Changes in Data Protection, Artificial Intelligence, and Supply Chain: Organizations Must Prepare for Regulatory Requirements Across All Security Aspects
In 2025, the cybersecurity world is preparing for comprehensive regulatory changes, particularly concerning cloud technologies, AI systems, and enterprise identity management. Experts note that governments are expected to institutionalize security procedures in a manner similar to GAAP (Generally Accepted Accounting Principles) in the world of accounting. New regulations, such as the European Union’s Digital Operational Resilience Act (DORA), will take effect as early as January, while a potential deregulation scenario in the US could pose a new global challenge. These trends primarily affect high-sensitivity sectors, such as finance and healthcare, which are required to maintain more advanced standards and closer monitoring of vendors and the supply chain.
Transitioning from IT Standards to Comprehensive Defense Frameworks: Emphasis on Business Resilience and Continuous Vendor Licensing
Organizations will find that regulatory requirements no longer settle for compliance with minimal defense procedures. DORA regulations will require financial institutions to ensure digital resilience, while directives such as NIS-2 and PCI DSS 4.0 will expand the definition of “basic security procedures.” Concurrently, new regulations will require cloud providers to commit to strict security policies and improve identity and access management (IAM) practices and event logging. The overall goal is the development of cross-organizational security frameworks focusing on business continuity and rapid resilience in the event of an attack or technological failure.
AI Raises Ethical and Legal Questions: Management of Non-Human Identities and Software Product Security
The increasing engagement with AI and the emergence of artificial intelligence laws, such as the EU AI Act, will force organizations to demonstrate transparency and compliance with new privacy rules alongside advanced security controls. Authorities are also dedicating special attention to the Domain Name System (DNS), as any malfunction or breach in the DNS could cause wide-scale disruption; therefore, it is defined as a core part of the global infrastructure requiring oversight and supervision. In the military and industrial sectors, the Cybersecurity Maturity Model Certification (CMMC) will require small and medium-sized enterprises (SMEs) to migrate to advanced secure clouds and strictly align with NIST 800-171 standards.
Recommendations from IPV Security Information Security Experts:
- Global Review of Security Standards: Continuous monitoring of diverse requirements such as NIS-2, PCI DSS 4.0, and DORA, and the necessary adjustments for each geographical market.
- Implementation of Microsegmentation and Zero-Trust Procedures: Updated frameworks require reducing lateral movement within the network and risk separation to prevent widespread damage during an attack.
- AI Integration with Privacy Procedures: Organizations using AI tools will be required to transparently document data sources and prove rigorous encryption policies.
- Strengthening the Supply Chain and Stringent Third-Party Vendor Processes: Due to security requirements for vendors in sensitive sectors (healthcare, finance), strict vetting must be performed before onboarding a new vendor, alongside the management of appropriate legal agreements.
Summary
The year 2025 is expected to revolutionize cyber regulations worldwide, with significant innovations in AI systems, cloud management, and supply chain risk mitigation. The impact of international laws, such as DORA and the EU AI Act, will raise the bar for security compliance. To meet regulations and avoid sanctions, organizations must adopt a proactive approach based on the adoption of new security frameworks and global coordination between cyber, legal, and business teams.
For further information: https://www.scworld.com/feature/how-will-rules-and-regulations-affect-cybersecurity-and-ai-in-2025