Security teams keep building controls, audits and contracts against standard versions that have already been replaced, amended or retired. The core cyber standards move on different cycles: NIST publishes numbered releases of its control catalogue, ISO amends and revises on a five-year review, the PCI Security Standards Council retires versions on fixed dates, and the post-quantum standards are still arriving one by one. This tracker records the current published version of each key standard, what changed most recently, what is still in draft, and what each change means for identity, access and non-human identity (NHI) programmes. It is written for security architects, GRC leads and auditors who need to cite the right version. Agent and AI identity specifications (MCP, A2A, OAuth drafts, WIMSE) are tracked separately in the Agent Identity Standards Tracker.
Status as of: 25 October 2026. Every status below was checked on the publisher's own page on that date; always re-check the linked primary source before an audit, a tender or a policy update.
Key takeaways
- NIST SP 800-53 is still Revision 5, but the current catalogue is Release 5.2.0 (27 August 2025), which added SA-15(13), SA-24 and SI-02(07). Control baselines and tooling pinned to 5.1.x are out of date.
- SP 800-63-4 is final (31 July 2025) and supersedes SP 800-63-3. Authentication, proofing and federation requirements should now cite the -4 volumes.
- ISO/IEC 27001:2022 remains current with one published amendment (Amd 1:2024, climate action changes); ISO/IEC 27701 became a standalone management system standard in its 2025 edition.
- PCI DSS v4.0.1 is the only active version: v4.0 retired on 31 December 2024 and the future-dated requirements became effective on 31 March 2025.
- Post-quantum cryptography is part published, part pending: FIPS 203, 204 and 205 are final, while the FN-DSA (Falcon) and HQC standards and the NIST IR 8547 transition timeline are not yet final.
Status key
- Published: final standard, publication or numbered release that can be cited in policy and audit.
- Published, amended: final standard with a published amendment that should be read together with the base text.
- Draft: public draft, initial public draft (ipd) or committee stage; expect change, do not certify against it.
- Retired or superseded: withdrawn or replaced; keep only for historical evidence.
- In progress: selection or standardisation announced, no draft text yet confirmed.
Frameworks and control catalogues
| Standard | Publisher | Status (25 Oct 2026) | Latest change | Identity and NHI relevance |
|---|
| SP 800-53 Rev. 5 | NIST | Published; current catalogue Release 5.2.0 | Release 5.2.0 (27 August 2025), a minor release: new SA-15(13) Logging Syntax, SA-24 Design for Cyber Resiliency and SI-02(07) Root Cause Analysis; revised SI-07(12) Integrity Verification; updated discussion in SA-04, SA-05, SA-08 and SI-02. No Revision 6 draft is listed. | AC-2 Account Management, IA-4 Identifier Management and IA-5 Authenticator Management remain the anchor controls for service accounts and machine credentials. See the NIST SP 800-53 Guide. |
| Cybersecurity Framework (CSF) 2.0 | NIST | Published (February 2024); CSF 1.1 archived | No 2.x revision listed. Supporting material continues: the final Informative References Quick-Start Guide (SP 1347), a draft O-RAN community profile (IR 8623 ipd) and SP 800-221r1 ipd on ICT risk, open for comment until 7 December 2026. | PR.AA-01 covers identities and credentials for "users, services, and hardware", which brings NHIs explicitly into scope. See the NIST CSF to ISO 27001 Mapping Guide. |
| CIS Critical Security Controls v8.1 | Center for Internet Security | Published; v8.0 and v7.1 still downloadable | v8.1 added the Govern security function to align with CSF 2.0. No v9 is announced on the CIS page. | Control 5 (Account Management) and Control 6 (Access Control Management) cover service accounts and revocation. See the CIS Controls Guide. |
| SP 800-171 Rev. 3 | NIST | Published | Revision 3 is the current revision of the CUI protection requirements. Check which revision your contract or assessment scheme cites, as programme rules can lag the catalogue. | Identification, authentication and account management requirements apply to system and service accounts handling CUI. See the NIST SP 800-171 and CMMC 2.0 Guide. |
Management system standards
| Standard | Status (25 Oct 2026) | Latest change | What it means in practice |
|---|
| ISO/IEC 27001:2022 | Published, amended (stage 60.60) | Amendment ISO/IEC 27001:2022/Amd 1:2024 "Climate action changes" is published. ISO/IEC 27001:2013 and its corrigenda are withdrawn. The ISO page shows no revision stage for the 2022 edition. | Certification is against the 2022 edition read with Amd 1. Annex A identity controls (5.15 to 5.18, 8.2, 8.5) are unchanged by the amendment. See the ISO 27001 Certification Guide. |
