Cybersecurity compliance covers how you prevent, detect, report and recover from attacks. It mixes voluntary frameworks that describe good practice (NIST CSF, CIS Controls) with laws that now impose duties directly on software makers and service providers (NIS2 and the Cyber Resilience Act in the EU, disclosure rules for US-listed companies).
5 items in this category
14 related from other categories
Oct 30, 2026 statuses last checked
At a glance
Cybersecurity compliance compared
How the items in this category differ on the question that matters first: do you have to, or do you choose to?
Name
Type
Mandatory or voluntary
Where it applies
Current version
NIST CSF
Framework
Voluntary framework, no official certificate
United States, used worldwide
CSF 2.0, released 26 February 2024.
CIS Controls
Framework
Voluntary framework, no official certificate
Global
CIS Controls v8.1, released in June 2024.
NIS2
Law
Mandatory by law for organizations in scope
EU and EEA, through national laws
Member states had to transpose it by 17 October 2024. Several transposed late, so national laws are still arriving.
Cyber Resilience Act
Regulation
Mandatory for regulated organizations in scope
EU market
In force since 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026; the remaining obligations from 11 December 2027.
SEC cybersecurity rules
Regulation
Mandatory for regulated organizations in scope
United States (companies registered with the SEC)
Adopted July 2023. Form 8-K Item 1.05 incident disclosure has applied since 18 December 2023 for most registrants.
Directory
What each one covers and who needs it
Framework United States, used worldwide
NIST Cybersecurity Framework
NIST Cybersecurity Framework (CSF) 2.0
The NIST Cybersecurity Framework is a voluntary framework that helps any organization understand and reduce cybersecurity risk. Version 2.0 organizes outcomes into six functions (Govern, Identify, Protect, Detect, Respond and Recover), broken into categories and subcategories, with profiles to describe current and target states and tiers to describe rigor. It does not prescribe controls; it points to references such as NIST SP 800-53, ISO 27001 and CIS Controls. There is no certification.
What it covers, who needs it and why
What it covers
Cybersecurity governance and risk outcomes across the organization and its supply chain, from strategy to incident recovery.
Who needs it
Organizations of any size, especially US companies, critical infrastructure and suppliers whose customers or regulators reference it.
Why it matters
It is a common language for boards, regulators and customers, and many sector rules (SEBI CSCRF among them) reuse its functions.
Key objectives
Describe current and target cybersecurity posture
Prioritize improvements by risk
Communicate risk to leadership and partners
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
US National Institute of Standards and Technology (NIST)
Center for Internet Security Critical Security Controls
The CIS Controls are a prioritized set of 18 security controls and 153 safeguards drawn from real attack data. They are grouped into three Implementation Groups: IG1 is the essential hygiene every organization should have, and IG2 and IG3 add safeguards for more complex environments and more capable attackers. They are free, prescriptive and map to NIST CSF, ISO 27001 and PCI DSS, which makes them a practical starting point for a small IT company. There is no official certification.
What it covers, who needs it and why
What it covers
Asset and software inventory, data protection, secure configuration, account and access control, vulnerability management, logging, email and browser protection, malware defenses, backup, network defenses, awareness training, service providers, application security, incident response and penetration testing.
Who needs it
IT teams that want a concrete, ordered to-do list, and companies whose cyber insurers or customers reference it.
Why it matters
It turns broad frameworks into specific safeguards in priority order, so limited budgets go to what stops most attacks.
Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union
NIS2 is the EU directive that sets cybersecurity risk management and incident reporting duties for medium and large organizations in 18 critical sectors. Digital infrastructure and ICT service management are among them, so cloud providers, data centers, managed service providers and managed security providers are directly in scope. Entities must take risk management measures, report significant incidents (early warning within 24 hours), and their management bodies must approve measures and take training. Fines reach 10 million euros or 2% of turnover for essential entities.
What it covers, who needs it and why
What it covers
Network and information systems of essential and important entities, including supply chain security, incident handling, continuity, encryption and access control.
Who needs it
Medium and large companies in listed sectors in the EU, including cloud, data center, managed service and managed security providers, and some digital providers regardless of size.
Why it matters
It makes executives personally accountable and brings many IT providers under a regulator for the first time.
Key objectives
Raise a common baseline of cybersecurity
Require fast incident reporting
Hold management bodies accountable
Address supply chain risk
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
European Union; enforced by national competent authorities
Current version
Member states had to transpose it by 17 October 2024. Several transposed late, so national laws are still arriving.
Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements
The Cyber Resilience Act sets cybersecurity requirements for hardware and software products with digital elements sold in the EU. Manufacturers must design products to essential security requirements, handle vulnerabilities for the support period, provide security updates, document a software bill of materials, and carry a CE mark. Since 11 September 2026 they must report actively exploited vulnerabilities and severe incidents to ENISA's single reporting platform within 24 hours. Pure SaaS is mostly covered by NIS2 instead, except where it is remote data processing for a product.
What it covers, who needs it and why
What it covers
Software and connected products placed on the EU market, from design and vulnerability handling to updates, documentation and conformity assessment.
Who needs it
Manufacturers, importers and distributors of software and connected devices for the EU market, including non-EU software publishers.
Why it matters
It is the first EU law to put security-by-design duties on software makers, with fines up to 15 million euros or 2.5% of turnover.
Key objectives
Ship products with fewer vulnerabilities
Keep products secure through their support period
Give users clear security information
Report exploited vulnerabilities fast
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; market surveillance authorities and ENISA
Current version
In force since 10 December 2024. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026; the remaining obligations from 11 December 2027.
Regulation United States (companies registered with the SEC)
SEC cybersecurity disclosure rules
US Securities and Exchange Commission rules on cybersecurity risk management, strategy, governance and incident disclosure
The SEC's 2023 rules require public companies to disclose material cybersecurity incidents on Form 8-K, generally within four business days of deciding an incident is material, and to describe their cybersecurity risk management, strategy and governance every year in Form 10-K. The rules do not prescribe controls, but they force a documented process for judging materiality and board oversight. IT vendors feel them through customers who now ask about incident notice timelines.
What it covers, who needs it and why
What it covers
Disclosure of material incidents, processes to assess and manage cyber risk, management's role and the board's oversight.
Who needs it
Companies listed in the US, including foreign private issuers (on Forms 6-K and 20-F), and indirectly their technology suppliers.
Why it matters
Late or misleading disclosure exposes the company and its officers to SEC enforcement.
Key objectives
Give investors timely incident information
Standardize disclosure of cyber governance
Push board-level oversight of cyber risk
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
US Securities and Exchange Commission (SEC)
Current version
Adopted July 2023. Form 8-K Item 1.05 incident disclosure has applied since 18 December 2023 for most registrants.
Information security management systems: requirements
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It asks you to define a scope, assess information security risks, choose controls to treat them (Annex A lists 93), and keep improving through internal audits and management review. Accredited certification bodies audit against it and issue a three-year certificate with yearly surveillance audits. It is voluntary, but enterprise and public sector buyers often require it.
What it covers, who needs it and why
What it covers
Governance of information security: risk assessment and treatment, policies, roles, people, physical and technical controls, supplier security, incident management, continuity and continual improvement.
Who needs it
Software and SaaS companies, IT service and managed service providers, data centers and any organization whose customers ask for independent proof of security.
Why it matters
It is the most widely recognized security certificate in tenders and vendor questionnaires outside the US, and its risk-based structure is the base that ISO 27701, 27017, 27018 and 42001 build on.
Key objectives
Identify and treat information security risks in a defined scope
Select and justify controls in a Statement of Applicability
Prove the system works through internal audit and management review
Improve continually and correct nonconformities
Mandatory or voluntary
Voluntary, with independent certification.
Owner
ISO and IEC (JTC 1/SC 27)
Current version
ISO/IEC 27001:2022 with Amendment 1:2024. Certificates to the 2013 edition expired on 31 October 2025.
ISO/IEC 27002 is the companion guidance to ISO 27001. It describes each of the 93 information security controls in detail: the purpose, how to implement it and what to consider. The 2022 edition groups the controls into four themes (organizational, people, physical and technological) and adds attributes so you can sort them by purpose. You cannot be certified to ISO 27002; you use it to implement the Annex A controls of ISO 27001 well.
What it covers, who needs it and why
What it covers
Implementation guidance for 37 organizational, 8 people, 14 physical and 34 technological controls, including threat intelligence, cloud services, secure coding and data masking.
Who needs it
Teams implementing ISO 27001, security leads writing policies, and anyone mapping controls between frameworks.
Why it matters
Auditors read Annex A controls with ISO 27002 in mind, so it tells you what a reasonable implementation of each control looks like.
Key objectives
Explain the intent of each control
Give practical implementation guidance
Let organizations filter controls by attribute (control type, security property, concept)
UK government-backed certification of five basic technical security controls
Cyber Essentials is a UK government-backed scheme that certifies five technical controls against common internet attacks: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment. Cyber Essentials Plus adds a hands-on technical audit by an assessor. Certificates last 12 months. Many UK central government contracts that handle personal or sensitive information require it.
