--- title: Data Security Compliance Requirements | Lattix description: Compliance means proving data controls meet what a regulator, contract, or standard requires. Covers CMMC 2.0, FedRAMP, HIPAA Security Rule, and audit evidence. source: "https://lattix.io/blog/topics/compliance/" content-type: text/markdown --- # Data Security Compliance Requirements | Lattix [Blog](https://lattix.io/blog/) [Topics](https://lattix.io/blog/topics/) Data Security Compliance Topic # Data Security Compliance Reference hub on proving data controls satisfy regulatory, contractual, and standards requirements, and on the evidence auditors accept. 38posts Compliance in data security means proving that the technical controls over sensitive data satisfy the requirements a regulator, contract, or standard sets. Requirements name outcomes: restrict access to authorized parties, encrypt data in transit and at rest, retain evidence of who reached what. Frameworks differ in scope and vocabulary, and the underlying data controls overlap heavily. The hard part is the distance between a documented policy and an enforced one. Most programs assemble evidence from configuration exports, screenshots, and attestations, all of which describe intent at a single point in time. Auditors increasingly ask what stops the prohibited action, not what the policy says about it. The posts under this hub work through specific regimes: CMMC 2.0 and controlled unclassified information, the FedRAMP High baseline, the HIPAA Security Rule, PCI DSS 4.0.1 and cryptographic agility, DORA, the EU AI Act, and DOJ 28 CFR Part 202. Lattix Technologies writes them from the data layer, where a control either holds or does not. ## Frequently asked questions ### Is encryption at rest enough to satisfy data protection requirements? Encryption at rest protects data sitting on stored media. It does nothing once an authorized process decrypts the file and hands it to a user, an application, or a model. Frameworks that require access restriction, least privilege, and audit evidence ask for controls that persist through use, which means policy bound to the object rather than to the storage layer. ### What evidence do auditors accept for data access controls? Auditors look for records that tie an access decision to the policy in force at the time. Configuration exports and screenshots show a system state, not a decision. Logs from a policy decision point (PDP) carry more weight, because they record the requesting attributes, the policy version, and the outcome. Merkle-tree lineage makes later tampering with those records detectable. ### How does data classification support compliance? Classification assigns each data object the labels that policy references: sensitivity level, jurisdiction, handling caveat, retention class. Without those labels, access rules degrade into group membership, and every requirement that names a data category becomes unenforceable in practice. Classification quality therefore sets the ceiling on how precise attribute-based access control (ABAC) rules can ever be. ### Can one set of controls satisfy multiple compliance frameworks? At the data layer, largely yes. CMMC 2.0, the FedRAMP High baseline, the HIPAA Security Rule, and PCI DSS 4.0.1 use different language for the same handful of outcomes: restrict access by attribute, encrypt with validated modules, log decisions, and revoke reliably. Enforcing those once at the object avoids maintaining four parallel control sets. ## Reading on data security compliance [![Lattix branded cover for 30+ Days to FIPS 140-2 Sunset: The CMVP Validation Backlog Compounds the Calendar. Dark grid background, surgical yellow accent, IBM Plex Mono typography. Reference box reads CMVP MODULES IN PROCESS with the date 21 SEP 2026 and the figure 31 DAYS.](https://lattix.io/images/blog/fips-140-2-sunset-30-days-cmvp-backlog-cover.svg) 30+ Days to FIPS 140-2 Sunset: The CMVP Validation Backlog Compounds the Calendar August 21, 2026 Thirty-one days remain before FIPS 140-2 certificates move to historical status. The CMVP queue has already decided which modules make it. This post covers the queue math and what a program does with the modules that will not clear. Read More →](https://lattix.io/blog/fips-140-2-sunset-30-days-cmvp-backlog/) [![Lattix branded cover for the NIST round three additional post-quantum signature schemes analysis. /28 section number, IBM Plex Mono on dark grid background, the May 14 2026 round-three date, nine advancing schemes