1. Home
  2. |Insights
  3. |NIST Offers a Two-for-One Special on Cybersecurity Updates

NIST Offers a Two-for-One Special on Cybersecurity Updates

Client Alert | 1 min read | 06.20.18

The government’s leading authority on cybersecurity standards has issued two updates relevant to government contractors working with DoD sensitive data. First, the National Institute of Standards and Technology (NIST) updated Special Publication (SP) 800-171, the security standard required by the DFARS Safeguarding Clause 252.204-7012 and also expected to be required under a pending FAR Clause. In addition to nuanced security control revisions, notable changes include the addition of Appendix F, which discusses security requirements derived primarily from the separate standard NIST SP 800-53 in an effort to inform organizations about mechanisms and procedures used to implement required safeguards. Second, NIST finalized its draft of NIST SP 800-171A. This sister document provides guidance in assessing NIST SP 800-171 security controls, including System Security Plans (SSPs) and Plans of Action and Milestones (POAMs). Changes in the finalized guidance include the removal of NIST SP 800-53 guidance in Appendix D and its replacement with three assessment methods – Examine, Interview, and Test – that can be used to assess security requirements under NIST SP 800-171.

Contacts

Insights

Client Alert | 5 min read | 08.21.26

FTC Proposes Enforcement Policy Statement on Personalized Pricing: What Businesses Need to Know

On August 19, 2026, the Federal Trade Commission (FTC) announced a proposed Enforcement Policy Statement on personalized pricing — the practice of companies using consumers’ personal data to set individualized prices, discounts, coupons, or other incentives. The proposed statement, which is open for public comment for 30 days following publication in the Federal Register, marks a major step up in the FTC’s focus on data-driven pricing strategies and puts businesses across industries on notice that undisclosed or inadequately disclosed personalized pricing will not be tolerated. Importantly, while the proposed statement is not a binding legal requirement and does not create new legal obligations, it serves as an enforcement warning that the FTC is prepared to use its existing enforcement authority under Section 5 of the FTC Act (Section 5) and is also a potential harbinger of rulemaking. Businesses that engage in — or are considering — personalized pricing should carefully assess their disclosure practices and data collection procedures against the standards articulated in this statement....

View All Insights