What it covers, who needs it and why
What it covers
Internet-connected devices, servers, cloud services and user accounts within the scope you define, against five technical control areas.
Who needs it
Any organization selling to UK government, and UK businesses whose customers or insurers ask for a baseline security certificate.
Why it matters
It is cheap and quick compared with ISO 27001, and for some UK public contracts it is a bid requirement.
Key objectives
Block common, low-skill internet attacks
Set a verifiable security baseline
Give buyers a simple yes or no check
Mandatory or voluntary
Voluntary, with independent certification.
Owner
UK National Cyber Security Centre (NCSC), delivered through IASME
Current version
Requirements for IT Infrastructure v3.3 with the "Danzell" question set, used for assessments from April 2026.
Open Worldwide Application Security Project Top 10 web application security risks
The OWASP Top 10 is an awareness document listing the most critical security risks to web applications, based on data from real applications and a community survey. It is updated every few years; the 2025 edition keeps broken access control at the top and adds software supply chain failures. It is not a standard and cannot be certified, but PCI DSS, customers and penetration testers use it as the minimum set of risks your developers must understand and test for.
What it covers, who needs it and why
What it covers
Access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and error handling.
Who needs it
Every team that builds web applications or APIs, and the security testers and buyers who assess them.
Why it matters
It is the shared baseline for secure coding training and application security testing.
Software bill of materials (SPDX, CycloneDX) and supply chain frameworks such as SLSA
A software bill of materials (SBOM) is a machine-readable list of the components inside a piece of software, usually in the SPDX or CycloneDX format. It lets producers and customers find affected products quickly when a vulnerability appears in a library. Supply chain frameworks such as SLSA add levels of build integrity and provenance. The EU Cyber Resilience Act requires manufacturers to draw up an SBOM, and US federal buyers increasingly ask for one.
What it covers, who needs it and why
What it covers
Component inventory, dependency management, build provenance, signing and vulnerability response for third-party and open source code.
Who needs it
Software publishers, SaaS companies that ship agents or on-premises editions, and teams that rely heavily on open source.
Why it matters
Supply chain attacks and library vulnerabilities are now among the top application risks, and regulators expect you to know what you ship.
Key objectives
Know every component you ship
Prove build integrity
Respond fast to component vulnerabilities
Mandatory or voluntary
Voluntary guidance, no official certificate.
Owner
CISA, NTIA guidance, the Linux Foundation (SPDX), OWASP (CycloneDX) and OpenSSF (SLSA)
Current version
SBOM duties appear in the EU Cyber Resilience Act and in US federal software procurement.
Regulation EU financial sector and its ICT providers
DORA
Digital Operational Resilience Act, Regulation (EU) 2022/2554
DORA sets a single set of digital operational resilience rules for EU banks, insurers, investment firms, payment institutions and other financial entities. It requires an ICT risk management framework, classification and reporting of major ICT incidents, resilience testing (including threat-led penetration testing for larger firms), and close management of ICT third-party risk, with mandatory contract terms. ICT providers designated as critical are overseen directly by EU supervisors.
What it covers, who needs it and why
What it covers
ICT risk management, incident reporting, testing, third-party contracts and the register of ICT providers, plus oversight of critical ICT providers.
Who needs it
EU financial entities, and every IT, cloud and SaaS vendor that supports their critical or important functions.
Why it matters
Financial customers must put DORA contract terms, audit rights and exit plans into vendor agreements.
Key objectives
Withstand and recover from ICT disruption
Report major incidents consistently
Control dependence on ICT providers
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
European Union; national financial supervisors and the European Supervisory Authorities
Current version
Applies from 17 January 2025. The first list of critical ICT third-party providers was designated in late 2025.
New York Department of Financial Services cybersecurity requirements, 23 NYCRR Part 500
Part 500 requires banks, insurers and other businesses licensed by New York DFS to run a cybersecurity program based on a risk assessment, with a CISO, written policies, access controls including multi-factor authentication, an asset inventory, encryption, incident response and continuity plans, annual security awareness training and third-party service provider policies. Covered entities report cybersecurity events within 72 hours and certify compliance each year by 15 April. Vendors feel it through contract requirements.
What it covers, who needs it and why
What it covers
Information systems and nonpublic information of DFS-licensed entities, and the service providers they rely on.
Who needs it
DFS-licensed financial services firms and the IT and SaaS providers that serve them.
Why it matters
DFS actively enforces it, and the annual certification is signed by the CEO and CISO.