with HAWK struck out after its July 29 2026 withdrawal, and a lineage strip showing signature agility at the policy enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/nist-round-3-additional-pqc-signatures-lineage-agility-cover.svg) NIST's Round-Three Signature Field Lost HAWK. Lineage Needs the Agility. August 21, 2026 NIST advanced nine signature candidates to round three on May 14, 2026. One, HAWK, was withdrawn on July 29 after a key-recovery attack. The signature track is the data provenance problem, and agility is now demonstrated rather than theoretical. Read More →](https://lattix.io/blog/nist-round-3-additional-pqc-signatures-lineage-agility/) [![Lattix branded cover for Zero Trust Data Security in 2026: The Standards Map. /45 section number, dark grid background with surgical yellow accent rules, IBM Plex Mono typography, a reference box grouping the standards by the question each one settles, and a strip naming architecture, implementation, measurement, sequencing, cryptographic floor and AI systems.](https://lattix.io/images/blog/zero-trust-data-security-2026-standards-map-cover.svg) Zero Trust Data Security in 2026: The Standards Map August 21, 2026 Nine documents govern zero trust data security in 2026, and each settles a different question. This is the map of which standard answers what, and the one question none of them answers for you. Read More →](https://lattix.io/blog/zero-trust-data-security-2026-standards-map/) [![Lattix branded cover for Posture Is Not Enforcement: What DSPM Can and Cannot Do. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box separating an inventory and exposure map from a request-time allow or deny decision.](https://lattix.io/images/blog/dspm-posture-is-not-enforcement-cover.svg) Posture Is Not Enforcement: What DSPM Can and Cannot Do August 17, 2026 DSPM discovers data stores, classifies contents, maps permissions and prioritizes exposure findings. It is not in the request path, so it does not decide access. DSPM and an enforcement layer are complements: one supplies attributes, the other acts on them. Read More →](https://lattix.io/blog/dspm-posture-is-not-enforcement/) [![Lattix branded cover for What Is Data Sovereignty: Enforcement, Not Geography. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a jurisdiction constraint bound to a data object rather than to a data center outline.](https://lattix.io/images/blog/what-is-data-sovereignty-cover.svg) What Is Data Sovereignty: Enforcement, Not Geography August 16, 2026 Data sovereignty is the question of whose law governs a data object and who can compel its disclosure. Storage location is a proxy for that answer, and SaaS control planes, vendor support access and AI inference have made the proxy unreliable. Read More →](https://lattix.io/blog/what-is-data-sovereignty/) [![Lattix branded cover for Cross-Border Data Sharing Under Conflicting Legal Regimes. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing one data object carrying two jurisdiction constraints into a single decision point.](https://lattix.io/images/blog/cross-border-data-sharing-conflicting-regimes-cover.svg) Cross-Border Data Sharing Under Conflicting Legal Regimes August 15, 2026 When two jurisdictions attach incompatible requirements to the same record, no storage location satisfies both. A policy bound to the object and evaluated at every request can carry both constraints at once, and it does not dissolve the underlying legal conflict. Read More →](https://lattix.io/blog/cross-border-data-sharing-conflicting-regimes/) [![Lattix branded cover for Policy-Based Data Residency: Turning a Requirement Into a Control. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a geography attribute entering a decision point and a key release being withheld.](https://lattix.io/images/blog/policy-based-data-residency-cover.svg) Policy-Based Data Residency: Turning a Requirement Into a Control August 15, 2026 Policy-based data residency enforces a geographic restriction as an evaluated attribute at the access decision point rather than as a deployment choice. The control is only as strong as the location claim it evaluates. Read More →](https://lattix.io/blog/policy-based-data-residency/) [![Lattix branded cover for Data Provenance vs Lineage vs Chain of Custody. /12 section number, three overlapping evidence circles with cryptographic seals, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-provenance-lineage-chain-of-custody-cover.svg) Data Provenance vs Lineage vs