Cyber Compliance Authority - Cybersecurity Compliance Reference

Cybersecurity compliance spans a dense matrix of federal statutes, sector-specific regulations, state-level mandates, and international standards that organizations across every industry must navigate to protect data, systems, and critical infrastructure. This page maps the regulatory landscape, explains how compliance frameworks operate in practice, identifies the scenarios where specific obligations arise, and clarifies the boundaries that determine which rules apply to which entities. The Cyber Compliance Authority network exists to make that landscape legible through reference-grade resources organized by geography, technology domain, and compliance vertical.

Definition and scope

Cybersecurity compliance is the organizational process of satisfying documented requirements — statutory, regulatory, or contractual — that govern how digital systems, data, and networks must be protected. It is distinct from general security practice: compliance imposes externally defined, enforceable obligations with specific timelines, evidence requirements, and penalty structures, whereas a security program may be internally designed and voluntary.

The scope of applicable obligations is determined by four primary variables:

1. Industry sector — Healthcare entities subject to the Health Insurance Portability and Accountability Act (HIPAA, 45 C.F.R. Parts 160 and 164) face requirements that differ structurally from financial institutions subject to the Gramm-Leach-Bliley Act (GLBA, 15 U.S.C. §§ 6801–6809) or defense contractors subject to the Cybersecurity Maturity Model Certification (CMMC) program administered by the U.S. Department of Defense (DoD CMMC).
2. Data type — Organizations that process payment card data must satisfy the Payment Card Industry Data Security Standard (PCI DSS), a contractual requirement enforced through card-brand agreements (PCI Security Standards Council).
3. Geography — State breach-notification laws, including the California Consumer Privacy Act (CCPA, Cal. Civ. Code §§ 1798.100–1798.199), impose obligations that vary by the residency of affected individuals, not just the location of the organization.
4. Federal designation — Critical infrastructure sectors defined under Presidential Policy Directive 21 (PPD-21) face sector-specific cybersecurity requirements tied to sector risk management agencies.

The National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), now at version 2.0, provides a widely referenced voluntary baseline that many compliance programs map against. NIST SP 800-53, Revision 5, catalogues 20 control families for federal information systems and serves as the technical substrate for the Federal Information Security Modernization Act (FISMA) compliance regime.

For a full glossary of terms used across these frameworks, the Cybersecurity Terminology and Definitions reference page provides structured definitions aligned to NIST and CISA sources.

How it works

Compliance programs operate through a repeating cycle of scoping, assessment, remediation, documentation, and audit. The following breakdown reflects the structure codified in frameworks such as NIST SP 800-37 (Risk Management Framework) and ISO/IEC 27001:

1. Scope determination — Identify which systems, data flows, and third-party relationships fall within the regulatory boundary. For HIPAA, this means identifying all electronic protected health information (ePHI) touchpoints. For PCI DSS 4.0, it means defining the cardholder data environment (CDE).
2. Gap analysis — Compare the current control posture against required controls. NIST SP 800-171, which governs Controlled Unclassified Information (CUI) in non-federal systems, contains 110 security requirements organized across 14 families; a gap analysis identifies which of the 110 requirements are not yet satisfied.
3. Remediation planning — Assign ownership, timelines, and budgets to close identified gaps. CISA's Known Exploited Vulnerabilities (KEV) catalog (CISA KEV) provides mandatory remediation deadlines for federal agencies and recommended timelines for critical infrastructure operators.
4. Control implementation — Deploy technical and administrative controls. Technical controls include encryption, access management, and logging; administrative controls include policies, training, and vendor agreements.
5. Evidence collection — Assemble documentation — system configurations, audit logs, training records, penetration test reports — required by auditors or assessors. SOC 2 Type II audits, governed by AICPA Trust Services Criteria, require evidence spanning a minimum 6-month observation period.
6. Assessment or audit — An independent or third-party assessor evaluates whether controls meet requirements. FISMA requires annual assessments for federal systems; CMMC Level 2 requires triennial third-party assessments by a CMMC Third-Party Assessment Organization (C3PAO).
7. Continuous monitoring — Post-audit surveillance maintains compliance posture between formal assessment cycles. NIST SP 800-137 defines Information Security Continuous Monitoring (ISCM) as the operational standard for federal agencies.

