design, development, and operation of information systems.

  6. 2001 Aug

    BSD syslog behavior documented in RFC 3164

    RFC 3164 documented the widely implemented BSD syslog message and relay model. It gave centralized collectors a shared reference while also recording delivery and security limitations.

  7. 2002

    FISMA requires awareness and training responsibilities

    FISMA created federal requirements for users to understand information-security responsibilities and for agencies to train people with significant security duties. This made broad awareness and specialized training linked obligations.

  8. 2002

    NIST SP 800-30 frames IT risk assessment

    NIST published a risk-management guide for information technology systems. It described assessment methods and control-selection recommendations.

  9. 2002

    NIST SP 800-34 is published

    NIST published its Contingency Planning Guide for Information Technology Systems. The guide brought business impact analysis, contingency strategies, plan development, testing, and maintenance into one IT planning process.

  10. 2002

    Trustworthy Computing drives security process changes

    Microsoft's Trustworthy Computing directive led product groups to run security pushes that included threat modeling and mitigation. It moved the practice toward a development-process expectation.

  11. 2002 Jun

    NIST SP 800-34 addresses IT contingency planning

    NIST published the Contingency Planning Guide for Information Technology Systems. The guide covered a contingency-planning process and technical considerations for IT systems.

  13. 2002 Jul

    NIST SP 800-30 defines IT risk assessment

    NIST publishes the original SP 800-30, the Risk Management Guide for Information Technology Systems, giving assessors a methodology for identifying threats and vulnerabilities and rating risk on a qualitative scale.

  15. 2002 Jul 30

    Sarbanes-Oxley Act enacted

    The Act strengthened corporate responsibility and financial disclosure requirements. Database change and access evidence became part of how many organizations support internal-control assessments over financial reporting systems.

  16. 2002 Dec

    FISMA becomes law within the E-Government Act

    The Federal Information Security Management Act required federal agencies to develop, document, and implement information security programs. That obligation created the legal driver for standardized security controls across the federal government.

  17. 2002 Dec

    FISMA makes risk management a federal mandate

    The E-Government Act of 2002 enacts FISMA, requiring federal agencies to conduct risk assessments and authorize systems before operation, turning the SP 800-30 methodology into a statutory practice.

  18. 2002 Dec

    FISMA requires agency-wide programs

    FISMA tasked NIST with federal standards and guidelines and required documented agency-wide information security programs.

  19. 2003

    Microsoft Patch Tuesday establishes a predictable cadence

    Microsoft moved to a monthly security update cycle published on the second Tuesday of each month. The regular rhythm gave enterprises a planning beat, while out-of-band releases became the mechanism for fixes that could not wait.

  21. 2003 Feb 20

    HIPAA Security Rule finalized

    HHS finalized technical safeguards that include audit controls. The rule requires mechanisms to record and examine activity in systems that contain or use electronic protected health information.

  22. 2003 Aug

    NIST SP 800-55 published

    NIST published its initial guide for using performance measures to assess information security controls, policies, and procedures.

  23. 2003 Oct

    NIST SP 800-50 frames awareness as a program life cycle

    SP 800-50 organized awareness and training around program design, material development, implementation, and post-implementation activity. Practice shifted from a standalone presentation toward managed program work.

  24. 2004

    Microsoft SDL makes threat modeling a lifecycle activity

    The Security Development Lifecycle became integral to Microsoft's development process. Threat modeling was established as a design-phase activity alongside security testing and review.

  25. 2004

    NIST SP 800-37 introduces system authorization

    NIST publishes the original SP 800-37, formalizing the certification and accreditation process in which a senior official reviews assessed risk and explicitly authorizes a system to operate.

  26. 2004

    NIST SP 800-37 links assessment to authorization

    NIST published guidance using risk and control assessments to inform a senior official's approval of a system's security posture.

  27. 2004 Jan

    NIST publishes SP 800-61

    The Computer Security Incident Handling Guide defined basic incident response terminology and concepts for organizational capabilities.

  28. 2004 Mar

    EU public procurement directive adopted

    Directive 2004/18/EC consolidated rules for public works, supply, and service contracts. It gave European public buyers a common procedural baseline.

  29. 2004 Jun

    NIST revises the engineering-principles baseline

    Revision A clarified a structured foundation that covered technical countermeasures alongside policy, procedures, and user education.

  30. 2004 Jul

    Jericho Forum presents de-perimeterisation at Black Hat

    The Jericho Forum argued that a hard trusted-inside boundary could not support open collaboration. Its presentation shifted protection toward data, systems, interoperable controls, and defense in depth.

  31. 2005

    Common Weakness Enumeration work begins

    MITRE began the work that led to CWE under the NIST SAMATE project. The taxonomy connected individual vulnerability records to recurring classes of software weakness.

  32. 2005

    ISO/IEC 27001 first edition published

    ISO published the first ISO/IEC 27001 edition, establishing an information security management system standard. It made risk-based management and continual improvement a formal management-system path for information security.

  33. 2005

    Microsoft documents the SDL publicly

    Microsoft's public SDL material described threat modeling and testing as part of a repeatable secure-development process. The practice became accessible beyond its original internal use.

  34. 2005

    National Vulnerability Database launches

    NIST replaced ICAT with the National Vulnerability Database. Vulnerability-management programs gained a national source for enriched vulnerability data and search.

  35. 2005

    NIST SP 800-53 establishes control baselines

    NIST published a control catalog with low, moderate, and high baselines. Teams gained a starting point adjustable for system-specific risk.

  36. 2005

    NIST SP 800-53 introduces a federal control catalog

    NIST published the first SP 800-53 control catalog. It placed contingency planning among the recommended security outcomes that organizations could tailor to system risk.

  37. 2005

    WSUS brings patching to estate scale

    Windows Server Update Services gave organizations control over distributing Microsoft updates across thousands of machines, with approval, targeting, and reporting replacing per-machine update checks.

  38. 2005 Feb

    NIST SP 800-53 published

    NIST published a catalog for selecting and specifying security controls for federal information systems. It established a repeatable control selection approach that accounts for system categorization.

  39. 2005 Apr 20

    HIPAA Security Rule compliance begins

    The main compliance date arrived for covered entities, with small health plans receiving one additional year. Audit controls moved from a published requirement into an operating obligation for covered systems.

  40. 2005 Jun

    ISO/IEC 17799:2005 revised

    A revised edition updated the code of practice, tightening the control set and its presentation. It remained the reference for implementing information security management controls.

  41. 2005 Oct

    ISO/IEC 27001 first edition published

    ISO and IEC published ISO/IEC 27001:2005 for information security management systems. The standard tied risk-based management to the selection of proportionate controls for information assets.

  43. 2006

    CWE first release

    MITRE released the first Common Weakness Enumeration List. Practitioners gained a structured vocabulary for grouping recurring weakness patterns behind individual findings.

  44. 2006

    Information Dashboard Design published

    Stephen Few's book formalized dashboard design around rapid monitoring and effective visual communication. It gave practitioners a focused reference for reducing clutter and strengthening comparisons.

  45. 2006

    NIST SP 800-100 published

    NIST published Information Security Handbook: A Guide for Managers. It connected information-security program governance with management roles, controls, and performance measures.

  46. 2006

    NIST SP 800-84 formalizes IT plan testing

    NIST SP 800-84 provided guidance on testing, training, and exercising IT plans and capabilities. It distinguished preparation activities from evidence that a plan can operate.

  47. 2006

    PCI DSS v1.1

    PCI DSS v1.1 became the baseline referenced by the later SAQ revision history. The standard began a documented cadence of aligned validation tools and requirements.

  48. 2006

    SDL is released for wider adoption

    Microsoft records 2006 through 2008 as the period when the SDL was released publicly and threat-modeling tooling collaboration expanded. This positioned design analysis as a reusable industry practice.