Chain of Custody: What Runtime Security Actually Needs August 14, 2026 Provenance tells you where data came from. Lineage shows how it transformed. Chain of custody proves who held it. Each answers a different security question, and conflating them weakens your evidence model. Read More →](https://lattix.io/blog/data-provenance-lineage-chain-of-custody/) [![Lattix branded cover for Protecting CUI After It Leaves Your Network. Dark grid background, surgical yellow accent, IBM Plex Mono typography, with a reference box showing a CUI-marked object leaving a prime contractor boundary and still requiring a policy decision to open.](https://lattix.io/images/blog/protecting-cui-after-it-leaves-your-network-cover.svg) Protecting CUI After It Leaves Your Network August 13, 2026 Controlled Unclassified Information stays protected outside the boundary only when the access control is bound to the object rather than to the network. DFARS obligations, NIST SP 800-171 and SPRS submission remain in force through the CMMC reform review. Read More →](https://lattix.io/blog/protecting-cui-after-it-leaves-your-network/) [![Lattix branded cover for the sovereign data architecture mid-year analysis, /45 section number on a dark grid in IBM Plex Mono with surgical yellow accent lines, headline stating sovereignty is a property of the object, and a stat panel citing the DOJ Data Security Program enforcement dates.](https://lattix.io/images/blog/sovereign-data-architecture-federal-mission-mid-year-cover.svg) Sovereign Data Architecture at Mid-2026: Policy Bound to the Object July 6, 2026 A mid-2026 stocktake of data sovereignty: DOJ 28 CFR Part 202 enforcement, the EU's sovereign cloud framework, and coalition data sharing all point to the same conclusion. Region-pinning fails at the data layer. Only policy bound to the object travels with the data. Read More →](https://lattix.io/blog/sovereign-data-architecture-federal-mission-mid-year/) [![Lattix branded cover for the Executive Order 14409 post-quantum analysis. /42 section number, IBM Plex Mono on a dark grid background, the order named and dated June 22 2026, the December 31 2030 key-establishment deadline, and a crypto-inventory strip with the object-level enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/eo-14409-post-quantum-mandate-cryptographic-bill-of-materials-cover.svg) EO 14409 Sets Federal Post-Quantum Deadlines. The Cryptographic Bill of Materials Is the Test. July 3, 2026 Executive Order 14409 sets December 2030 and 2031 deadlines for federal post-quantum migration and orders a cryptographic bill of materials. The binding requirement is naming which algorithm protects which data object, not swapping a transport cipher. Read More →](https://lattix.io/blog/eo-14409-post-quantum-mandate-cryptographic-bill-of-materials/) [![Lattix branded cover for the Oracle PeopleSoft CVE-2026-35273 analysis. /41 section number, IBM Plex Mono on a dark grid background, the unauthenticated Environment Management flaw named, a CVSS 9.8 statistic, a 68 percent higher-education victim share, and an exploit-to-data strip with the object-level enforcement point highlighted in surgical yellow.](https://lattix.io/images/blog/oracle-peoplesoft-cve-2026-35273-unauth-rce-data-layer-cover.svg) Oracle PeopleSoft CVE-2026-35273: Unauthenticated Access Reaches Data the Identity Layer Never Sees July 2, 2026 ShinyHunters exploited an unauthenticated PeopleSoft flaw as a zero-day for two weeks before Oracle's advisory. Universities took 68 percent of the hits. No credential was stolen and none was needed. The data carried no policy of its own. Read More →](https://lattix.io/blog/oracle-peoplesoft-cve-2026-35273-unauth-rce-data-layer/) [![Lattix branded cover for Federal Cloud Migration ATO Acceleration Lives at the Data Layer. /31 section number, ATO control family pace comparison, IBM Plex Mono on dark grid background, yellow accent on the data-control families that consistently bottleneck ATO timelines.](https://lattix.io/images/blog/federal-cloud-migration-ato-acceleration-data-layer-cover.svg) Federal Cloud Migration ATO Acceleration Lives at the Data Layer June 26, 2026 ATO timelines for federal cloud workloads consistently exceed the planned program schedule. Boundary, identity, and configuration controls converge quickly. Data controls do not. The architecture that produces ATO evidence by construction is the architecture that compresses the cycle. Read More →](https://lattix.io/blog/federal-cloud-migration-ato-acceleration-data-layer/) [![Lattix