| ISO/IEC 27701:2025 | Published (14 October 2025), edition 2 | Now a standalone management system standard; ISO/IEC 27701:2019 is withdrawn. | A privacy information management system no longer has to be certified as an extension of an ISO/IEC 27001 ISMS. Plan the transition of existing 2019 certificates with your certification body. See the ISO/IEC 27701 Privacy Information Management Guide. |
| ISO/IEC 42001:2023 | Published (December 2023), edition 1, stage 60.60 | No amendment or revision listed. | The AI management system standard; AI agents and the credentials they use fall within its operational controls and risk treatment. See the ISO 42001 Lead Auditor and Lead Implementer Guide. |
Identity and authentication
| Standard | Status (25 Oct 2026) | Latest change | Identity and NHI relevance |
|---|
| SP 800-63-4 Digital Identity Guidelines | Published (31 July 2025) | Supersedes SP 800-63-3 (March 2020). Published as SP 800-63-4 with parts SP 800-63A-4 (proofing and enrolment), SP 800-63B-4 (authenticators) and SP 800-63C-4 (federation and assertions). NIST has added an Implementation Resource Hub; no errata are listed. | Written for human subscribers, but the federation and assertion rules in 63C-4 shape how tokens issued to workloads and agents are designed. Update policies that still cite 800-63-3 assurance levels. See the NIST SP 800-63 Digital Identity Guidelines Guide. |
| OWASP Non-Human Identities Top 10 | Published, 2025 edition (guidance list) | 2025 is the first edition; NHI1:2025 is Improper Offboarding. | The reference risk list for service accounts, API keys, tokens and workload identities. See the Top 10 NHI Risks and the OWASP NHI Top 10 NHI1 Improper Offboarding Guide. |
| Agent identity specifications (MCP, A2A, OAuth drafts, WIMSE, AuthZEN) | Mixed | Tracked separately because they change monthly. | See the Agent Identity Standards Tracker. |
Cryptography and post-quantum
| Standard | Status (25 Oct 2026) | Latest change | Identity and NHI relevance |
|---|
| FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), FIPS 205 (SLH-DSA) | Published (13 August 2024) | Approved by the Secretary of Commerce; drafts had been open for comment from 24 August 2023. | Key establishment and signatures for TLS, code signing and certificates: every machine identity that relies on RSA or elliptic-curve keys is eventually affected. See the Post-Quantum Migration for NHIs Guide. |
| FN-DSA (Falcon) signature standard | In progress | NIST states that Falcon was selected and standardisation "is underway". We could not confirm the draft status from the publisher on the review date, so it is not listed as a draft here. | Smaller signatures than ML-DSA; relevant to constrained devices and certificate chains. |
| HQC key encapsulation | In progress | Selected for standardisation on 11 March 2025 (status report NIST IR 8545). | A backup KEM based on different mathematics from ML-KEM; plan for algorithm agility rather than a single swap. |
| NIST IR 8547 Transition to Post-Quantum Cryptography Standards | Draft (initial public draft, 12 November 2024) | Comment period closed 10 January 2025; comments published 21 January 2025; no final version listed. NIST's project page states that quantum-vulnerable algorithms will be deprecated and ultimately removed from NIST standards by 2035, with high-risk systems moving much earlier. | Sets the planning horizon for certificate authorities, HSMs and long-lived signing keys. See the Post-Quantum Cryptography Migration Guide. |
Industry and sector standards
| Standard | Status (25 Oct 2026) | Latest change | Identity and NHI relevance |
|---|
| PCI DSS v4.0.1 | Published; the only active version | Published June 2024 as a limited revision with no requirements added or deleted. PCI DSS v4.0 retired on 31 December 2024. Requirements that were future-dated became effective on 31 March 2025, and v4.0.1 did not move that date. | Requirement 8 now governs system and application accounts directly, including password management for accounts that can be used interactively and removal of hard-coded passwords. See the PCI DSS 4.0 Guide. |
| ISA/IEC 62443 series | Published, parts at different editions | Newest parts: 62443-2-1:2024 (security programme requirements for asset owners) and the technical report 62443-2-2:2025 (IACS security protection scheme). Other parts on the ISA list: 1-1 (2007), 2-3 TR (2015), 2-4 (2018), 3-2 (2020), 3-3 (2013), 4-1 (2018), 4-2 (2018). ISA shows no part as under revision. | 3-3 and 4-2 define identification and authentication requirements for software processes and devices, the OT equivalent of NHI controls. See the IEC 62443 Guide. |
Where identity and NHIs fit
Most of these revisions are small, but several matter directly to identity programmes:
- Machine accounts are no longer implicit: CSF 2.0 PR.AA-01 names services and hardware alongside users, and PCI DSS v4.0.1 Requirement 8 addresses system and application accounts. Auditors increasingly ask for an inventory of non-human accounts, their owners and their credential rotation evidence. See the Non-Human Identity (NHI) Guide.