  49. 2006 Mar

    NIST publishes FIPS 200

    FIPS 200 established minimum security requirements for federal information and information systems, organized across seventeen security-related areas. It defined the management, operational, and technical control classes.

  50. 2006 Sep

    NIST publishes enterprise log-management guidance

    NIST SP 800-92 described log-management infrastructure, planning, and operational processes across an enterprise. Logging became an explicit program that supported analysis and incident handling rather than a collection of isolated files.

  51. 2006 Sep

    NIST publishes SP 800-92

    NIST published enterprise guidance for computer security log management. The guide described centralized infrastructures and identified SIEM as a class of analysis-focused logging software.

  53. 2006 Sep

    NIST SP 800-92 finalized

    NIST published enterprise guidance for building log-management infrastructure and processes. Database audit records could now be placed in a broader collection, analysis, storage, and operational model.

  54. 2006 Oct

    NIST SP 800-100 focuses on security program managers

    The handbook assembled program elements for managers establishing and implementing an information security program.

  55. 2006 Dec

    NIST publishes SP 800-53 Revision 1

    Revision 1 of the security controls catalog organized controls into families and established the baseline model tied to FIPS 199 impact levels. It turned statutory requirements into a specific, assessable control set.

  57. 2007

    NIST SP 800-100 final update

    NIST issued the final update to SP 800-100. Its handbook framing kept governance and management distinct from operational security work.

  58. 2007 May

    Jericho Forum Commandments version 1.2 published

    The commandments documented design principles for systems operating beyond a fixed perimeter. They connected open networks with data protection, identity, trust, and policy enforcement.

  59. 2007 Aug

    The 17799 series is renumbered into the 27000 family

    ISO/IEC 17799:2005 and its Corrigendum changed the reference number to ISO/IEC 27002:2005, aligning the code of practice's numbering with the 27000 family that 27001 had started.

  60. 2007 Nov

    Symantec acquires Vontu for 350 million dollars

    Symantec announced the purchase of Vontu for 350 million dollars and completed it at the end of the month. The deal moved DLP from a niche category into the portfolios of mainstream enterprise security vendors.

  62. 2008

    NIST SP 800-53A formalizes assessment procedures

    NIST published guidance for assessment plans and procedures. Controls could be tested for operating as intended rather than assumed from their existence.

  63. 2008 Mar

    NIST issues SP 800-61 Revision 1

    Revision 1 updated the incident-handling guide. Its later supersession records the revision as part of the sequence that shaped the familiar preparation-through-lessons-learned model.

  64. 2008 Jul

    NIST publishes the original SP 800-53A

    The assessment guide defined examine, interview, and test procedures for determining whether controls are implemented correctly, operating as intended, and producing the desired outcome. It made control assessment a repeatable discipline.

  65. 2008 Jul

    NIST SP 800-55 Revision 1 published

    Revision 1 updated performance-measurement guidance and linked measures to resource allocation and reporting.

  66. 2008 Aug

    McAfee completes its Reconnex acquisition

    McAfee closed its 46 million dollar acquisition of Reconnex, a network DLP and data-at-rest discovery vendor, and folded the technology into ePolicy Orchestrator. Consolidation ran in parallel, with EMC buying Tablus and Websense buying PortAuthority.

  67. 2008 Oct

    PCI DSS v1.2

    Version 1.2 aligned the SAQ with revised requirements and testing procedures. This made version changes operational for entities using reporting tools.

  68. 2008 Dec 11

    WCAG 2.0 becomes a W3C Recommendation

    WCAG 2.0 established durable web accessibility requirements that also apply to browser-delivered reports, controls, charts, and status cues.

  69. 2009

    Privacy by Design principles published

    Ontario's Privacy by Design framework set out seven foundational principles, including proactive design and privacy as the default setting. It helped frame privacy as something built into systems and business practices.

  70. 2009

    SDL collaboration expands beyond Microsoft

    Microsoft's SDL timeline records collaboration with SAFECode, Adobe, Cisco, DISA, and NIST from 2009 through 2011. Threat modeling became part of wider secure-development guidance and exchange.

  71. 2009 Mar

    NIST drafts a revision to SP 800-16

    The draft revision incorporated awareness-training and role-based-training mandates that followed the 1998 publication. It kept role-specific responsibilities central to the training model.

  72. 2009 Mar

    RFC 5424 standardizes the syslog protocol

    RFC 5424 replaced RFC 3164 with a standards-track, transport-independent protocol and structured data model. It made event format, timestamps, extensions, and transport mappings more explicit.

  73. 2009 Apr

    Directions in Security Metrics Research published

    NIST published research directions that treated security measurement as a continuing technical and organizational problem.

  74. 2009 Aug

    NIST SP 800-53 Revision 3 expands the control catalog

    Revision 3 delivered a major update to security controls for federal systems and organizations. Its catalog supported consistent requirements while remaining complementary to other standards.

2010s

135 milestones

  1. 2010

    NIST SP 800-37 Revision 1 defines the RMF

    NIST expanded certification and accreditation into the Risk Management Framework. Risk management was described as a system life-cycle process.

  2. 2010

    NIST updates SP 800-34 as Revision 1

    Revision 1 updated the federal contingency planning guide and described its relationship to related security and emergency management plans. It retained a system-focused process for determining requirements and priorities.

  3. 2010

    SP 800-37 Rev. 1 establishes the Risk Management Framework

    NIST revises SP 800-37 into the Risk Management Framework, replacing certification and accreditation with a life-cycle process of categorize, select, implement, assess, authorize, and monitor.

  4. 2010 Feb

    Risk Management Framework replaces certification focus

    SP 800-37 Revision 1 described a six-step lifecycle with control selection, assessment, authorization, and ongoing monitoring.

  5. 2010 Apr

    SSAE 16 announced to replace SAS 70

    The AICPA moved service-organization reporting from an auditing standard (SAS 70) to an attestation standard (SSAE 16), aligning more closely with international assurance practice.

  7. 2010 Jun

    AWS publishes backup and disaster-recovery guidance

    AWS described backup and disaster-recovery use cases for cloud storage and service providers. Cloud storage changed how teams could obtain off-site recovery capacity.

  8. 2010 Jun

    NIST publishes guidance for significant security responsibilities

    An ITL Bulletin helped agencies identify personnel whose duties required focused information-security training. The guidance made the selection of role-based audiences an explicit program task.

  9. 2010 Jun

    NIST SP 800-53A Revision 1 published

    The assessment guide described procedures for evaluating security controls. This strengthened the distinction between recording an access decision and obtaining evidence that a control operates.

  10. 2010 Aug

    Forrester presents the Zero Trust model

    John Kindervag's webinar named a zero-trust model that treated all users as untrusted and placed security throughout the network rather than only at its edge.

  11. 2010 Oct

    PCI DSS v2.0

    Version 2.0 updated requirements and testing procedures. The associated SAQ history records the alignment of assessment documentation with that revision.

  12. 2010 Nov

    NIST SP 800-34 Revision 1 updates the guide

    Revision 1 updated the contingency-planning guide with practical guidance on plan development, requirements, priorities, resilience, and the system development life cycle.

  13. 2010 Nov 4

    Commission outlines a comprehensive reform

    The Commission presented its comprehensive approach to personal-data protection, beginning the policy path toward a new regulation.

  14. 2011

    Cyber Kill Chain paper published

    Lockheed Martin published an intelligence-driven defense model that linked intrusion phases, indicators, defensive actions, and campaign analysis in an iterative feedback loop.

  15. 2011

    NIST publishes patch-management guidance

    NIST SP 800-40 Revision 3 described enterprise patch management as preventive maintenance. The guidance emphasized identification, prioritization, acquisition, testing, deployment, and verification.

  16. 2011

    NIST SP 800-137 addresses continuous monitoring

    NIST published continuous-monitoring guidance. Monitoring became an ongoing activity rather than a point-in-time check.