branded cover for Defense Industrial Base Audit Failure Patterns. /31 section number, 110 NIST 800-171 practices statistic, three recurring NOT MET findings highlighted, IBM Plex Mono on dark grid background, surgical yellow accent on the architectural pattern in a practice family strip.](https://lattix.io/images/blog/dib-cyber-compliance-audit-failure-patterns-data-controls-cover.svg) Defense Industrial Base Audit Failure Patterns Point to the Same Data Controls June 25, 2026 CMMC Phase 1 assessment data, DCMA audit findings, and GAO supply chain reports converge on the same NOT MET controls. SC.L2-3.13.11 on cryptographic protection. MP.L2-3.8.9 on backup encryption. AC.L2-3.1.20 on external information system flows. The pattern is architectural. Read More →](https://lattix.io/blog/dib-cyber-compliance-audit-failure-patterns-data-controls/) [![Lattix branded cover for DORA Pushes Operational Resilience Past the Contract. /28 section number, January 17 2025 effective date, five DORA pillar statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the technical evidence pillar in a regulatory pillar strip.](https://lattix.io/images/blog/dora-third-country-ict-provider-data-control-evidence-cover.svg) DORA Pushes Operational Resilience Past the Contract. ICT Provider Evidence Is Technical. June 16, 2026 EU DORA effective January 17 2025 reaches ICT third-party providers including non-EU vendors serving EU financial entities. Tier 1 supervisory examinations are ramping in 2026. Contract clauses do not satisfy DORA's evidence expectations. Technical evidence for data-level control does. Read More →](https://lattix.io/blog/dora-third-country-ict-provider-data-control-evidence/) [![Lattix branded cover for NIST AI 600-1 GenAI Profile Maps Cleanly to Data-Centric Controls. /28 section number, GAI risk-to-control mapping table, IBM Plex Mono on dark grid background, yellow accent on the data-pillar controls that satisfy multiple GAI risk categories from one primitive.](https://lattix.io/images/blog/nist-ai-600-1-genai-profile-data-centric-controls-cover.svg) NIST AI 600-1 GenAI Profile Maps Cleanly to Data-Centric Controls June 12, 2026 NIST AI 600-1 names the unique risks of foundation models. The mitigations the profile recommends, training data provenance, output attribution, access governance over model artifacts, are evidence categories that process attestation cannot supply. Data-centric architecture supplies them by construction. Read More →](https://lattix.io/blog/nist-ai-600-1-genai-profile-data-centric-controls/) [![Lattix branded cover for PCI DSS 4.0.1 Requires Cryptographic Agility. /27 section number, March 2025 binding date, twelve future-dated requirements statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the PCI requirement in a control flow strip.](https://lattix.io/images/blog/pci-dss-4-0-1-cryptographic-agility-cardholder-data-cover.svg) PCI DSS 4.0.1 Requires Cryptographic Agility. Cardholder Data Architectures Have to Move. June 11, 2026 PCI DSS 4.0.1 effective April 2024 introduced future-dated cryptographic requirements that bite in 2025 and 2026. Cardholder Data Environments tightly coupling crypto to application code cannot migrate inside the PCI assessment window. Data-centric encryption is the architectural path. Read More →](https://lattix.io/blog/pci-dss-4-0-1-cryptographic-agility-cardholder-data/) [![Lattix branded cover for NIST IR 8547 Sets the PQC Migration Floor. /26 section number, 2027 binding window date, federal civilian migration cohort statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the migration milestone in a timeline strip.](https://lattix.io/images/blog/nist-ir-8547-pqc-migration-mid-2026-status-cover.svg) NIST IR 8547 Sets the PQC Migration Floor. The Calendar Bites in 2027. June 9, 2026 NIST IR 8547 establishes the federal post-quantum migration timeline. Mid-2026 progress data shows the schedule is tighter than most program offices have modeled. FIPS 140-3 module validation backlog compounds the risk. Cryptographic agility patterns are the schedule mitigation. Read More →](https://lattix.io/blog/nist-ir-8547-pqc-migration-mid-2026-status/) [![Lattix branded cover for CMMC Level 2 Compliance Through Data-Centric Security. /11 section number, 110 practices and 14 domains metadata, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/cmmc-level-2-compliance-data-centric-security-cover.svg) CMMC Level 2 Compliance Through Data-Centric Security