The Cyber Audit Authority covers audit methodology, assessor qualification requirements, and the documentation standards that auditors apply across FISMA, SOC 2, and ISO 27001 engagements — making it an essential reference for organizations preparing for formal assessments.

The Cloud Compliance Authority addresses the added complexity that arises when compliance scope extends into cloud environments, including shared-responsibility model implications under FedRAMP, which requires cloud service providers to obtain an Authority to Operate (ATO) from a federal agency or a Joint Authorization Board (JAB) Provisional ATO.

For a conceptual walkthrough of how cybersecurity controls function before compliance obligations are layered on, the How Cybersecurity Works: Conceptual Overview page provides that foundational context.

Common scenarios

Scenario 1 — Healthcare provider implementing HIPAA Security Rule controls

A regional hospital network with 12 affiliated clinics must implement administrative, physical, and technical safeguards under the HIPAA Security Rule (45 C.F.R. § 164.300–318). Required addressable specifications include encryption of ePHI in transit and at rest. The Office for Civil Rights (OCR) at HHS, which enforces HIPAA, assessed penalties totaling $135.3 million between 2003 and 2022 (HHS OCR Enforcement Highlights). The Data Security Authority provides framework-level reference on data classification and protection controls applicable to healthcare and other regulated data environments.

Scenario 2 — Defense contractor pursuing CMMC Level 2 certification

A manufacturer supplying components to the U.S. Air Force must demonstrate compliance with all 110 practices in NIST SP 800-171 to achieve CMMC Level 2 certification, a prerequisite for contract award under applicable Defense Federal Acquisition Regulation Supplement (DFARS) clauses. The Advanced Security Authority covers the hardened control environments and advanced threat detection architectures that CMMC Level 2 and Level 3 assessments evaluate.

Scenario 3 — Financial institution addressing GLBA Safeguards Rule

The FTC's updated Safeguards Rule (16 C.F.R. Part 314), which took full effect in June 2023, requires non-banking financial institutions to implement a written information security program with 9 specific elements, including annual penetration testing and bi-annual vulnerability assessments (FTC Safeguards Rule). The Penetration Testing Authority details the methodologies, scoping criteria, and reporting standards that satisfy regulatory penetration testing mandates across GLBA, PCI DSS, and CMMC contexts.

Scenario 4 — Multi-state retailer managing breach notification obligations

A retailer operating in 48 states that experiences a breach affecting payment records must navigate breach-notification laws that vary in timing (72 hours under GDPR for EU residents; 30–90 days in most U.S. state statutes), notification content, and exemption thresholds. The California Security Authority addresses California's layered framework combining CCPA, Cal. Civ. Code § 1798.82 (breach notification), and SB 1386 obligations. The New York Security Authority covers New York's SHIELD Act and the Department of Financial Services Cybersecurity Regulation (23 NYCRR 500), which imposes specific technical controls on covered financial entities.

Scenario 5 — Cloud-native SaaS provider pursuing FedRAMP authorization

A software vendor seeking to sell to federal agencies must complete FedRAMP authorization, which requires selection of a security baseline (Low, Moderate, or High) mapped to NIST SP 800-53 controls, engagement of a FedRAMP-approved Third-Party Assessment Organization (3PAO), and continuous monitoring reporting. The Cloud Security Authority covers cloud-specific security architectures, and the Cloud Defense Authority addresses the defensive controls that satisfy FedRAMP Moderate and High baseline requirements.

Scenario 6 — Ransomware incident triggering reporting obligations

Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), covered entities must report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours (final rules pending as of 2024). The [Rans