Key objectives
Protect nonpublic information
Ensure governance and accountability
Require timely incident notice
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
New York State Department of Financial Services (DFS)
Current version
Second amendment adopted November 2023; the last phased requirements took effect on 1 November 2025.
Information Technology Act, 2000 (India), as amended in 2008, with the SPDI Rules 2011
The IT Act 2000 is India's core law on electronic records, digital signatures, cybercrime and intermediaries. It gives legal recognition to electronic records and signatures, defines offences such as hacking, identity theft and data theft, gives CERT-In its powers under Section 70B, and sets the safe harbor and due diligence conditions for intermediaries under Section 79. Until the DPDP Act fully commences, Section 43A and the SPDI Rules 2011 require reasonable security practices for sensitive personal data.
What it covers, who needs it and why
What it covers
Electronic records and signatures, cyber offences and penalties, intermediary liability, government powers to block, intercept and direct, and (for now) sensitive personal data security.
Who needs it
Every IT company, platform and intermediary operating in India.
Why it matters
It is the base under CERT-In directions, the IT Rules 2021 and many sector rules.
Key objectives
Legal validity for electronic commerce
Define and punish cyber offences
Set intermediary duties and protections
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
Parliament of India; MeitY
Current version
As amended by the IT (Amendment) Act 2008. Section 43A and the SPDI Rules 2011 fall away once the DPDP Act fully commences.
Directions under Section 70B(6) of the IT Act relating to information security practices, procedure, prevention, response and reporting of cyber incidents (28 April 2022)
The CERT-In Directions apply to service providers, intermediaries, data centers, body corporates and government bodies. They require reporting of listed cyber incidents to CERT-In within 6 hours of noticing them, keeping ICT system logs for a rolling 180 days within India, synchronizing clocks to national NTP servers, and naming a point of contact. Data centers, VPS, cloud and VPN providers must also keep subscriber records for five years. They are among the strictest incident reporting timelines anywhere.
What it covers, who needs it and why
What it covers
Cyber incident reporting, log retention, time synchronization, points of contact and subscriber records for certain providers.
Who needs it
Practically every company with IT systems in India, including SaaS companies, data centers, cloud and hosting providers.
Why it matters
Non-compliance is punishable under Section 70B(7), and the 6-hour clock needs a tested process.
Key objectives
Fast national visibility of cyber incidents
Logs available for investigation
A named contact in every organization
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Indian Computer Emergency Response Team (CERT-In), MeitY
Current version
Directions dated 28 April 2022, in force since June 2022, with FAQs. CERT-In issued Comprehensive Cyber Security Audit Policy Guidelines in July 2025.
Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities
SEBI's CSCRF replaces earlier cybersecurity circulars with one framework for stock exchanges, depositories, brokers, mutual funds, portfolio managers and other regulated entities. It sorts entities into categories by size and importance and sets standards across the governance, identify, protect, detect, respond and recover functions, including a security operations center, periodic VAPT, cyber audits and incident reporting. Third-party service providers, including IT vendors, must meet requirements passed down through contracts.
What it covers, who needs it and why
What it covers
Cyber governance, risk, security controls, monitoring, incident response and recovery for SEBI-regulated entities and their technology providers.
Who needs it
Indian securities market entities and the software, cloud and managed security providers that serve them.
Why it matters
It is mandatory for regulated entities and audited, and vendors must support evidence requests.
Key objectives
Cyber resilience across the securities market
Proportional controls by category
Regular testing and audit
Mandatory or voluntary
Mandatory for regulated organizations in scope.
Owner
Securities and Exchange Board of India (SEBI)
Current version
Circular of 20 August 2024, with compliance deadlines extended into 2025 and later clarifications.
Law United States (federal agencies and their contractors)
FISMA
Federal Information Security Modernization Act of 2014
FISMA requires every US federal agency to run an agency-wide information security program and report on it each year. In practice it is implemented through the NIST Risk Management Framework (SP 800-37) and the SP 800-53 controls, with systems authorized to operate before use. Contractors that operate federal systems or handle federal information on an agency's behalf are bound through their contracts, which is why federal IT contracts carry FISMA language.
What it covers, who needs it and why
What it covers
Federal information and information systems, including those run by contractors for agencies.
Who needs it
Federal agencies and the IT contractors and service providers that run systems for them.
Why it matters
An authority to operate is needed before a federal system goes live.
Key objectives
Agency-wide security programs
Risk-based authorization of systems
Annual reporting and oversight
Mandatory or voluntary
Mandatory by law for organizations in scope.
Owner
US Congress; OMB, CISA and NIST
Current version
FISMA 2014, implemented through OMB guidance and NIST standards.