June 4, 2026 CMMC Level 2 requires 110 practices across 14 domains. Data-centric security maps to 76 of them through a single architectural primitive bound to the CUI object. Read More →](https://lattix.io/blog/cmmc-level-2-compliance-data-centric-security/) [![Lattix branded cover for Data Classification: The Foundation You Can't Skip. /09 section number, classification taxonomy metadata, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-classification-foundation-zero-trust-cover.svg) Data Classification: The Foundation You Can't Skip May 21, 2026 You cannot enforce a policy you have not defined, and you cannot define a policy on data you have not classified. Classification is where zero trust actually begins. Read More →](https://lattix.io/blog/data-classification-foundation-zero-trust/) [![Lattix branded cover for CMMC Phase 2 Starts November 10. /16 section number, 110 practice count and November 10 2026 deadline metadata, IBM Plex Mono on dark grid background, surgical yellow accent on the Level 2 step in a four-phase rollout strip.](https://lattix.io/images/blog/cmmc-phase-2-november-2026-c3pao-level-2-cover.svg) CMMC Phase 2 Is Suspended. The Level 2 Data Requirements Still Bind. May 15, 2026 CMMC Phase 2 was suspended in July 2026 and there is no November 10 enforcement date. The third-party C3PAO gate is paused, but DFARS 252.204-7012 and 7020 still bind, Phase 1 self-assessment with SPRS submission still applies, and the 110 NIST SP 800-171 Rev 2 practices still govern what Level 2 requires. Read More →](https://lattix.io/blog/cmmc-phase-2-november-2026-c3pao-level-2/) [![Lattix branded cover for CNSA 2.0 and the January 2027 Deadline for National Security Systems. /18 section number, twenty months remaining statistic, ML-KEM-1024 / ML-DSA-87 algorithm metadata, IBM Plex Mono on dark grid background, surgical yellow accent on the January 2027 milestone in a transition timeline strip.](https://lattix.io/images/blog/cnsa-2-january-2027-national-security-systems-cover.svg) CNSA 2.0 and the January 2027 Deadline for National Security Systems May 15, 2026 CNSA 2.0 binds new National Security System acquisitions to ML-KEM-1024 and ML-DSA-87 effective January 1, 2027. Twenty months remain on the clock. The target is not the hard part. The transition pattern is. Read More →](https://lattix.io/blog/cnsa-2-january-2027-national-security-systems/) [![Lattix branded cover for DOJ 28 CFR Part 202 Enforcement Starts October 6. /19 section number, October 6 2026 enforcement deadline metadata, six countries of concern statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the enforcement milestone in a rule timeline strip.](https://lattix.io/images/blog/doj-28-cfr-202-bulk-sensitive-data-rule-cover.svg) DOJ 28 CFR Part 202 Enforcement Starts October 6. Data-Centric Controls Carry the Evidence. May 15, 2026 The DOJ Bulk Sensitive Data rule under 28 CFR Part 202 took effect April 8, 2025. Active enforcement actions begin October 6, 2026. Most compliance frameworks treat the rule as a contract control. The evidence the rule actually requires is technical. Read More →](https://lattix.io/blog/doj-28-cfr-202-bulk-sensitive-data-rule/) [![Lattix branded cover for The EU AI Act High-Risk Deadline Slipped to December 2027. /20 section number, December 2027 deadline metadata, Articles 9 through 17 plus 26 statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the data governance node in an Articles map strip.](https://lattix.io/images/blog/eu-ai-act-high-risk-data-governance-conformity-evidence-cover.svg) The EU AI Act High-Risk Deadline Slipped to December 2027. The Architecture Window Did Not. May 15, 2026 The May 7, 2026 political agreement pushed the EU AI Act Article 6 deadline from August 2026 to December 2027. The substantive obligations under Articles 10, 12, and 14 did not change. The architecture that produces conformity evidence takes twelve to eighteen months to build. Read More →](https://lattix.io/blog/eu-ai-act-high-risk-data-governance-conformity-evidence/) [![Lattix branded cover for The HIPAA Security Rule NPRM Demands Cryptographic Safeguards the Current Rule Only Implies. /21 section number, December 2024 NPRM date and 4,700 comments statistic, IBM Plex Mono on dark grid background, surgical yellow accent on the encryption requirement node in a safeguard map strip.](https://lattix.io/images/blog/hipaa-security-rule-nprm-cryptographic-safeguards-cover.svg) The HIPAA Security Rule NPRM Demands Cryptographic Safeguards