  17. 2011

    NIST SP 800-39 connects organization and system views

    NIST published guidance for organization, mission, and information-system risk. Local assessments became connected to wider governance.

  18. 2011

    SP 800-39 organizes risk across three tiers

    NIST publishes SP 800-39, Managing Information Security Risk, framing risk management as an ongoing process at the organization, mission/business-process, and information-system tiers.

  19. 2011 Mar

    Government ICT Strategy published

    The strategy set a central direction for government ICT and its implementation over the following two years. It made technology purchasing and reuse a cross-government management concern.

  20. 2011 May

    CyDefSIG project began

    The project later named MISP began as an attempt to replace IOC exchange through email and PDF files with machine-processable sharing.

  21. 2011 Jun 15

    SSAE 16 effective for period ends

    SSAE 16 became required for service organization reports with periods ending on or after June 15, 2011, ending SAS 70 as the governing standard for new reporting periods.

  22. 2011 Sep

    NIST formalizes information security continuous monitoring

    NIST SP 800-137 defined an organization-wide strategy for ongoing visibility into assets, threats, vulnerabilities, and control effectiveness. Monitoring outputs were tied directly to risk decisions and risk tolerance.

  23. 2011 Sep

    NIST SP 800-137 established continuous monitoring guidance

    The guide connected ongoing visibility into assets, threats, vulnerabilities, and control effectiveness with organizational risk tolerance.

  24. 2011 Dec

    ISO/IEC 29100 privacy framework published

    ISO/IEC 29100 provided a privacy framework and privacy principles for personally identifiable information processing. It supplied a standards-oriented reference for integrating privacy into information and communication technology systems.

  25. 2012

    ISO 22301:2012 is published

    ISO 22301:2012 became the earlier published edition identified in ISO's lifecycle for the business continuity management-system standard. It framed continuity as an organization-wide management system.

  26. 2012

    SP 800-30 Rev. 1 reframes the assessment

    NIST publishes SP 800-30 Revision 1, recasting the assessment as prepare, conduct, and maintain, and grounding risk as a function of threat-event likelihood and impact.

  27. 2012 Jan

    MITRE described the STIX effort

    MITRE published STIX as an effort to represent cyber threat information in an expressive, extensible, and automatable language.

  28. 2012 Jan

    NIST SP 800-162 defined ABAC considerations

    NIST described attribute-based access control and the attributes used in policy decisions. This made authoritative identity attributes a more explicit input to access decisions.

  30. 2012 Feb

    First G-Cloud supplier framework went live

    The framework introduced an online route for public-sector organizations to buy commodity IT services. Shorter, catalog-based cloud purchases changed the supplier arrangements contract managers had to operate.

  31. 2012 Feb

    G-Cloud framework opens to UK public buyers

    G-Cloud created a route for public bodies to buy cloud services. It shifted attention toward reusable frameworks and digital service marketplaces.

  32. 2012 Mar

    FTC privacy report calls for privacy by design

    The FTC's final report made privacy by design, simplified choice, and greater transparency central recommendations. It connected privacy expectations to product development and data practices.

  33. 2012 Aug

    NIST publishes SP 800-61 Revision 2

    Revision 2 addressed organizing an incident response capability and handling incidents from preparation through post-incident lessons learned. It became the widely used reference for the lifecycle model.

  34. 2012 Aug

    NIST SP 800-61 Revision 2 published

    NIST revised its Computer Security Incident Handling Guide to address evolving threats and incident response competencies. The guide linked preparation, detection, analysis, containment, recovery, and lessons learned into incident handling practice.

  35. 2012 Sep

    NIST SP 800-30 Revision 1 published

    The revision organized risk assessment into preparation, conduct, and maintenance, reinforcing assessment as an ongoing input to risk-management decisions.

  36. 2012 Nov

    TAXII exchange specifications appeared

    MITRE published TAXII specifications for services and message exchanges that transport structured cyber threat information between producers and consumers.

  37. 2013

    Exchange Server 2013 ships built-in DLP policies

    Microsoft added DLP policy templates, transport-rule conditions, and policy tips to Exchange Server 2013. Content inspection for email moved into the mail server itself rather than a separate appliance or gateway.

  38. 2013

    MITRE starts ATT&CK

    MITRE began ATT&CK to document adversary tactics, techniques, and procedures for research on endpoint telemetry and post-compromise analytics. Security operations teams gained a shared behavior model for detection and assessment.

  39. 2013

    NIST SP 800-40 Revision 3 frames patch management planning

    Revision 3 of the guide reframed the practice around planning patch management and vulnerability remediation for information technology, giving organizations a published process to follow rather than ad hoc patching.

  40. 2013 Feb

    Executive Order 13636 directs a cybersecurity framework

    The order directed development of a voluntary, risk-based framework for critical infrastructure cybersecurity. It created the policy origin for the NIST Cybersecurity Framework.

  41. 2013 Feb

    NIST requests input for a cybersecurity framework

    NIST published a request for information after Executive Order 13636. Public input and workshops began the Framework development process.

  42. 2013 Apr

    NIST publishes SP 800-53 Revision 4

    Revision 4 grew the catalog to eighteen families and added supply chain risk management controls. It responded to evolving threats and reinforced the need for tailored, risk-informed control selection.

  43. 2013 Apr

    NIST SP 800-53 Revision 4 published

    Revision 4 integrated privacy controls with security controls. Governance programs could relate identity and access evidence to a broader security and privacy control catalog.

  44. 2013 Apr 8

    STIX 1.0 released

    STIX 1.0 established a released schema for campaigns, indicators, incidents, threat actors, courses of action, and related CTI components.

  45. 2013 Jul

    Diamond Model published

    The Diamond Model formalized intrusion events around adversary, capability, infrastructure, and victim, with relationships used for analytic pivoting and activity grouping.

  46. 2013 Jul

    Preliminary Cybersecurity Framework released

    NIST released a preliminary Framework based on the request for information and public workshops. It gave stakeholders a concrete draft to discuss before the first release.

  47. 2013 Jul 8

    Microsoft details Power BI for Office 365

    Microsoft described browser and mobile access to reports built from Excel-based modeling and visualization components. Cloud distribution became part of the mainstream BI design path.

  48. 2013 Sep

    CryptoLocker begins the modern ransomware campaign model

    CryptoLocker paired malware distribution with encryption and a payment workflow. The Canadian Centre for Cyber Security identifies it as the first modern ransomware campaign.

  49. 2013 Sep

    MITRE created ATT&CK

    MITRE created the first ATT&CK model to organize adversary behavior observed during research into post-compromise detection.

  50. 2013 Oct

    ISO/IEC 27001:2013 second edition

    The 2013 edition reorganized the ISMS requirements around the common management-system structure and strengthened the risk-based approach, making the standard easier to align with other management systems.

  51. 2013 Oct

    ISO/IEC 27002:2013 second edition

    The companion controls standard was revised alongside 27001, keeping 114 controls as the reference for implementing information security management controls.

  53. 2013 Nov

    PCI DSS v3.0

    Version 3.0 added an in-scope system-component inventory requirement in its published change summary. Inventory became an explicit input to configuration standards and assessment scope.

  54. 2014

    Automated ransomware campaigns proliferate

    The CryptoLocker model spread through malicious attachments and broad campaigns from 2014 through 2016. Defense therefore needed to cover access paths and endpoints at scale.

  55. 2014

    Google publishes the first BeyondCorp architecture paper

    Google described removing the privileged intranet and making access depend on users and devices. The paper supplied a production example of resource access without location-based trust.

  56. 2014 Feb

    CSF 1.0 released

    NIST released Framework Version 1.0 for improving critical-infrastructure cybersecurity. Organizations, regulators, and customers could use its structure to guide and assess programs.

