| Section | Action Type | Changes |
|---|---|---|
| SIMM 140 | Change | Updated FIPS to 140-2 to FIPS 140-3 |
| SIMM 5320-A | Change | Eliminating the requirement for the Office of Information Security (OIS) and California Cybersecurity Integration Center (Cal-CSIC) requirements for approval before conducting a simulated phishing campaign, while maintaining the 72-hour advanced notification email requirement to Cal-CSIC |