the Current Rule Only Implies May 15, 2026 HHS issued the first major HIPAA Security Rule update since 2003 in December 2024. OCR targets May 2026 for the final rule, with 4,700 comments under review. The NPRM raises the bar on encryption, MFA, inventory, and audit. The architecture window is shorter. Read More →](https://lattix.io/blog/hipaa-security-rule-nprm-cryptographic-safeguards/) [![Lattix branded cover for The SEC's Four-Day Clock Starts on Materiality, Not Discovery. /17 section number, four business days statistic and Item 1.05 metadata, IBM Plex Mono on dark grid background, surgical yellow accent on the materiality determination node in a decision flow strip.](https://lattix.io/images/blog/sec-cyber-disclosure-four-day-materiality-rule-cover.svg) The SEC's Four-Day Clock Starts on Materiality, Not Discovery May 15, 2026 Form 8-K Item 1.05 starts the four-business-day clock on the materiality determination, not on incident discovery. The clock is shorter than most response playbooks assume. The architecture that shortens the materiality analysis is data-centric. Read More →](https://lattix.io/blog/sec-cyber-disclosure-four-day-materiality-rule/) [![Lattix branded cover for CISA's PQC product categories and federal acquisition. /11 section number, January 23 2026 publication date, two-tier procurement category map, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/cisa-pqc-product-categories-federal-acquisition-cover.svg) CISA's PQC Product Categories Move Quantum-Safe From Roadmap to Procurement May 12, 2026 CISA's January 23, 2026 product categories list, issued under Executive Order 14306, defines where federal buyers should acquire only PQC-capable products. The list is advisory. The procurement language built on it will not be. Read More →](https://lattix.io/blog/cisa-pqc-product-categories-federal-acquisition/) [![Lattix branded cover for M&A data rooms and policy-bound due diligence. /08 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-rooms-mergers-acquisitions-due-diligence-cover.svg) M&A Data Rooms After Deal Close: Policy-Bound Due Diligence May 8, 2026 Virtual data rooms protect documents while deals are live. The hard question: what happens after the deal closes or collapses? Policy-bound data with cryptographic enforcement ensures revocation is real. Read More →](https://lattix.io/blog/data-rooms-mergers-acquisitions-due-diligence/) [![Lattix branded cover for data sovereignty and multi-cloud compliance. /09 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/data-sovereignty-multi-cloud-cover.svg) Data Sovereignty Beyond Storage: Policy-Bound Access in Multi-Cloud May 8, 2026 Regulatory mandates from GDPR to China PIPL require demonstrable access control at the data layer, not region-pinning. Policy-bound data with attribute-based access control collapses jurisdictional rules into a single enforcement primitive. Read More →](https://lattix.io/blog/data-sovereignty-multi-cloud/) [![Lattix branded cover for federated learning. /10 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/federated-learning-training-without-surrendering-data-cover.svg) Federated Learning: Training AI Without Surrendering Data May 8, 2026 Federated learning trains models by sharing gradients, not data. Combined with data-centric zero trust, it makes privacy-preserving AI a realistic architectural choice, not an academic one. Read More →](https://lattix.io/blog/federated-learning-training-without-surrendering-data/) [![Lattix branded cover for FedRAMP High cloud-native government workloads. /11 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/fedramp-high-cloud-native-government-workloads-cover.svg) FedRAMP High Baseline: 421 Controls and the Data-Centric Path May 8, 2026 FedRAMP High imposes 421 controls on cloud service providers seeking federal authorization. Data-centric zero trust collapses several of the hardest controls into cryptographic enforcement at the policy enforcement point. Read More →](https://lattix.io/blog/fedramp-high-cloud-native-government-workloads/) [![Lattix branded cover for HIPAA enforcement beyond BAAs. /12 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/healthcare-hipaa-beyond-business-associate-agreements-cover.svg) HIPAA Security Rule Enforcement Starts With Data, Not Paper May 8, 2026 Business Associate Agreements transfer liability, not enforcement. HIPAA's Security Rule is explicit about what must be protected and how. Real compliance means cryptographic policy at the PHI