  57. 2014 Feb

    Cybersecurity Framework 1.0 broadens voluntary adoption

    NIST released the first Cybersecurity Framework for critical infrastructure organizations. Awareness and training then appeared inside a broader risk-management framework used beyond federal compliance.

  58. 2014 Feb

    NIST Cybersecurity Framework 1.0 organizes security outcomes

    The framework gave organizations a common risk-based structure around Identify, Protect, Detect, Respond, and Recover rather than prescribing one control implementation.

  61. 2014 Feb 12

    NIST Cybersecurity Framework 1.0 released

    NIST released a voluntary framework for improving critical infrastructure cybersecurity. Its five functions gave organizations a common structure for managing cybersecurity risk.

  62. 2014 Feb 12

    NIST releases Cybersecurity Framework 1.0

    The framework introduced a common risk language built around the Identify, Protect, Detect, Respond, and Recover functions. Profiles connected those outcomes to organizational needs without prescribing one implementation.

  63. 2014 Mar

    Directive 2014/24/EU adopted

    The directive replaced the 2004 EU public-procurement directive. It updated the legal framework for public purchasing and procurement procedures.

  64. 2014 Apr

    Heartbleed identifies a widely deployed OpenSSL flaw

    CVE-2014-0160 documented a memory-disclosure flaw in affected OpenSSL TLS and DTLS implementations. The event made rapid identification of deployed component versions an operational security need.

  65. 2014 Apr

    Revised WTO procurement agreement enters into force

    The revised Agreement entered into force for the parties that accepted it. It updated the international procurement framework and expanded its coverage.

  66. 2014 Apr 7

    Heartbleed disclosed

    A flaw in OpenSSL exposed memory from systems using affected releases. The event drew attention to the dependence of major services on critical open source components.

  67. 2014 Apr 24

    Core Infrastructure Initiative announced

    The Linux Foundation formed an industry-backed effort to identify and fund critical open source projects after Heartbleed.

  68. 2014 Dec

    Cybersecurity Enhancement Act reinforces NIST's role

    The Act directed NIST to facilitate and support voluntary, consensus-based approaches to reducing cyber risk. It gave the Framework work an ongoing statutory basis.

  69. 2015

    Government Commercial Function formed

    The Government Commercial Function brought commercial roles into a cross-government function. It established a central capability for commercial standards and improvement.

  70. 2015 Feb

    ESFA records digital procurement lessons

    A UK government digital team documented a move away from a single large IT contract toward component suppliers, market engagement, and supplier trials. It made procurement design part of delivery transformation.

  71. 2015 Apr

    Office 365 DLP extends to SharePoint Online and OneDrive

    Microsoft began previewing DLP for SharePoint Online and OneDrive for Business, adding policy evaluation to cloud content stores. Enforcement started to follow data into hosted repositories, not just mail flow.

  72. 2015 Apr

    PCI DSS v3.1

    The SAQ change history records an update to align the tool with PCI DSS v3.1. Reporting artifacts continued to move with the standard.

  73. 2015 May

    ATT&CK released publicly

    MITRE released Enterprise ATT&CK with 96 techniques, turning an internal research model into a public behavior knowledge base for defenders.

  74. 2015 Jun

    OASIS CTI Technical Committee formed

    OASIS formed the CTI Technical Committee to standardize and continue development of STIX, TAXII, and CybOX under an open standards process.

  75. 2015 Jul 24

    The new Power BI service reaches general availability

    Microsoft released the redesigned service and Power BI Desktop for general use. Reports, dashboards, semantic models, and custom visuals formed a broadly available reporting stack.

  76. 2015 Sep

    DLP rolls out in OneDrive, SharePoint Online, and Office 2016

    Microsoft began the general rollout of DLP across OneDrive for Business, SharePoint Online, and the Office 2016 desktop apps. Policy tips inside the editing applications brought data-in-use feedback to end users.

  77. 2015 Dec

    NIST asks for views on Framework use

    NIST requested information on organizations' experience with the Framework. The feedback informed the update process after Version 1.0.

  78. 2016

    BeyondCorp design-to-deployment account published

    Google documented deployment experience with dynamic device trust tiers. Zero trust moved from a high-level perimeter critique toward an operated access model.

  79. 2016

    NIST publishes draft data-centric threat-modeling guidance

    NIST SP 800-154 described data-centric system threat modeling as a form of risk assessment. It framed the practice around selected data and its attack and defense sides.

  81. 2016 Apr

    GDPR adopted with design and default duties

    The GDPR was adopted with Article 25 requiring data protection by design and by default. It made technical and organizational measures part of the legal expectation for processing systems.

  82. 2016 Apr

    PCI DSS v3.2

    PCI SSC released version 3.2 to replace v3.1 in response to growing threats to payment information. The standard remained a living security baseline rather than a fixed checklist.

  83. 2016 Apr

    SSAE 18 issued (clarification and recodification)

    The Auditing Standards Board issued SSAE No. 18, clarifying and recodifying attestation standards into AT-C sections for examinations such as SOC engagements.

  84. 2016 Apr 27

    General Data Protection Regulation adopted

    The European Parliament and Council adopted Regulation 2016 slash 679. Its accountability and security framework increased the need to demonstrate controlled processing of personal data, including activity in database systems.

  86. 2016 May 3

    CII Best Practices Badge launched

    The initiative introduced a badge program that lets projects document security and quality practices against public criteria.

  88. 2016 Aug 31

    FIRST standardized TLP 1.0

    FIRST released a consolidated TLP 1.0 definition and usage guide, replacing community variation with a common set of sharing designations.

  89. 2016 Nov

    NIST SP 800-160 integrates security with systems engineering

    The publication applied security concepts and principles across standards-based systems engineering processes and the system life cycle.

  90. 2017

    2017 Trust Services Criteria published

    The AICPA Assurance Services Executive Committee issued the 2017 Trust Services Criteria, renaming the former principles framing, aligning structure with COSO 2013, and strengthening cybersecurity-oriented supplemental criteria used in SOC 2.

  91. 2017

    Gartner publishes its last Enterprise DLP Magic Quadrant

    Gartner issued its final Magic Quadrant for Enterprise Data Loss Prevention and replaced it the next year with a Market Guide. The change reflected a market Gartner viewed as mature and increasingly delivered inside email, endpoint, and cloud-access platforms.

  92. 2017

    in-toto framework introduced

    in-toto, a framework for ensuring the integrity of a software product from initiation to installation by recording what steps were performed, by whom, and in what order, was introduced from academic work at NYU. It became the chain-of-steps attestation model later adopted by SLSA and Sigstore.

  93. 2017

    Sigma introduces portable log detections

    Sigma introduced a shared rule format, tools, and collections for describing log detections across analysis platforms. Detection content could be reviewed and translated without beginning in one vendor's query language.

  94. 2017 Jan

    First CSF 1.1 draft released

    The first draft update added supply-chain-risk detail, clarified terms, and introduced cybersecurity measurement discussion. It made the revision process visible for public comment.

  95. 2017 Jan

    Sigma repository begins portable log detections

    The Sigma project began publishing a generic format for describing log detections. Detection authors gained a shared representation that tooling could translate for different SIEM backends.

  96. 2017 May

    npm version 5 makes package lockfiles the default

    npm version 5 introduced package-lock.json as a standardized lockfile feature and made lockfiles the default. Repeatable resolution became normal evidence for reviewing a JavaScript dependency graph.

  97. 2017 May

    WannaCry spreads across organizations worldwide

    WannaCry remotely compromised systems, encrypted files, and affected organizations in more than 150 countries. It made patching and network exposure central ransomware-resilience concerns.

  98. 2017 May 1

    SSAE 18 effective for report dates

    SSAE 18 became effective for practitioners' reports dated on or after May 1, 2017, becoming the attestation framework for SOC 1, SOC 2, and SOC 3 examinations.

