The agency has finalized the framework’s first major update since its creation in 2014