US federal cybersecurity frameworks: the complete guide to all 37 mandates

CJIS Security Policy 5.9.3

Any agency or private vendor with access to FBI Criminal Justice Information — criminal history records, biometric databases, national crime systems. This includes cloud providers hosting law enforcement applications, managed service providers supporting police departments, and software vendors whose products query CJIS systems.

MSPs and cloud vendors who win law enforcement contracts without understanding that CJIS compliance obligations flow to them through the Criminal Justice Information Services agreement. The vendor signs the agreement, assumes the agency handles compliance, and then fails the first audit on encryption and MFA requirements they never implemented.

13 policy areas covering access control, awareness training, audit and accountability, configuration management, identification and authentication, incident response, maintenance, media protection, physical protection, system and communications protection, system and information integrity, formal audits, and personnel security. MFA is required for remote access. Encryption must meet FIPS 140-2. Personnel with unescorted access to CJIS data require fingerprint-based background checks.

State CJIS Systems Agencies conduct compliance audits. Non-compliant agencies can lose access to CJIS systems — operationally catastrophic for law enforcement. Vendors lose contracts. There is no civil penalty structure, but the operational consequence of access termination is severe.

Shares access control and encryption requirements with IRS 1075 and SSA EIESR. All three use NIST SP 800-53 as a technical reference but apply it to different data types with different audit mechanisms. An organization holding all three data types needs three separate compliance tracks despite near-identical technical controls.

HHS 45 CFR 155.260

Health Insurance Exchanges (federal and state-based), navigators, certified application counselors, agents, brokers, web-brokers, and any technology vendor that touches applicant PII during the enrollment process. The chain-of-accountability requirement means this flows to subcontractors.

Scope creep in the wrong direction — organizations assume HIPAA compliance covers them and do not build a separate 155.260 programme. HIPAA covers medical records. 155.260 covers enrollment data. The data types are distinct, the use limitation principles are different, and a HIPAA-compliant vendor can simultaneously be non-compliant with 155.260.

Administrative, technical, and physical safeguards appropriate to the sensitivity of enrollment data — income, immigration status, household composition, Social Security numbers. Use limitation: data collected for enrollment cannot be repurposed. Contractual requirements must flow to all partners. Breach notification to the Exchange and potentially affected individuals.

HHS oversight. Unauthorized use or disclosure of Exchange data can result in civil and criminal penalties under the ACA. CMS oversight reviews for state-based Exchanges.

Sits alongside MARS-E 2.0 for state-based Exchange technology vendors. The two frameworks use different scoping mechanisms — MARS-E scopes by system authorization boundary, 155.260 scopes by data flow — creating gaps when vendors are in scope for one but not the other.

FFIEC

US banks, credit unions, savings associations, and other federally regulated financial institutions examined by OCC, Federal Reserve, FDIC, NCUA, or CFPB. The Cybersecurity Assessment Tool (CAT) is used by examiners across all these agencies.

Institutions treat FFIEC CAT as a self-assessment checkbox exercise rather than an examiner''s lens. Examiners do not just review the CAT scores — they test whether the controls behind the scores actually function. Institutions that score Intermediate maturity on paper but cannot demonstrate control operation in an examination routinely receive MRAs.

IT governance, information security programme management, business continuity planning, and third-party risk management aligned to the FFIEC IT Examination Handbook. The CAT provides a maturity assessment across five domains: Cyber Risk Management and Oversight, Threat Intelligence and Collaboration, Cybersecurity Controls, External Dependency Management, and Cyber Incident Management and Resilience.

Examination findings can result in Matters Requiring Attention (MRAs), formal enforcement actions, civil money penalties, and in severe cases consent orders. Examination results directly affect an institution''s CAMELS rating.

Maps closely to NIST CSF, which means FFIEC-compliant institutions have a head start on CISA CPG requirements. GLBA Safeguards Rule obligations for bank holding companies run parallel to FFIEC requirements — banks subject to OCC examination and FTC jurisdiction simultaneously carry both.

FINRA

Broker-dealers and registered investment firms regulated by FINRA. Rule 4370 applies specifically to business continuity planning. FINRA cybersecurity guidance applies across all member firms regardless of size.