  99. 2017 Jun

    NIST SP 800-63-3 published

    NIST updated its digital identity guidelines. It clarified identity proofing, authentication, and federation as distinct concerns that IGA must coordinate with rather than replace.

  100. 2017 Jun

    NotPetya demonstrates destructive disruption at scale

    NotPetya exploited vulnerabilities, gained privileged rights, and rendered infected Windows computers unusable. The event reinforced that recovery planning must address essential systems, not only user files.

  101. 2017 Jun 22

    NIST publishes SP 800-12 Revision 1

    The revision updated the introductory handbook and connected information security principles to modern risk management and control families. It superseded the 1995 edition.

  102. 2017 Sep

    NISTIR 8062 defines privacy engineering objectives

    NISTIR 8062 introduced predictability, manageability, and disassociability together with a privacy-risk model based on problematic data actions. It gave engineers a way to translate privacy concerns into system objectives.

  103. 2017 Oct 27

    STIX and TAXII 2.0 became Committee Specifications

    OASIS published redesigned STIX 2.0 and an HTTPS-based TAXII 2.0 API as approved Committee Specifications ready for implementation and interoperability testing.

  104. 2017 Dec

    Second CSF 1.1 draft released

    NIST published a second proposed update to clarify and refine the Framework. It incorporated another round of public review before the final release.

  105. 2018

    2018 SOC 2 Description Criteria

    The AICPA issued description criteria for management's SOC 2 system description, separating description evaluation from control evaluation against the Trust Services Criteria.

  106. 2018

    NIST SP 800-37 Revision 2 broadens the RMF

    NIST updated the Risk Management Framework for information systems, organizations, security, and privacy. The update strengthened lifecycle accountability.

  107. 2018

    SP 800-37 Rev. 2 integrates security and privacy

    NIST publishes SP 800-37 Revision 2, integrating privacy controls alongside security controls in the Risk Management Framework and reinforcing the authorization-to-operate decision as risk acceptance.

  108. 2018 Jan

    NIST updates SP 800-160 design-principle guidance

    The update emphasized applying security design principles to critical infrastructure systems and corrected the first edition.

  109. 2018 Feb

    Bad Security Metrics research published

    NIST listed research on common measurement problems and solutions, reinforcing the need to distinguish activity counts from useful security measures.

  110. 2018 Feb

    ISO 31000 second edition published

    ISO published the second edition of its risk-management guidelines, presenting principles, a framework, and a process applicable across organizations and sectors.

  111. 2018 Feb

    ISO/IEC 27000:2018 updates family terms

    The overview-and-vocabulary standard was updated, clarifying the terms and concepts the 27000 family uses. It supplies the shared definitions the family depends on.

  112. 2018 Apr

    CSF 1.1 released

    Version 1.1 added self-assessment material, expanded supply-chain-risk guidance, and clarified the relationship between Profiles and Tiers. The update remained compatible with Version 1.0.

  114. 2018 Apr 16

    NIST Cybersecurity Framework 1.1 released

    NIST released version 1.1 with refinements for identity, supply-chain risk management, self-assessment, and coordinated vulnerability disclosure. It remained compatible with version 1.0.

  115. 2018 Apr 16

    NIST releases Cybersecurity Framework 1.1

    Version 1.1 added clearer treatment of self-assessment, identity, supply-chain risk, and vulnerability disclosure. Policy teams gained more explicit connections between organizational outcomes and changing dependencies.

  116. 2018 May

    GDPR becomes applicable

    The GDPR became applicable across the European Union. Privacy design decisions increasingly needed evidence across deployed systems, vendors, retention paths, and rights-request workflows.

  119. 2018 Jun 5

    WCAG 2.1 becomes a W3C Recommendation

    WCAG 2.1 added guidance addressing more mobile, low-vision, and cognitive accessibility needs. Dashboard testing expanded beyond a desktop mouse-and-screen workflow.

  120. 2018 Oct 23

    EU data-protection rules for institutions adopted

    Parliament and Council adopted the EUDPR, extending the reformed framework to EU institutions, bodies, offices, and agencies.

  121. 2018 Dec

    NIST updates the Risk Management Framework

    SP 800-37 Revision 2 integrated the RMF across the system development life cycle and added a Prepare step. The seven-step framework became the standard sequence for selecting, implementing, assessing, authorizing, and monitoring controls.

  122. 2018 Dec

    Risk Management Framework expands to organizations and privacy

    SP 800-37 Revision 2 added organization preparation, privacy integration, stronger accountability, and continuous monitoring across system and organization levels.

  123. 2019

    LockBit predecessor activity is first observed

    CISA records ABCD ransomware activity in September 2019 as the predecessor to LockBit. The operation's later affiliate model illustrated why defender observations vary across incidents.

  124. 2019

    Reproducible builds gain adoption

    Reproducible builds — building the same source into byte-identical artifacts — moved from a Debian project to a widely-adopted property that toolchains like F-Droid, Bitcoin Core, and NixOS used to make provenance verifiable. It made the digest-tie this course relies on meaningful.

  126. 2019 Feb

    Outsourcing Playbook published

    The Playbook introduced guidance on risk allocation, pilots, performance indicators, resolution plans, and delivery-model decisions. These made lifecycle controls explicit in central-government outsourcing.

  127. 2019 Mar

    Global Digital Marketplace shares multi-supplier lessons

    Government Digital Service described work to adapt digital marketplace practices internationally. The work linked procurement transparency with digital-sector development.

  128. 2019 May

    OECD countries adopt the AI Principles

    OECD countries adopted the Recommendation on Artificial Intelligence. The principles provided an intergovernmental reference point for trustworthy-AI policy and governance work.

  129. 2019 Jun

    Elastic SIEM launches with Elastic Stack 7.2

    Elastic introduced a dedicated SIEM application for host and network investigation workflows. It joined common-schema event data with a security-focused analyst interface.

  131. 2019 Sep

    NIST releases the initial SP 800-207 draft

    The draft defined logical components, deployment models, use cases, and a migration roadmap in technology-neutral language. Public review began a shared architecture vocabulary beyond individual vendor or enterprise designs.

  132. 2019 Oct

    ISO 22301:2019 is published

    ISO published edition 2 of ISO 22301 in October 2019, replacing the 2012 edition. The standard specifies requirements for a business continuity management system.

  133. 2019 Nov

    Broadcom acquires Symantec's enterprise security business

    Broadcom completed its 10.7 billion dollar purchase of Symantec's enterprise security business, including Symantec DLP. The former parent renamed itself NortonLifeLock and kept the consumer products.

  134. 2019 Nov

    Chronicle Backstory joins Google Cloud security

    Google described Backstory as its flagship hybrid security analytics offering while consolidating Chronicle into Google Cloud. The move placed large-scale security analytics inside a major cloud platform.

  135. 2019 Nov

    GitHub automated security updates become generally available

    GitHub made automated pull requests for nearest non-vulnerable dependency versions generally available for public repositories. Dependency remediation became part of routine pull-request work.

2020s

124 milestones

  1. 2020

    LockBit appears as a ransomware-as-a-service operation

    LockBit-named ransomware was first seen on cybercrime forums in January 2020. The service model separated ransomware development from affiliate intrusion activity.

  2. 2020

    NIST publishes the enterprise patching practice guide

    NIST SP 1800-31 documented an example enterprise patch-management approach using automated asset discovery, assessment, prioritization, deployment, and monitoring.

  3. 2020

    Sigstore project started

    Sigstore began work on accessible signing and transparency services for open source software artifacts.

  4. 2020

    Threat Modeling Manifesto is created

    A cross-practitioner group created the Threat Modeling Manifesto. It articulated shared values, principles, patterns, and anti-patterns for collaborative and continuous practice.