object. Read More →](https://lattix.io/blog/healthcare-hipaa-beyond-business-associate-agreements/) [![Lattix branded cover for the Canvas breach analysis. /05 section number, IBM Plex Mono on dark grid background, surgical yellow accent, 275M record stat panel and FERPA enforcement gap reference.](https://lattix.io/images/blog/instructure-canvas-breach-data-enforcement-cover.svg) The Canvas Breach Is a Data Enforcement Story, Not a Containment Story May 8, 2026 ShinyHunters claimed 275 million records from Instructure across 9,000 institutions. Containment closed the access path. The records had already crossed the policy boundary. The disclosure surface is what FERPA, schools, and downstream subjects have to deal with now. Read More →](https://lattix.io/blog/instructure-canvas-breach-data-enforcement/) [![Lattix branded cover: Data-Centric Security Closes the Third-Party Risk Assurance Gap. /18 section number, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/third-party-risk-data-centric-answer-cover.svg) Data-Centric Security Closes the Third-Party Risk Assurance Gap May 8, 2026 Questionnaire fatigue and point-in-time audits cannot track vendor risk continuously. Policy authority retained at the data layer does. Read More →](https://lattix.io/blog/third-party-risk-data-centric-answer/) [![Lattix branded cover for Federal Zero Trust Deadlines Are Binding. Data Layer Enforcement Is Not. Yellow accent bar, /02 section number, IBM Plex Mono typography on dark grid background.](https://lattix.io/images/blog/federal-zero-trust-deadlines-data-layer-enforcement-cover.svg) Federal Zero Trust Deadlines Are Binding. Data Layer Enforcement Is Not. May 6, 2026 CISA's April 2026 binding directive sets Q3/Q4 2026 deadlines for identity, network, and device zero trust controls. The data layer remains optional. Programs that hit every milestone without object-level enforcement still fail on a compromised service account. Read More →](https://lattix.io/blog/federal-zero-trust-deadlines-data-layer-enforcement/) [![Lattix branded cover for CNSA 2.0 Just Narrowed the PQC Field. /04 section number, ML-KEM-1024 and ML-DSA-87 metadata strip, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/cnsa-2-0-ml-kem-1024-ml-dsa-87-exclusive-clarification-cover.svg) CNSA 2.0 Just Narrowed the PQC Field. ML-KEM-768 Will Not Clear NSS. May 5, 2026 NSA's April 2026 clarification narrowed the post-quantum field for National Security Systems to ML-KEM-1024 and ML-DSA-87. ML-KEM-768 will not clear NSS. Vendors that staked PQC-ready claims on the smaller parameter set need new statements. Read More →](https://lattix.io/blog/cnsa-2-0-ml-kem-1024-ml-dsa-87-exclusive-clarification/) [![Lattix branded cover for Post-Quantum Cryptography: Why the Transition Has to Happen Now. /03 section number, FIPS 140-2 sunset date, IBM Plex Mono on dark grid background, surgical yellow accent.](https://lattix.io/images/blog/post-quantum-cryptography-why-transition-now-cover.svg) Post-Quantum Cryptography: Why the Transition Has to Happen Now May 4, 2026 Two PQC deadlines are already running. September 21, 2026 sunsets FIPS 140-2 for federal procurement. January 2027 binds CNSA 2.0 for National Security Systems. The migration that matters is not the algorithm. It is the cryptographic agility to swap one. Read More →](https://lattix.io/blog/post-quantum-cryptography-why-transition-now/) [![Lattix branded cover for Protecting Sensitive AI Training Data with Data-Centric Security. /06 section number, infrastructure-to-data protection shift metadata, IBM Plex Mono on dark grid background.](https://lattix.io/images/blog/protecting-sensitive-ai-training-data-with-data-centric-security-cover.svg) Protecting Sensitive AI Training Data with Data-Centric Security May 13, 2025 AI systems are only as trustworthy as the data they train on. A data-centric security approach shifts protection from infrastructure to the data itself. Read More →](https://lattix.io/blog/protecting-sensitive-ai-training-data-with-data-centric-security/) ## Related topics - [Zero Trust Architecture](https://lattix.io/blog/topics/zero-trust/) - [Data Security](https://lattix.io/blog/topics/data-security/) - [Zero Trust Data Format](https://lattix.io/blog/topics/ztdf/) - [Access Control](https://lattix.io/blog/topics/access-control/) - [AI Security](https://lattix.io/blog/topics/ai-security/) - [Post-Quantum Cryptography](https://lattix.io/blog/topics/post-quantum-cryptography/) [All topics →](https://lattix.io/blog/topics/)