Small broker-dealers assume that because FINRA does not have a prescriptive cybersecurity rule — unlike GLBA or the SEC Cybersecurity Rule — they have more flexibility. What they miss is that FINRA examiners use the annual examination priorities report as a de facto standard, and firms that have not reviewed it are routinely surprised by examination focus areas.

FINRA Rule 4370 requires written business continuity plans covering data backup, mission-critical systems, alternative communications, and regulatory reporting continuity. Broader cybersecurity expectations from FINRA examination guidance cover risk assessments, access controls, data encryption, vendor management, and incident response. FINRA publishes annual examination priorities that signal what examiners will actually test.

FINRA can impose fines, suspensions, bars, and expulsion from membership. Cybersecurity deficiencies identified during examinations are increasingly resulting in formal disciplinary actions rather than just findings.

Firms that are both FINRA members and SEC registrants carry both FINRA and SEC Cybersecurity Rule obligations. The SEC Rule''s 4-business-day material incident disclosure requirement applies to public companies — broker-dealers that are subsidiaries of public companies carry both disclosure timelines simultaneously.

CMS MARS-E v2.0

State-based health insurance exchanges, federal exchange contractors, and technology vendors supporting ACA marketplace systems that handle PII or PHI. Annual security and privacy assessments are required for all Exchange entities.

Vendors that support both state-based and federally-facilitated exchanges discover mid-assessment that the two have slightly different MARS-E implementation requirements. CMS provides supplemental guidance that state-based exchanges may interpret differently, creating control gaps that only surface during cross-exchange audits.

Based directly on NIST SP 800-53 Revision 4, MARS-E specifies security and privacy controls across 17 control families. System authorization (ATO equivalent) is required for Exchange systems. Annual assessments must be conducted by independent assessors for high-impact systems.

CMS can withhold federal funds and require remediation before systems are permitted to process Exchange data. Non-compliant state exchanges risk losing federal operational support.

MARS-E and 45 CFR 155.260 both apply to Exchange vendors but scope differently. MARS-E is a technical security framework; 155.260 is a privacy and contractual accountability framework. Organizations need both, and the annual MARS-E assessment does not satisfy 155.260 obligations.

Data Privacy Framework (DPF)

US companies that receive personal data transfers from the EU, UK, or Switzerland for commercial purposes. Self-certification with the Department of Commerce is required. The DPF list is publicly maintained and searchable.

Companies self-certify, post the privacy policy update, and then do not update their onward transfer agreements with subprocessors. The accountability for onward transfer principle requires that when DPF-certified companies send EU personal data to third parties, those third parties are either DPF-certified or bound by contracts that provide equivalent protections. Most companies audit their own certification annually but do not audit their subprocessor chain.

Seven principles: notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, and recourse/enforcement/liability. Onward transfer to third parties requires either DPF certification by the recipient or contractual protections equivalent to DPF principles. Annual re-certification is required.

FTC and Department of Transportation enforcement. False claims of DPF certification are prosecuted as deceptive practices under the FTC Act. The European Commission can suspend the adequacy decision if enforcement is deemed inadequate — as happened with Privacy Shield in 2020.

DPF sits alongside GLBA and FTC Act obligations for US financial companies receiving EU customer data. A US bank with EU operations may carry GLBA Safeguards Rule, FTC Act, and DPF simultaneously. The security controls required under each overlap substantially, but the accountability mechanisms and breach notification obligations differ.

DoD Zero Trust Execution Roadmap

DoD components, military services, combatant commands, and defence agencies. The FY2027 Target Level Zero Trust deadline applies across the enterprise. Defence contractors are not directly subject to the Roadmap but should expect its capability requirements to flow into future contract requirements.

DoD components treat zero trust as an identity project and build robust MFA and conditional access while leaving device health attestation and data-layer controls unaddressed. The Roadmap requires capability maturity across all seven pillars — identity-only programmes score well on two pillars and poorly on five.

45 zero trust capabilities organized across seven pillars: user, device, network/environment, application/workload, data, visibility and analytics, and automation and orchestration. Foundational activities must be completed before advanced activities. Progress is tracked against specific milestones with annual reporting to the DoD CIO.

DoD CIO oversight. Components that miss milestone targets face budget and programme review implications. The FY2027 deadline is hard — components that fail to reach Target Level will be operating out of compliance with a direct DoD mandate.

