05/29/2026
If your company holds a FedRAMP authorization, works in GovCon, or handles any federal health data — this is required reading before July 1.
Lori Crooks, CEO of Cadra, breaks down three major compliance deadlines converging right now, and what executives need to do before enforcement kicks in:
📋 FedRAMP CR26 — Finalizes end of June, takes effect July 1. Authorization becomes Certification. Impact levels are being reclassified. Templates are gone. Your IR plan and SIEM alerting thresholds need to reflect the new framework — now.
⚖️ DOJ False Claims Act Enforcement — The Department of Justice's new Division for National Fraud Enforcement is active, cybersecurity FCA settlements topped $52M in FY2025, and the MORSECORP case made clear: reckless disregard of compliance accuracy is enough for liability. You don't have to have lied to be in trouble.
🏥 HIPAA Security Rule — A sweeping final rule is expected any day, starting a 240-day compliance clock. MFA, encryption, network segmentation, annual pen testing, and 72-hour recovery capability are all moving from optional to mandatory. If you're also working toward CMMC, these programs overlap significantly — the work counts for both.
The bottom line: The companies caught off guard won't always be the ones who ignored compliance. They'll be the ones who stopped paying attention after the initial filing.
Don't be that company. Find out more: https://www.linkedin.com/pulse/six-months-out-q2-compliance-play-lori-crooks-cissp-cisa-cism-ef2ve/