  5. 2020 Jan

    NIST Privacy Framework 1.0 released

    NIST released a voluntary privacy risk-management framework with a Core and Profiles. Teams could express current and target privacy outcomes and prioritize gaps in a form that fits enterprise risk management.

  6. 2020 Feb 19

    European Commission publishes its AI White Paper

    The White Paper set out a European approach to excellence and trust in AI. It put options for a legislative framework for trustworthy AI into the policy path that led to the AI Act.

  8. 2020 Jun

    Dependabot version updates add scheduled maintenance

    GitHub added scheduled Dependabot version updates alongside security updates. Maintaining dependency currency became distinct from responding to disclosed vulnerabilities.

  9. 2020 Jun

    NIST SP 800-137A published

    The assessment guide added a method for evaluating the effectiveness of an information security continuous-monitoring program.

  10. 2020 Jun

    Outsourcing Playbook updated

    The update added delivery model assessments and strengthened guidance on value, risk, and supplier relationships. It shifted attention from contract award toward the choice and operation of the delivery model.

  12. 2020 Jun 24

    Commission publishes first GDPR application report

    The Commission published its first report on applying the GDPR, shifting attention from preparation to implementation experience.

  13. 2020 Aug

    NIST publishes SP 800-207

    The final publication established zero trust tenets, policy engine, policy administrator, policy enforcement point, trust-algorithm inputs, threats, and deployment approaches as a reference architecture.

  14. 2020 Aug

    NIST SP 800-207 defines Zero Trust Architecture

    The guidance shifted access reasoning away from implicit network-location trust toward explicit decisions about users, devices, assets, and resources.

  15. 2020 Aug 3

    OpenSSF formed

    The Linux Foundation consolidated the Core Infrastructure Initiative, the Open Source Security Coalition, and other efforts into the OpenSSF.

  16. 2020 Sep

    Microsoft announces Endpoint DLP at Ignite

    Microsoft added native endpoint enforcement to Microsoft 365 DLP, covering USB copy, network shares, cloud uploads, printing, and clipboard on Windows 10 without a separate agent. Endpoint coverage became part of the same policy set as email and SharePoint.

  18. 2020 Sep

    NIST SP 800-53 Revision 5 published

    Revision 5 consolidated security and privacy controls and made control statements outcome-based. IGA programs could align ownership, access review, and evidence with a broader organization-level control framework.

  19. 2020 Sep

    The Sourcing Playbook published

    The UK government published commercial guidance covering delivery models, market management, evaluation, cost, risk allocation, and resolution planning. It emphasized procurement as an end-to-end commercial lifecycle.

  20. 2020 Sep 23

    NIST SP 800-53 Revision 5 published

    NIST integrated security and privacy controls into one catalog and added a supply-chain risk management control family. The revision broadened control selection beyond isolated technical safeguards.

  21. 2020 Oct

    NIST IR 8286 connects cyber risk with enterprise risk

    The publication used risk registers and shared business language to bring cybersecurity risk into enterprise risk management.

  22. 2020 Oct

    NIST IR 8286 links cyber risk to enterprise risk

    NIST publishes IR 8286, Integrating Cybersecurity and Enterprise Risk Management, introducing the cybersecurity risk register as the construct that rolls security exposure up into enterprise risk language.

  23. 2020 Nov

    NIST IR 8286 connects cyber risk registers to ERM

    NIST described how cybersecurity risk registers can communicate system and organizational risks into enterprise risk management. The guidance made risk aggregation a governance concern rather than a system-by-system activity.

  24. 2020 Dec

    SolarWinds Orion supply chain attack disclosed

    A compromised build of SolarWinds Orion, distributed through a signed update, was used to compromise roughly 18,000 customers including US government agencies. The attack made supply chain integrity a board-level concern and shifted attention from "is the source safe" to "is the build that produced the artifact safe."

  25. 2021

    Sigstore announced and Cosign released

    Sigstore, with its Cosign client, Fulcio certificate authority, and Rekor transparency log, was released to bring keyless identity-bound signing and an auditable signing log to open-source artifacts, removing the key-management barrier that had kept signing rare.

  26. 2021

    SLSA v0.1 draft released

    SLSA (Supply-chain Levels for Software Artifacts) was first published as a draft by Google and the community, naming the build levels and source expectations that became the vocabulary for describing supply chain security guarantees.

  27. 2021 Feb

    AWS publishes Disaster Recovery of Workloads on AWS

    The AWS Well-Architected whitepaper formalized cloud disaster-recovery guidance. It organized recovery design around workload disruption, recovery options, detection, and testing.

  28. 2021 Mar

    Digital, Data and Technology Playbook published

    The UK government issued technology-specific guidance for sourcing and contracting digital, data, and technology projects. It connected commercial decisions with technology delivery concerns.

  30. 2021 May

    CIS releases Controls version 8

    CIS Controls v8 reorganized its safeguards around activity rather than device ownership and trimmed the set to eighteen controls with 153 safeguards. It preserved the model of prioritization through implementation groups.

  31. 2021 May

    Colonial Pipeline disruption brings ransomware resilience into public focus

    The attack temporarily disrupted gasoline delivery across much of the southeastern United States. It showed how a cyber incident can quickly become an operational continuity event.

  32. 2021 May

    Executive Order 14028 defines the SBOM policy direction

    Executive Order 14028 defined an SBOM as a formal record of component details and supply-chain relationships. Component inventory gained a policy role beyond individual vulnerability scans.

  33. 2021 May

    Executive Order 14028 directs federal zero trust adoption

    The order required federal civilian agencies to plan for zero trust architecture. The directive made implementation an accountable government program rather than only an architectural recommendation.

  34. 2021 May

    Third annual Playbook update issued

    The Sourcing Playbook became the third annual refresh of the earlier Outsourcing Playbook. It set expectations for how contracting authorities and suppliers engage.

  35. 2021 May

    US Executive Order 14028 on supply chain security

    The order required federal agencies to adopt SBOMs and secure software development practices, making the software bill of materials a procurement requirement and pulling SSDF, SLSA, and SBOM tooling into mainstream adoption.

  36. 2021 May 12

    United States Executive Order 14028 issued

    The order directed federal action on software supply chain security and prompted standards and guidance for secure development and software evidence.

  37. 2021 Jun

    Google introduces the SLSA supply-chain integrity framework

    Google introduced SLSA as an end-to-end framework for supply-chain integrity. Dependency vulnerability matching was increasingly placed beside build and publication integrity controls.

  38. 2021 Jun

    LockBit adds built-in information theft tooling

    CISA records LockBit 2.0 and its StealBit tool in June 2021. The change reflects the defense problem covered here; restoration alone does not settle data-extortion risk.

  39. 2021 Jun 10

    STIX and TAXII 2.1 approved as OASIS Standards

    OASIS members approved STIX 2.1 and TAXII 2.1 as full standards, consolidating the JSON graph model and aligned exchange protocol used by modern CTI systems.

  40. 2021 Sep

    NIST opens the SP 800-50 revision process

    The initial preliminary draft recognized that awareness and training resources, methods, and requirements had evolved since the 1998 and 2003 publications. The revision expanded the scope toward cybersecurity and privacy learning.

  41. 2021 Oct

    Fortra acquires Digital Guardian

    HelpSystems, later renamed Fortra, acquired Digital Guardian, one of the last large independent enterprise DLP vendors. Standalone DLP suites kept being absorbed into broader data-security portfolios.

  42. 2021 Nov

    CISA establishes the KEV Catalog

    Binding Operational Directive 22-01 created a living catalog of vulnerabilities known to be exploited. It made documented exploitation a distinct prioritization input for vulnerability-management programs.

  43. 2021 Nov

    KEV catalog and BOD 22-01 tie deadlines to exploitation

    CISA launched the Known Exploited Vulnerabilities catalog of CVEs with reliable evidence of active exploitation, and Binding Operational Directive 22-01 required federal agencies to remediate listed vulnerabilities on a fixed schedule. The exploited catalog, not severity, became the deadline.

