Tech Stack Update Plan

2026 Tech Stack Update Plan

Purpose

This document is the output of a full-repository review conducted in September 2026 to identify content that had drifted out of date with the current cloud security tooling and regulatory ecosystem. Most files carried a “2025-2026” label, but several product names, version numbers, and framework citations had become factually stale or referred to products that were renamed, merged, or acquired. This plan cataloged those findings and sequenced the fixes so the repository’s “current as of 2026” claim (README.md line 197) is now fully verified and true.

All phases (Phase 1 through Phase 4) have been fully executed and verified across the codebase.

Findings

1. Vendor/product renames and mergers (factually incorrect as written)

Issue Why it’s stale Locations Suggested replacement
Azure AD / Azure Active Directory Microsoft completed the rebrand to Microsoft Entra ID in 2023; “Azure AD” has not been the product’s name for several years. IMPLEMENTATION_GUIDE.md:31,173, README.md:83, index.html:323,329 Replace with “Microsoft Entra ID” (first mention can note “formerly Azure AD” once for reader continuity; ensure IMPLEMENTATION_GUIDE.md:31 “Azure: Active Directory” is updated alongside the “Azure AD” acronyms).
Twistlock Twistlock was acquired by Palo Alto Networks and fully folded into Prisma Cloud Compute by 2020. The standalone brand no longer exists. IMPLEMENTATION_GUIDE.md:50, TESTING_GUIDE.md:146, README.md:88 Replace “Twistlock/Prisma Cloud” with “Prisma Cloud Compute”.
Bridgecrew Bridgecrew was acquired by Palo Alto Networks in 2021 and merged into Prisma Cloud (its code-to-cloud/IaC scanning capability); it is no longer sold as a separate product. IMPLEMENTATION_GUIDE.md:58,152, TESTING_GUIDE.md:160, README.md:87 Replace “Bridgecrew” with “Prisma Cloud (code-to-cloud)” or drop the standalone mention.
Chronicle (standalone) Google rebranded Chronicle as Google Security Operations (Google SecOps) in 2024, integrating it with Mandiant capabilities. IMPLEMENTATION_GUIDE.md:47, SECURITY_FRAMEWORK.md:200,206, README.md:84, index.html:351,357 Replace “Chronicle” with “Google Security Operations (Google SecOps)”.
Lacework Acquired by Fortinet in late 2024; it is now part of Fortinet’s cloud security portfolio branded as Lacework FortiCNAPP / FortiCNAPP, not an independent standalone vendor. IMPLEMENTATION_GUIDE.md:48,154, SECURITY_FRAMEWORK.md:209, README.md:86, TESTING_GUIDE.md:157 Use official product branding “Lacework FortiCNAPP” or “FortiCNAPP” (noting “(formerly Lacework)” once on initial reference if desired), or drop from independent vendor listings.
HashiCorp Sentinel / Terraform ownership IBM completed its acquisition of HashiCorp in 2025; Terraform/Sentinel/Vault are now IBM-owned products. Also, HashiCorp’s 2023 BSL relicensing spawned OpenTofu (now a Linux Foundation project) as the open-source Terraform fork many teams adopted instead. README.md:87, IMPLEMENTATION_GUIDE.md:37,54 Note IBM ownership where HashiCorp is named, and add OpenTofu only in IaC provisioning guidance (not compliance or policy-enforcement tool lists).
“GPT-powered analysis” Vendor- and model-specific phrasing that reads as a stale 2023-era buzzword rather than a durable architectural description. SECURITY_FRAMEWORK.md:151 Reword to vendor-neutral language, e.g., “LLM-powered security orchestration” or “generative-AI-assisted analysis.”

