Each card gives the rule, its status, the words that matter and our part in the work. Your agency makes the determinations; we provide the evidence and the documentation.
U.S. federal (budget guidance)Key date: July 21, 2026
OMB M-26-16: Fiscal Year 2028 Administration Research and Development Budget Priorities (robotics and physical AI)
In effect: R&D budget-priority guidance issued jointly by OSTP and OMB on July 21, 2026 (NSTM-5 / M-26-16), for agencies to consider, as appropriate, in FY 2028 budget formulation.
“Robotics: General-purpose autonomous systems capable of dexterous manipulation, mobility, and reliable operation in real-world environments, to initiate the era of physical AI-driven scientific discovery and American reindustrialization”
What we do: For agency R&D programs that follow this robotics priority, we test one physical AI application in simulation first and then on site, with the payback case and the safety case attached.
Source: OMB M-26-16 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (Department of War / Department of Defense programs)Key date: December 21, 2023
DoD Instruction 5000.97, Digital Engineering
In effect (published December 21, 2023); quote from the official DoD CTO summary.
“Programs started after the date of the policy will incorporate digital engineering during development unless the program's decision authority provides an exception.”
What we do: For defense programs we assess twin and data readiness, design the authoritative source of truth for data and models, and list the digital models and data sets the program can name as contract deliverables.
Source: DoD Instruction 5000.97, Digital Engineering (cto.mil, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (NIST guidance)Key date: February 14, 2025
NIST IR 8356: Security and Trust Considerations for Digital Twin Technology
Final (February 2025): a NIST Internal Report on security and trust considerations, written for standards developers and digital twin implementers.
“Digital twin technology enables the creation of electronic representations of real-world entities”
What we do: We use NIST IR 8356 to review the data boundaries, connections and trust considerations of every twin pilot, alongside the security controls your agency selects.
Source: NIST IR 8356 (csrc.nist.gov) (opens in a new tab) · Checked November 10, 2026
U.S. federal (executive agencies; national security systems and the Defense and Intelligence Community systems described in 44 U.S.C. 3553(e) excluded)Key date: May 22, 2026
OMB M-26-14: agency logging and network visibility (rescinds M-21-31)
In force since May 22, 2026; covers systems operated by third parties and the IoT/OT within them. CISA published the Logging Reference Architecture on August 20, 2026, which sets the agency deadlines: Agency Logging Plan by November 18, 2026, Level 1 (Basic) maturity by December 18, 2026, Intermediate by February 16, 2027 and Advanced by July 6, 2027.
“including any Internet of Things (IoT) devices or operational technology (OT) that is part of or constitutes such an information system”
What we do: Twin and robotics pilots log from the first sensor, and the logging design follows your agency's logging plan.
Source: OMB M-26-14 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (executive agencies)Key date: January 26, 2022
OMB M-22-09: Moving the U.S. Government Toward Zero Trust Cybersecurity Principles
Issued January 26, 2022; its FY2024 objectives have passed; no rescission found.
“For agency staff, contractors, and partners, phishing-resistant MFA is required.”
What we do: We design identity, network and data-boundary controls on zero trust principles: phishing-resistant MFA, conditional access and least privilege.
Source: OMB M-22-09 (whitehouse.gov, PDF) (opens in a new tab) · Checked November 10, 2026
U.S. federal (FedRAMP)Key date: February 25, 2026
FedRAMP Certification Classes (Notice 0004 and the agency guidance on classes)
In force under the Consolidated Rules for 2026 (launched June 24, 2026; mandatory January 1, 2027), as announced in Notice 0004 of February 25, 2026: four classes from Class A (minimal assurance) to Class D; Class B includes the current LI-SaaS and Low baselines, Class C the Moderate baseline and Class D the High baseline; classes are not one-for-one replacements for impact levels.
“Agencies should not treat Certification Classes as one-for-one replacements for Low, Moderate, or High impact levels.”
What we do: Your agency categorizes the system first, and the blueprint then records, for each workload, the cloud service and the FedRAMP class it holds, ready for your agency's risk decision.
Source: FedRAMP Certification Classes (fedramp.gov) (opens in a new tab) · Checked November 12, 2026
U.S. (community water systems serving more than 3,300 people)Key date: October 23, 2018
America's Water Infrastructure Act §2013: risk and resilience assessments and emergency response plans
In force. This cycle's risk and resilience assessment certifications were due March 31, 2025, December 31, 2025 and June 30, 2026, by system size; emergency response plans follow six months after each assessment certification, the last on EPA's schedule by December 31, 2026; reviews repeat at least once every five years.
“electronic, computer, or other automated systems (including the security of such systems)”
What we do: Utility twin, operational-data and capital-planning work is scoped so its findings can feed the risk and resilience assessment and the emergency response plan a community water system reviews and certifies to EPA at least once every five years.
Source: America's Water Infrastructure Act §2013 (epa.gov) (opens in a new tab) · Checked November 10, 2026