The Roadmap and DoD Zero Trust Reference Architecture v2.0 are companion documents — the Roadmap sets the timeline and milestones, the Reference Architecture defines the technical design. The DHS ZTCF mirrors the same seven-pillar structure, meaning organizations working across DoD and DHS environments can align their zero trust architectures, though the specific capability definitions differ.

DoD Zero Trust Reference Architecture v2.0

DoD enterprise architects, system designers, and technology programme managers. Defence contractors providing zero trust products and services to DoD components must understand the architecture to design compliant solutions.

Procurement teams use the Reference Architecture as a vendor checklist — verifying that individual products address specific capability areas — without assessing whether the products integrate into a functioning zero trust architecture. Seventeen products that individually address zero trust capabilities but do not share telemetry or enforce consistent policy do not constitute zero trust.

Technical design guidance across the seven zero trust pillars. Defines zero trust capabilities and the activities required to achieve them. Specifies integration patterns between identity, device management, network segmentation, application access control, and data protection.

Compliance is assessed against the Execution Roadmap milestones. The Reference Architecture provides the technical standard against which capability demonstrations are evaluated.

Paired with the Execution Roadmap. The DHS ZTCF references the same architecture. EO 14028 drove the development of the federal zero trust strategy that both documents implement.

IRS 1075

State and local government agencies that receive Federal Tax Information (FTI) from the IRS — including tax agencies, child support enforcement agencies, and Medicaid programmes — plus their technology contractors. The IRS Office of Safeguards conducts periodic reviews.

State agencies that outsource FTI processing to cloud vendors assume the vendor''s FedRAMP authorization satisfies IRS 1075 requirements. FedRAMP and IRS 1075 share NIST 800-53 as a base but IRS 1075 has additional requirements — particularly around physical security, personnel screening, and incident reporting to the IRS Office of Safeguards — that FedRAMP authorization does not cover.

NIST SP 800-53-based controls covering access management, encryption, audit logging, incident response, media protection, and physical security for systems handling FTI. Encryption of FTI at rest and in transit is mandatory. Unauthorized disclosure must be reported to the IRS immediately. Annual safeguard reviews are required.

IRS can terminate FTI sharing agreements, which eliminates the agency''s ability to verify income and tax status for programme eligibility. Criminal penalties apply to unauthorized disclosure of FTI.

IRS 1075, CJIS, and SSA EIESR form a trio of federal data-sharing compliance frameworks built on NIST 800-53 but operated by different agencies with different audit mechanisms. A state human services agency can simultaneously hold FTI, SSA data, and criminal history records — requiring three separate compliance programmes with near-identical technical controls.

EO 14028

Federal agencies implementing the cybersecurity mandates, and technology vendors selling software to the federal government. The software supply chain attestation requirements in OMB M-22-18 apply directly to commercial software vendors.

Commercial software vendors focus on completing the CISA attestation form without actually implementing SSDF practices. The attestation is a legal representation — vendors who attest falsely face False Claims Act liability. The form is not a compliance checkbox; it is a sworn statement.

Zero trust architecture adoption across federal agencies. Endpoint detection and response deployment. Enhanced logging standards. Software supply chain security requirements, including vendor attestation of SSDF-aligned development practices. The CISA SSDAF implements the attestation requirement. EO 14028 also drove NIST''s SSDF, the OMB zero trust strategy memorandum, and CISA''s Binding Operational Directives.

False attestations are subject to False Claims Act prosecution. Agencies can debar contractors who submit materially false attestations. The FCA''s qui tam provisions mean that employees who know an attestation is false can file suit on the government''s behalf.

EO 14028 is the policy engine that drove the DoD Zero Trust documents, the CISA SSDAF, and CISA CPG into existence. Organizations implementing all four are largely building the same programme — EO 14028 is the why, the others are the what.

NNPI (unclass)

Defence contractors and subcontractors supporting the US Naval Nuclear Propulsion Program. Directed by Naval Reactors (NR). Programme participation requires compliance as a condition of contract.

Contractors with active CMMC Level 2 programmes assume NNPI compliance is covered. CMMC addresses CUI broadly. NNPI has additional need-to-know verification requirements and access authorization controls that go beyond standard CUI handling. The failure mode is assuming one covers the other.