Security and Privacy Controls for Information Systems and Organizations
NIST SP 800-53 is the catalog of security and privacy controls used for US federal information systems and, through FedRAMP and FISMA, for their contractors. Revision 5 contains 20 control families, from access control and audit to supply chain risk management, with baselines (low, moderate, high and privacy) set in SP 800-53B. It is mandatory for federal systems and widely reused by states, regulators and companies as a detailed control library. Release 5.2.0 updated controls on software updates and patching.
What it covers, who needs it and why
What it covers
Technical, operational and management controls across 20 families, plus privacy controls and control enhancements.
Who needs it
Federal agencies, FedRAMP cloud providers, federal contractors, and organizations that want a detailed control catalog.
Why it matters
It is the control language of US government security and the basis of FedRAMP baselines.
Key objectives
Protect federal systems and information
Give a common control catalog
Support risk-based tailoring
Mandatory or voluntary
Voluntary framework, no official certificate.
Owner
NIST
Current version
Revision 5, release 5.2.0 (August 2025). Baselines are in SP 800-53B.
Contract requirement United States (federal contractors)
NIST SP 800-171
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
NIST SP 800-171 sets security requirements for protecting controlled unclassified information (CUI) in contractor systems. Revision 2 has 110 requirements in 14 families; Revision 3 reorganizes them into 97 requirements in 17 families with organization-defined parameters. Defense contractors are required to implement it by DFARS clause 252.204-7012, report a self-assessment score in SPRS, and, under CMMC, prove it through assessment. Other agencies are moving toward similar requirements.
What it covers, who needs it and why
What it covers
Contractor information systems that process, store or transmit CUI, including cloud services they use for CUI.
Who needs it
Defense and federal contractors and subcontractors handling CUI, including IT and software providers in the supply chain.
Why it matters
False compliance claims have led to False Claims Act settlements, and CMMC makes it a condition of award.
Key objectives
Protect CUI outside federal systems
Give contractors one requirement set
Enable verification through assessment
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
NIST; required through DFARS 252.204-7012 and other contract clauses
Current version
Revision 3 (May 2024) is current at NIST; DoD contracts and CMMC Level 2 still assess against Revision 2 under a class deviation.
Contract requirement United States (Department of Defense supply chain)
CMMC 2.0
Cybersecurity Maturity Model Certification program (32 CFR Part 170)
CMMC verifies that defense contractors protect federal contract information and CUI. Level 1 covers 15 basic safeguarding requirements with an annual self-assessment. Level 2 covers the 110 NIST SP 800-171 Rev. 2 requirements, assessed every three years either by the contractor or by an authorized third-party assessor (C3PAO), as the contract specifies. Level 3 adds requirements from SP 800-172, assessed by the government. Since November 2025, contracts can make a CMMC status a condition of award, phased in over three years.
What it covers, who needs it and why
What it covers
Contractor systems that handle federal contract information or CUI, and flow-down to subcontractors.
Who needs it
Every company in the US defense industrial base supply chain, including software, IT and managed service providers.
Why it matters
Without the required CMMC status, a contractor cannot win or keep covered DoD contracts.
Key objectives
Verify contractor cybersecurity
Protect FCI and CUI
Hold the supply chain to one standard
Mandatory or voluntary
Mandatory once a contract, card brand or government buyer requires it.
Owner
US Department of Defense (DoD CIO); assessments by C3PAOs and DIBCAC
Current version
Program rule effective December 2024; the DFARS contract rule took effect 10 November 2025 (phase 1). Phase 2, requiring C3PAO Level 2 assessments where specified, starts 10 November 2026.
Most of these frameworks expect trained staff and records to prove it. LMS Advisor assigns the right courses by role, sends reminders, renews certificates on schedule and keeps an audit trail you can export.
Due dates, reminders and overdue reports for mandatory courses
Certificates that expire and renew on your retraining cycle
CSV, Excel and PDF exports of who completed what, and when
LMS Advisor is our product. It runs your training and keeps the records. It does not certify you against any standard.
Book a demo before Dec 1, 2026 and your quote comes with 30% off your first year of LMS Advisor: courses, proctored exams, certificates and AI authoring in one platform, in our cloud or on your own server.
Offer ends Dec 1, 2026, 11:59 PM ET
Cloud or self-hosted, proctoring included
The discount is applied in your written quote
We use cookies to see how visitors use this site and to measure our ads. Choose Continue to allow them, or Reject to browse without them. Privacy policy
LMS Advisor AI
AI product consultant
You're chatting with an AI. Answers can be wrong, so please don't type personal data here. Privacy ·
