The three month delay in new vendor security requirements is unlikely to cause disruptions, but experts are wary of longer pauses on critical cybersecurity standards.