- Control catalogues drive tooling: GRC platforms and OSCAL content pinned to an older SP 800-53 release will miss SA-24 and SA-15(13). Ask your tooling provider which release its catalogue reflects.
- Cryptographic change lands on machines first: post-quantum migration is mostly a machine identity problem (certificates, signing keys, TLS between services), so the PQC rows above belong in the NHI roadmap, not only the PKI team's backlog. See the Machine Identity, PKI and Certificate Lifecycle Guide.
- Agent identity is a separate, faster track: do not cite agent protocol drafts as if they were stable standards. Use the Agent Identity Standards Tracker for those.
Version hygiene: what to update now
| If your documents cite | Replace with | Typical places to change |
|---|
| SP 800-63-3, IAL/AAL/FAL from the 2017 text | SP 800-63-4 and its A, B and C volumes | Authentication standard, MFA policy, federation and SSO requirements, RFP templates |
| SP 800-53 Rev. 5 release 5.1.x | SP 800-53 Rev. 5 Release 5.2.0 | Control baselines, OSCAL catalogues in GRC tooling, system security plans |
| PCI DSS v4.0 | PCI DSS v4.0.1 | Reports on Compliance, SAQs, scoping documents, third-party contracts |
| ISO/IEC 27001:2013 | ISO/IEC 27001:2022 with Amd 1:2024 | Statement of Applicability, ISMS manual, supplier assurance questionnaires |
| ISO/IEC 27701:2019 as an extension of 27001 | ISO/IEC 27701:2025 (standalone) | Privacy programme scope, certification plan |
| CSF 1.1 categories (for example PR.AC) | CSF 2.0 categories (for example PR.AA) | Board reporting, maturity assessments, control mappings |
Retired and superseded versions
Keep these only as historical evidence for past audit periods. New policies, contracts and assessments should not cite them.
| Retired or superseded version | Replaced by | Status on the publisher page |
|---|
| NIST SP 800-63-3 (2017, updated March 2020) | SP 800-63-4 | Superseded on 31 July 2025 |
| PCI DSS v4.0 | PCI DSS v4.0.1 | Retired on 31 December 2024 |
| ISO/IEC 27001:2013 with Cor 1:2014 and Cor 2:2015 | ISO/IEC 27001:2022 | Withdrawn |
| ISO/IEC 27701:2019 | ISO/IEC 27701:2025 | Withdrawn |
| NIST CSF 1.1 | CSF 2.0 | Archived; PDF and Core spreadsheet still available |
| CIS Controls v8.0 and v7.1 | CIS Controls v8.1 | Still downloadable as earlier versions |
What to watch next
- NIST IR 8547 final: the final text will fix deprecation and disallowance dates for RSA and elliptic-curve algorithms, which drive certificate and HSM replacement plans.
- FN-DSA and HQC drafts: draft FIPS for Falcon-based signatures and an HQC-based KEM, then their comment periods.
- SP 800-53 releases: NIST now issues numbered minor releases between revisions; watch the release notes for new account and authenticator management enhancements.
- SP 800-221r1: the ICT risk management draft aligned with CSF 2.0 is open for comment until 7 December 2026.
- ISO/IEC 27001 review cycle: the 2022 edition will reach its normal systematic review point; any revision will appear first as a stage change on the ISO page.
- 27701:2025 certificate transitions: certification body transition rules for organisations holding 2019 certificates.
- ISA/IEC 62443: further revisions to older parts such as 3-3 (2013) and 1-1 (2007).
How to use this tracker
- Find your citations: search policies, contracts, RFPs and audit evidence for each standard name and record the version cited.
- Compare against the status column: anything older than the published version above is a change request; anything citing a draft needs a note that it may change.
- Assess impact before editing: a minor release (800-53 5.2.0, PCI DSS 4.0.1) rarely changes your controls; a new revision (800-63-4) or a structural change (27701:2025) usually does.
- Update mappings once: keep a single control mapping (for example CSF 2.0 to ISO/IEC 27001 Annex A to CIS v8.1) and regenerate dependent documents from it.
- Re-check the primary source on the publisher's page before an audit, a certification or a tender; this page reflects the status on 25 October 2026 only.
- Track agent and AI identity specifications separately in the Agent Identity Standards Tracker.
Status information is based on the linked primary sources as at 25 October 2026 and may have changed since. This guide summarises the status of published standards and is not legal advice. Related NHI Mgmt Group resources: Agent Identity Standards Tracker · NIST SP 800-53 Guide · ISO 27001 Certification Guide · Post-Quantum Cryptography Migration Guide · Top 10 NHI Risks
NHIMG Editorial Note
Researched and written by the NHI Mgmt Group editorial team using AI tools, under the editorial direction of Lalit Choda. Facts are drawn from the sources listed on this page and checked by our automated quality process. Last updated 26 October 2026. Spotted an error? Use our
contact page.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM and Agentic AI security.
nhimg.org