  44. 2021 Dec 10

    Log4Shell disclosed

    The remote code execution flaw in Apache Log4j created an urgent need to locate affected versions across deployed software inventories.

  45. 2022

    Journey to CSF 2.0 begins

    NIST began the CSF 2.0 development journey, opening a new cycle of concept work, drafts, reference-tool development, and stakeholder feedback.

  46. 2022

    Microsoft publishes DevOps integration guidance

    Microsoft documented threat modeling as an evolutionary DevOps practice tied to actionable mitigations and implementation tracking. The guidance explicitly extends scope to modern supply-chain and deployment concerns.

  47. 2022

    Revised implementation guidance for 2018 description criteria

    Parallel revisions updated implementation guidance for the 2018 SOC 2 description criteria used to evaluate management's system description.

  48. 2022

    Revised points of focus for the 2017 TSC

    The AICPA published revised points of focus for the 2017 Trust Services Criteria, updating interpretive guidance used when applying the criteria in SOC 2 examinations.

  49. 2022

    Sigstore reaches general availability

    Sigstore's public-good signing service reached general availability, with PyPI, npm, Kubernetes, and Docker Hub adopting keyless signing for releases. It made ephemeral identity-bound signing a default expectation for open-source releases rather than a research project.

  50. 2022 Jan

    OMB issues the Federal Zero Trust Strategy

    Memorandum M-22-09 set goals across identity, devices, networks, applications and workloads, and data. Agencies received concrete outcomes for translating the architecture into programs and controls.

  51. 2022 Feb

    AWS updates active-passive failover guidance

    The whitepaper added data-plane and control-plane material, expanded active-passive failover guidance, and replaced CloudEndure Disaster Recovery with AWS Elastic Disaster Recovery.

  52. 2022 Feb

    ISO/IEC 27002:2022 publishes 93 controls

    The 2022 edition reorganized information security controls into organizational, people, physical, and technological themes and consolidated the set from 114 to 93 controls. Organizations select from them within an ISO/IEC 27001 management system.

  53. 2022 Feb

    ISO/IEC 27002:2022 reworks the control catalog

    The 2022 edition condensed the controls into 93 items grouped in four themes — organizational, people, physical, and technological — consolidating 56 of the 2013 edition's 114 controls into 24 and adding new ones.

  54. 2022 Feb

    NIST publishes SSDF version 1.1

    NIST published SP 800-218 version 1.1 with secure development practices that include handling third-party software components. Dependency maintenance became part of a documented development lifecycle framework.

  55. 2022 Feb 3

    NIST published SSDF version 1.1

    NIST SP eight hundred dash two hundred eighteen standardized a core set of secure software development practices, including provenance tasks.

  56. 2022 Mar 31

    PCI DSS v4.0

    PCI SSC published v4.0 with changes intended for emerging threats and technologies, including a broader network-security framing and added flexibility in meeting security objectives.

  57. 2022 Mar 31

    PCI DSS version 4.0 published

    PCI Security Standards Council published version 4.0 with logging and monitoring retained as a core requirement area. The revision continued the operational focus on defining, protecting, reviewing, and responding to security events affecting account data environments.

  58. 2022 Jun

    NIST SP 800-40 Revision 4 covers enterprise patch management

    Revision 4 extended the guide to enterprise patch management across IT and operational technology and framed patching as preventive maintenance, an ongoing cost of running technology. It defines the identify, prioritize, acquire, install, and verify cycle the course uses.

  60. 2022 Aug

    ISO 31700 privacy by design standard published

    ISO 31700 established consumer-protection privacy-by-design requirements and guidance for consumer goods and services. It extended the design focus into organizational processes and product development.

  61. 2022 Aug

    Open Cybersecurity Schema Framework released

    AWS and partners released OCSF as an open specification for normalizing security telemetry across products and services. It addressed the common-schema stage that enables cross-source analytics.

  62. 2022 Aug 5

    FIRST released TLP 2.0

    FIRST updated TLP after a multiyear industry consultation, revising the designations and guidance used to control redistribution of shared security information.

  63. 2022 Sep

    DoD Zero Trust Reference Architecture version 2.0 released

    The second reference architecture organized capabilities and activities for mission systems. It expanded the operational relationships around identity, devices, applications, data, networks, analytics, and automation.

  64. 2022 Oct

    CISA Cybersecurity Performance Goals released

    CISA published prioritized baseline practices that organizations can use to track and improve cybersecurity outcomes.

  65. 2022 Oct

    ISO/IEC 27001 receives its third edition

    The third edition refreshed the requirements for establishing, implementing, maintaining, and improving an information security management system. It preserved risk-based management while updating the standard's control context.

  66. 2022 Oct

    ISO/IEC 27001 third edition published

    ISO published the third edition of ISO/IEC 27001. Organizations applying the standard continued to use a requirements-based ISMS and risk-management approach.

  67. 2022 Oct

    ISO/IEC 27005:2022 updates risk guidance

    The risk management guidance standard was updated to align with ISO 31000, giving the family's risk process a dedicated, current reference.

  68. 2022 Oct 25

    ISO/IEC 27001:2022 third edition

    The requirements edition was revised to match the 27002 control structure, with four themes replacing the older domains and new requirements including planned change (Clause 6.3) and explicit ISMS processes (Clause 4.4).

  69. 2022 Nov

    CISA publishes its SSVC decision tree

    Stakeholder-Specific Vulnerability Categorization turned exploitability and impact inputs into four decisions, Track, Track star, Attend, and Act. It gave organizations a decision framework for urgency instead of a raw score.

  70. 2022 Nov

    CSAF 2.0 becomes an OASIS Standard

    The Common Security Advisory Framework standardized machine-readable advisories with product status values and remediation categories. Advisories became data that an automated queue could consume instead of prose for a human to read.

  71. 2022 Nov

    DoD Zero Trust Strategy and Roadmap released

    The strategy connected department-wide adoption, secured systems, technology acceleration, and enabling processes to a target implementation roadmap.

  72. 2022 Nov

    NIST revises Engineering Trustworthy Secure Systems

    Revision 1 updated the engineering guidance and retained design principles as flexible tools for trustworthy secure systems across the life cycle.

  75. 2023

    SLSA v1.0 published

    SLSA v1.0 finalized the Build track with levels L0 through L3 and separated source concerns into a Source track, giving the specification a stable target that producers and consumers could certify against.

  78. 2023 Jan 26

    NIST releases AI RMF 1.0

    NIST released the voluntary AI Risk Management Framework 1.0. Its Govern, Map, Measure, and Manage functions gave organizations a repeatable structure for lifecycle risk work.

  79. 2023 Apr

    CISA publishes Zero Trust Maturity Model version 2.0

    The model defined traditional, initial, advanced, and optimal stages across five pillars and three cross-cutting capabilities. It gave operators a progression for automation, visibility, and integrated policy.

  80. 2023 Apr

    SLSA version 1.0 released

    The stable specification defined build integrity levels and provenance requirements for software artifacts.

  81. 2023 Jun

    CISA publishes a detailed LockBit defender advisory

    The advisory documented LockBit activity, affiliate variation, and mitigation recommendations. It connected ransomware response to continual testing of controls against observed attacker techniques.

  82. 2023 Jul

    SEC adopts cybersecurity disclosure rules

    The SEC adopted rules requiring covered public companies to describe cybersecurity risk management, strategy, governance, and incident disclosure. Board oversight and management roles became explicit disclosure subjects for those issuers.

  83. 2023 Aug

    CSF 2.0 public draft and implementation examples released

    NIST released the public draft of CSF 2.0 and associated implementation examples for comment. The draft invited review of changes intended to address current and future cybersecurity challenges.

