Cybersecurity Challenges in 2025

The Changing Cybersecurity Landscape in 2025

Navigating compliance with the new PCI DSS, CMMC, and HIPAA Security Rule

Looming compliance deadlines, relentless cyberthreats, and a shifting regulatory landscape have combined to make 2025 a challenging year for cybersecurity.

While the effects of an evolving regulatory climate are yet to be determined, here’s what we know about impending security updates from the payment card industry (PCI DSS 4.0.1), the Department of Defense (CMMC 2.0), and the HHS Office for Civil Rights (HIPAA Security Rule).

• CMMC 2.0 and the new HIPAA Security Rule represent updates to previous versions of these federal security regulations; PCI DSS 4.0.1 is an update to the industry’s previous security standard.
• All three of these security updates have key implementation milestones in 2025.
• PCI DSS 4.0.1 addresses formatting and typographical errors discovered in v4.0 and provides additional implementation guidance for users, with minimal changes to the existing security requirements of v4.0.
• CMMC 2.0 significantly streamlines security requirements to three levels of cybersecurity, aligns the requirements at each level with well-known NIST cybersecurity standards, and relieves the smallest contractors of unnecessary compliance burdens.
• The new HIPAA Security Rule aims to further strengthen cybersecurity safeguards for electronic protected health information, or ePHI, in the most substantial healthcare security update in more than a decade.

Critical Targets to Meet in 2025

Several deadlines in 2025 govern the implementation of the updated security measures outlined above. Affected organizations should be proceeding toward these critical target dates with a sense of urgency and unwavering purpose, as there is no current indication that these compliance targets will be delayed or suspended.

• Payment Card Industry Members: Compliance with the newest Payment Card Industry Data Security Standard (PCI DSS 4.0.1) is required within several weeks, by March 31, 2025.
• Defense Contractors and Subs: Security requirements of the newest Cybersecurity Maturity Model Certification (CMMC 2.0) will be incorporated into Department of Defense contracts beginning as soon as the first quarter of 2025.
• Healthcare Industry Members: The new HIPAA Security Rule is on track to become law by mid-year 2025, meaning that compliance with the new security requirements will be due by the end of 2025 for regulated entities, including healthcare providers, business associates, health plans, and clearinghouses.

What You Should Be Doing Now

Implementing PCI DSS 4.0.1

To comply with PCI DSS 4.0.1 by March 31, 2025, members of the payment card industry must implement the security requirements by this date and demonstrate compliance with those requirements in their next annual risk assessments. Three actions are essential, beginning with assessing your security risks, remediating identified vulnerabilities, and reporting your assessment findings to your merchant bank.

• Assessing Security Risks. This action includes identifying the locations of all payment account data within your organization and taking inventory of all information technology assets and business processes associated with payment processing. You must analyze those processes and assets for vulnerabilities that could expose payment account data to hacking and other unauthorized access, and then implement or update all necessary controls. Complete a formal risk assessment, which is required annually.

• Remediating Vulnerabilities. This step requires identifying and addressing gaps in your security controls, resolving all vulnerabilities identified during the above assessment activity, implementing secure business processes, and securely removing any payment data being stored unnecessarily or beyond its use. With 64 new security requirements in the new standard, most organizations will discover additional vulnerabilities compared to previous assessments.
• Reporting Assessment Findings. In this step you must document your assessment and remediation details. Level 1 and 2 merchants must engage a Qualified Security Assessor (QSA) to conduct their annual assessments and produce the requisite Reports on Compliance (ROC). Level 3 merchants are generally eligible to conduct self-assessments using a formal Self-Assessment Questionnaire (SAQ). Finally, Attestations of Compliance (AOC) are required to testify to the results of all assessments.

Implementing CMMC 2.0

This update to CMMC 1.0 took effect on December 24, 2024 after publication in the Federal Register. That, and incorporation into the Code of Federal Regulations (32 CFR 170), enables CMMC 2.0 security requirements to begin appearing in DoD contracts as early as the first quarter of 2025. A three-year phased approach allows implementation from now through 2027, with a final security compliance deadline of 2028.

Three actions are essential to compliance, including determining your compliance level under v2.0, identifying and resolving existing security gaps, and scheduling your official compliance assessment with a certified third party assessor. The honor system permitted in v1.0 is being replaced with objective, expert oversight and reporting.

• Determining Your Compliance Level. This decision will identify which level of assessment and certification you require based on the type of information you handle. Level 1 (Foundational) handles Federal Contract Information (FCI), Level 2 (Advanced) handles Controlled Unclassified Information (CUI), and Level 3 (Expert) handles CUI for high-priority DoD projects.
• Identifying and Remediating Security Gaps. You’ll need to conduct a preparatory assessment to identify current gaps in your security program that would prevent compliance with CMMC 2.0 requirements at your level. Then, prepare and execute a remediation plan to address gaps, which may include conducting vulnerability assessments and penetration testing, developing compliant policies and procedures, and similar activities.
• Officially Assessing Compliance. You are now prepared to undergo an official assessment for CMMC 2.0 certification. Level 2 contractors must hire a Certified Third-Party Assessment Organization (C3PAO), while Level 3 will work with the Defense Industrial Base Cybersecurity Assessment Center. Having solidly prepared for this step, your certification process should be successful. Once certified, your organization will be able to continue bidding on and performing contract work for the DoD.

Implementing the New HIPAA Security Rule 

The Security Rule specifies national data protection standards for healthcare providers, health plans, healthcare clearinghouses, and business associates—known collectively as “regulated entities.” Compliance with the Security Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is mandatory. However, the HHS Office for Civil Rights (OCR), which enforces HIPAA, continues to find the same compliance failures with every audit and investigation. These failures have led to escalating cyberattacks, ransomware crimes, and data breaches—leading the OCR to propose extensive updates to HIPAA security requirements.

Following are just a few examples of more than a dozen new requirements specified for regulated entities.

• Complete Written Documentation. Develop written documentation of all Security Rule policies, procedures, plans, and analyses.

• Annual Compliance Audits. Conduct a security assessment at least once every 12 months to ensure compliance with the Security Rule requirements. Your written assessment must contain a review of your technology asset inventory and network map, identification of all potential vulnerabilities, and an assessment of the risk level for each vulnerability. Business associates and their subcontractors are also required to conduct annual assessments.

• Mandatory Data Protections. Encrypt ePHI at rest and in transit as an additional data protection, and employ multi-factor authentication to ensure only authorized users are able to access ePHI. Segment networks that connect with ePHI information systems and apply appropriate technical controls, such as multiple firewalls, to isolate and protect high-value assets and data.
• Robust Incident Response. Strengthen security incident responses through required actions including: (1) establishing written procedures to restore electronic information systems and data within 72 hours, (2) analyzing the criticality of the systems and data to prioritize for restoration, and (3) establishing and testing written security incident response plans and procedures governing how employees are to report suspected or known security incidents and how the organization will respond to those incidents.

• Rapid Data Breach Notifications. For business associates, their subcontractors, and group health plans, security incidents and data breaches that trigger activation of the required incident response plans must be reported no later than 24 hours after response activation.

It's Not Too Late to Ask for Help