2. Version/standard references that have moved on

Issue Current state (Sept 2026) Locations Suggested update
PCI-DSS v4.0 / PCI-DSS 4.0 Superseded by PCI-DSS v4.0.1 (June 2024); the v4.0 future-dated requirements became mandatory March 31, 2025, and are now in full force. 10 literal “PCI-DSS v4.0” references across 6 text files (README.md:15,46,65,104, COMPLIANCE.md:20, SECURITY_FRAMEWORK.md:172, SECURITY_TRAINING_GUIDE.md:37, VENDOR_SECURITY_ASSESSMENT.md:121, index.html:125,260), plus diagram labels: security_framework.dot:13 and rendered security_framework.svg:204 (“PCI-DSS 4.0”). Note: TESTING_GUIDE.md:57 only uses generic “PCI-DSS” without a version. Update the 10 literal text references to “PCI-DSS v4.0.1”, drop “future-dated”/”enhanced requirements” framing since those requirements are already in force, and update diagram source security_framework.dot:13 (and regenerate security_framework.svg:204) from “PCI-DSS 4.0” to “PCI-DSS 4.0.1”.
Terraform “v1.6+” Terraform has advanced multiple minor versions since 1.6 (Oct 2023), with active releases in the 1.16.x family (and OpenTofu in 1.12.x). Hardcoded version pins like 1.6+ (or interim 1.9+/1.8+) quickly become obsolete and predate or understate the OpenTofu fork. IMPLEMENTATION_GUIDE.md:37 Adopt a support-policy-based baseline (e.g., “actively supported stable versions such as Terraform 1.16+ / OpenTofu 1.12+, or current N-2 release lines verified at implementation time”) rather than hardcoding an obsolete minimum.
Post-quantum cryptography & vague “quantum-ready” phrasing NIST finalized the primary PQC standards in August 2024: FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA). Multiple repository documents use vague, speculative phrasing like “quantum-resistant”, “post-quantum”, or “quantum-ready” without citing the finalized FIPS standards or reflecting that federal agencies and industry are now in active PQC migration windows. SECURITY_FRAMEWORK.md:119, INNOVATION.md:45-51,140-144, RISK_MANAGEMENT.md:11,169-173, SECURITY_TRAINING_GUIDE.md:14,44,82,176, VENDOR_SECURITY_ASSESSMENT.md:30,88,109, index.html:242-245, and diagram labels (security_framework.dot:20 / svg:95, risk_management.dot:20 / svg:88) Explicitly cite FIPS 203, 204, and 205; replace vague “quantum-ready” and speculative “planning for” phrases with concrete “migrating to FIPS-standardized PQC” terminology across guides, assessment checklists, and diagram labels.
OWASP Top 10 2024 SECURITY_TRAINING_GUIDE.md:87 cites a nonexistent “OWASP Top 10 2024”. The core web application security standard is OWASP Top 10:2025 (superseding 2021). For the AI-specific training content, the dedicated standard is the OWASP Top 10 for LLM & Generative AI Applications (which has evolved beyond its initial 2025 edition). SECURITY_TRAINING_GUIDE.md:87 Update the web application reference to “OWASP Top 10:2025”, and cite the current “OWASP Top 10 for LLM & Generative AI Applications” rather than hardcoding legacy 2021 or interim 2025 AI labels.
EU AI Act cited without its phased timeline The Act entered into force in August 2024, and its enforcement roadmap incorporates the 2026 Digital Omnibus timeline: prohibited practices (February 2, 2025 - in force), GPAI model governance (August 2, 2025 - in force), and general governance/transparency rules (August 2, 2026 - in force). Annex III standalone high-risk AI system obligations are set for December 2, 2027, and Annex I regulated-product high-risk obligations for August 2, 2028. The repo currently references the Act only generically without distinguishing enacted vs. upcoming requirements. README.md:14,16,50,93,99,114,137,204,206, COMPLIANCE.md:35, RISK_MANAGEMENT.md:178, VENDOR_SECURITY_ASSESSMENT.md:118, SECURITY_TRAINING_GUIDE.md:83, index.html:116, and diagram labels (security_framework.dot:13, risk_management.dot:21). Note: SECURITY_FRAMEWORK.md text currently lacks an AI Act match and should be aligned. Add the updated phased compliance timeline (noting live obligations for prohibited practices, GPAI, and transparency vs. 2027/2028 high-risk system milestones) to compliance docs and homepage content, and ensure diagrams and SECURITY_FRAMEWORK.md are aligned.
Ruby/Jekyll toolchain & GitHub Pages compatibility Gemfile pins jekyll "~> 4.3.0". Because this repository deploys via GitHub Pages without a custom GitHub Actions CI/CD deployment workflow, upgrading gems to arbitrary latest stable releases is not a simple mechanical change: local bundle exec jekyll build passes do not guarantee GitHub Pages runtime compatibility. Gemfile, Gemfile.lock Verify pinned gems against the official GitHub Pages supported dependency set (or evaluate migrating to a GitHub Actions-based deployment workflow) before bumping gem versions.

3. Structural/copy issues found during the review (not tech-stack, but worth fixing alongside)

Remediation Plan

Work is sequenced so that objective, low-risk factual corrections land first, and interpretive/content-judgment updates land later with review.

Phase 1 — Factual vendor/product corrections [COMPLETED]

Find-and-replace executed across all affected files:

Phase 2 — Version/standards currency updates [COMPLETED]

Phase 3 — Structural cleanup [COMPLETED]

Phase 4 — Toolchain hygiene and GitHub Pages compatibility [COMPLETED]

Out of Scope / Not Flagged

The fedramp-30-days/ directory (control checklist, AWS services reference, 30-day roadmap) was reviewed and found to be internally consistent and grounded in real, currently-valid AWS service names and NIST 800-53 control IDs — no stale product names were found there. It already carries an explicit disclaimer to check fedramp.gov/marketplace for current authorization status, which is the right pattern; no changes recommended.

Document Version: 2.0 Updated: 2026-09-22 (All Phase 1–4 items executed and verified)