  84. 2023 Sep

    CISA published its Open Source Software Security Roadmap

    CISA set goals for understanding open source dependency prevalence, reducing federal risk, and hardening the wider ecosystem.

  85. 2023 Sep

    NIST publishes SP 800-207A

    The publication adapted zero trust access control to cloud-native applications across multiple clouds. It added identity-tier and network-tier policies, service meshes, and gateways to the implementation vocabulary.

  86. 2023 Sep 30

    Current TSC download package dated on AICPA site

    AICPA & CIMA listed the consolidated 2017 Trust Services Criteria with 2022 revised points of focus as a current free download resource for practitioners and service organizations.

  87. 2023 Oct

    NIST publishes SP 800-92 Revision 1 draft

    NIST published a new planning guide focused on organization-wide improvement of cybersecurity log management. The revision reframed log management as a continuing program of generation, transmission, storage, access, and disposal.

  88. 2023 Oct

    Procurement Act 2023 received Royal Assent

    The Act established the new procurement regime that later changed the supporting guidance and operational preparation for contracting authorities and suppliers.

  89. 2023 Oct

    Procurement Act 2023 receives Royal Assent

    The Act created a new statutory procurement framework for England, Wales, and Northern Ireland. It set the direction for later implementation guidance and procedures.

  90. 2023 Oct 5

    WCAG 2.2 becomes a W3C Recommendation

    WCAG 2.2 added success criteria while retaining backward compatibility with earlier WCAG 2 versions. Report and dashboard teams gained a new current accessibility target for web delivery.

  91. 2023 Nov

    CVSS v4.0 separates what a flaw is from what is happening to it

    Version 4.0 introduced four metric groups and the CVSS-B, CVSS-BT, CVSS-BE, and CVSS-BTE nomenclature, making explicit which parts of a score are base characteristics and which add threat and environment. A bare base score no longer stands in for urgency.

  92. 2023 Nov

    NIST releases the 5.1.1 control reference tool

    NIST updated the catalog with a small set of identity-focused additions and published the interactive Control Reference Tool for browsing controls and enhancements. Machine-readable OSCAL formats continued alongside the tooling.

  93. 2023 Dec

    EU co-legislators reach political agreement on the AI Act

    The European Parliament and Council reached political agreement on the AI Act. Organizations could begin turning the emerging requirements into inventories, controls, and evidence plans before final adoption.

  94. 2024

    ISO 22301 receives Amendment 1

    ISO lists Amendment 1:2024 for ISO 22301:2019. The amendment kept the standard current while its next full edition entered development.

  96. 2024 Feb

    CSF 2.0 released

    NIST released CSF 2.0 for organizations in every sector. The update added the Govern Function and expanded the Framework's scope beyond critical infrastructure.

  97. 2024 Feb

    NIST CSF 2.0 adds Govern and broadens its audience

    The update added Govern to the core functions and presented cybersecurity outcomes for organizations of every size and sector.

  98. 2024 Feb

    NIST Cybersecurity Framework 2.0 adds Govern

    CSF 2.0 expanded its audience to all organizations and made governance a separate Function spanning strategy, roles, policy, oversight, and supply-chain risk.

  99. 2024 Feb

    NIST Cybersecurity Framework 2.0 released

    CSF 2.0 broadened the framework's governance emphasis and refreshed the outcome structure used to relate measures to cybersecurity objectives.

  101. 2024 Feb 23

    Climate action changes added by amendment

    ISO/IEC 27001:2022/Amd 1:2024 introduced climate action changes to the standard, adding the consideration of climate-related risk to the ISMS context and risk process.

  102. 2024 Feb 26

    NIST Cybersecurity Framework 2.0 adds Govern

    NIST publishes CSF 2.0, adding the Govern function and elevating risk governance and strategy to the same structural level as the operational functions, with risk assessment outcomes carried in Govern and Identify.

  103. 2024 Feb 26

    NIST Cybersecurity Framework 2.0 released

    NIST released CSF 2.0 for organizations of any sector or size and added the Govern function. The framework now organizes cybersecurity risk outcomes around six concurrent functions.

  104. 2024 Feb 26

    NIST releases Cybersecurity Framework 2.0

    CSF 2.0 expanded its intended audience to all organizations and added Govern as a distinct function. Policy, roles, oversight, and enterprise risk alignment became more visible across the framework.

  105. 2024 Mar

    ISO/IEC 27006-1:2024 replaces the certifier requirements

    The requirements for bodies that audit and certify ISMSs were reissued as 27006-1:2024, aligning certification-body competence with the current 27001 edition.

  106. 2024 Mar

    The XZ Utils backdoor is reported

    A report to the oss-security mailing list described a backdoor in upstream xz releases that could affect SSH server compromise. The incident showed why known-vulnerability matching alone cannot cover malicious changes in a dependency supply path.

  107. 2024 Mar

    XZ Utils backdoor discovered

    A malicious backdoor was found in XZ Utils, planted over months by a maintainer operating under a pseudonym, targeting sshd on Linux. It demonstrated that dependency trust is a social as well as a technical problem, and that provenance and identity matter even for small, widely-used libraries.

  108. 2024 Mar 13

    European Parliament adopts the AI Act

    Parliament adopted the Artificial Intelligence Act. The legislative text established the risk-based framework and obligations that governance programs would need to operationalize.

  109. 2024 Mar 29

    xz Utils compromise disclosed

    Investigators found malicious code in release tarballs of xz versions five point six point zero and five point six point one, demonstrating a targeted compromise of an upstream release path.

  110. 2024 May

    CIS Controls version 8.1 adds governance recommendations

    CIS released Controls v8.1 with governance recommendations for policies, procedures, processes, and compliance evidence. The update connected prioritized safeguards more directly to governance practice.

  112. 2024 Jun 11

    PCI DSS v4.0.1

    PCI SSC published v4.0.1 as a limited revision that clarified and corrected v4.0 without adding or deleting requirements. Practitioners moved to the maintained version while preserving the underlying control set.

  115. 2024 Sep

    NIST SP 800-50 Revision 1 replaces earlier guidance

    SP 800-50 Revision 1 superseded SP 800-16 and the original SP 800-50. It defines a life-cycle approach for cybersecurity and privacy learning programs that encourage behavior change and security culture.

  116. 2024 Dec

    NIST SP 800-55 Volumes 1 and 2 released

    NIST replaced the earlier guide with separate volumes for selecting measures and developing a measurement program.

  118. 2025

    Attestation verification at admission goes mainstream

    Kubernetes admission controllers and package registries began verifying Sigstore signatures and SLSA provenance by default for published artifacts, moving verification from a producer-side concern to a consumer-side gate that refuses unverified releases.

  119. 2025 Feb

    Procurement Act 2023 came into force

    The new regime took effect on 24 February 2025. Official learning materials included operational procurement staff and professionals who manage suppliers or contracts.

  120. 2025 Feb

    Procurement Act 2023 comes into force

    The new regime took effect on 24 February 2025. Buyers and suppliers began using the framework in live procurement activity.

  121. 2025 Feb 2

    Prohibited-practices and AI-literacy obligations begin to apply

    The first AI Act application date brought prohibited AI practices and AI-literacy obligations into application. Governance teams needed an inventory capable of identifying affected uses.

  122. 2025 Apr

    NIST publishes SP 800-61 Revision 3

    Revision 3 superseded Revision 2 and expressed incident response as a CSF 2.0 community profile. Practice moved from a standalone lifecycle guide toward recommendations integrated across cybersecurity risk management.

  123. 2025 Aug 2

    GPAI-model obligations begin to apply

    Governance rules and obligations for general-purpose AI models became applicable. Organizations using or providing these models needed evidence appropriate to their role in the value chain.

  124. 2026

    SLSA v1.2 refines the tracks

    SLSA v1.2 reintroduced a Source track alongside the Build track and refined attestation formats, giving teams a vocabulary that covers both where source lives and how it is built.