2026 Compliance Landscape: What's Changed for Business

The 2026 compliance landscape looks meaningfully different from where it was even two years ago. New state-level privacy laws, expanded breach notification requirements, the maturation of CMMC for defense contractors, and a steady tightening of cyber insurance underwriting requirements have all shifted what businesses need to actually do — not just what's nice to have. Here's a practical overview of what's changed and what most small and mid-market businesses need to be paying attention to.

State Privacy Laws Keep Multiplying

The patchwork of US state privacy laws continues to expand. As of 2026, more than 20 states have enacted comprehensive consumer privacy laws — beyond California (CCPA/CPRA), there are Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Iowa, Indiana, Tennessee, Texas, Oregon, Delaware, Montana, New Hampshire, New Jersey, and others with active or pending statutes. The compliance impact for businesses operating across multiple states is meaningful: privacy notices, consumer rights handling (access requests, deletion requests, opt-outs), data minimization practices, and vendor management requirements need to satisfy the strictest applicable standard or be applied per-state.

Practical implication for SMBs: if you have customers in any of those states, the de facto floor is something close to a CCPA-aligned privacy program — even without a specific revenue or volume trigger. The cost of building a state-by-state program exceeds the cost of building one program against the strictest standard.

CMMC Has Teeth Now

The Cybersecurity Maturity Model Certification (CMMC) for defense contractors has moved from "coming soon" to "actively being required in contracts." Department of Defense contracts increasingly include CMMC Level 2 requirements that contractors must demonstrate before award. The bar for Level 2 — alignment with NIST SP 800-171 controls, third-party assessment, ongoing maintenance — is substantial. Businesses in the defense supply chain that haven't started CMMC preparation are already behind; lead time from start to certification typically runs 9-18 months.

For businesses across industries with any defense or federal civilian contract exposure, CMMC is the most consequential compliance shift in this cycle. Even non-DoD federal contracts increasingly reference NIST 800-171 or similar control sets as baseline requirements.

Breach Notification Requirements Are Tightening

Federal and state breach notification requirements have continued to compress timelines. The SEC's cybersecurity disclosure rules for public companies require material incidents to be disclosed within four business days. Some state laws now require notification within 30 days; HIPAA-covered entities have always had 60 days for individual notification but increasingly face faster timelines for press and HHS notifications on larger breaches. For most SMBs, the practical impact is that an incident response plan must include legal counsel involvement on day one of an incident, not as a follow-up step.

Cyber Insurance Drives Practical Requirements

One of the more consequential compliance pressures isn't a regulation — it's cyber insurance underwriting. Insurers have moved aggressively to require specific controls before they'll write or renew policies. The current floor for most insurance markets includes:

• MFA on email, VPN, and admin accounts
• EDR or equivalent endpoint protection
• Immutable, off-network backups
• Security awareness training
• Patching SLAs for critical CVEs
• Privileged access management
• Vendor risk management for major suppliers

Businesses that can't attest to those controls increasingly find their coverage being non-renewed or priced punitively. The insurance market is, in practice, a faster-moving compliance regime than any government regulator.

What to Do Now

For SMB and mid-market businesses, the practical next steps are: confirm whether your customer footprint triggers state privacy law obligations, audit your current security controls against cyber insurance underwriting requirements, identify any federal contract exposure that triggers CMMC or NIST 800-171, and verify your incident response plan reflects current breach notification timelines. A compliance scoping conversation can identify which of these apply to your specific business and where the priority investments are.