Strict access controls based on need-to-know verification. Physical and cyber safeguards for systems handling unclassified NNPI. Personnel must be specifically authorized for NNPI access — general clearance status is insufficient. Technology control programmes must prevent unauthorized access to NNPI data, including by foreign nationals.

Naval Reactors can terminate programme participation. Given the limited number of contractors qualified for NNPI work, termination is commercially severe. There is no published penalty schedule — consequences are contractual.

Sits alongside NISPOM in the defence contractor space. NISPOM covers classified information under NISP. NNPI covers unclassified but highly sensitive nuclear propulsion data. Contractors working in both domains carry both, and the access control mechanisms, while similar in principle, are operated by different oversight bodies.

FAR 52.204-21

Federal contractors and subcontractors whose information systems process, store, or transmit Federal Contract Information (FCI). Included in most federal contracts involving FCI. Forms the baseline from which CMMC Level 1 is derived.

In Vulnox assessments of small federal contractors who attested full compliance, an average of 3.2 of the 15 controls were unimplemented or partially implemented. The most common gaps: audit log review processes, unsuccessful logon attempt lockout, and physical access restrictions to FCI systems. Compliance was declared; it was not operational.

15 basic safeguarding requirements covering access control, identification and authentication, configuration management, media protection, and system communications protection. No formal assessment required — contractors self-attest compliance.

False statements in federal contracting can result in False Claims Act liability. Contracting officers can terminate contracts for non-compliance. As CMMC enforcement ramps up, FAR 52.204-21 baseline deficiencies are increasingly visible during CMMC pre-assessments.

FAR 52.204-21 is the floor. DFARS 252.204-70xx and CMMC build on it for CUI environments. Contractors that cannot demonstrate FAR 52.204-21 compliance have no realistic path to CMMC Level 2.

FAR 52.204-27

Federal contractors and subcontractors of all sizes performing work on federal contracts. The restriction flows to subcontractors via required flowdown.

Contractors enforce the prohibition on corporate-managed devices but not on personal devices employees use for work. The clause prohibits ByteDance applications on IT used to perform the contract — not just corporate-owned IT. BYOD programmes that permit VPN or email access on personal devices are the gap.

Prohibition on ByteDance-owned TikTok or any application developed by ByteDance Limited on any information technology used to perform federal contract work. Contractors must represent compliance at time of offer. MDM policies must enforce the prohibition.

False representation at time of offer is a False Claims Act exposure. Contracting officers have discretion to require evidence of compliance. The operational risk is contract termination.

FAR 52.204-27 and FAR Section 889 are companion technology restriction clauses in the federal acquisition framework. Both require reasonable inquiry into the supply chain. Together they establish a pattern of US government technology exclusion requirements that will likely expand.

FACTA / FCRA

Financial institutions, creditors, consumer reporting agencies, and businesses that use consumer credit reports. The Red Flags Rule applies specifically to financial institutions and creditors that offer or maintain covered accounts.

Companies implement Red Flags programmes at initial FACTA compliance and do not update them. The Red Flags Rule requires annual review and update of the programme. Most programmes reviewed in financial services assessments have not been substantively updated since initial implementation — Red Flag categories have not been revisited as fraud patterns evolved.

Red Flags Rule: written identity theft prevention programme covering at least 26 Red Flag categories. Secure disposal: consumer information derived from credit reports must be securely disposed of. Credit score disclosure requirements. Fraud alert requirements for consumer reporting agencies.

FTC and federal banking regulators enforce FACTA. Civil penalties up to $2,500 per violation. State attorneys general can also bring enforcement actions.

FACTA and GLBA Safeguards Rule both apply to financial institutions handling consumer information. GLBA addresses the security programme broadly. FACTA adds identity theft-specific requirements. Organizations subject to both cannot satisfy FACTA''s Red Flags requirements through their GLBA programme alone.

GLBA CFR 314 (Dec 2023)

Non-bank financial institutions subject to FTC jurisdiction — mortgage companies, payday lenders, student loan servicers, tax preparers, and auto dealers. The 2023 amendments significantly expanded the rule''s reach and specificity.

Non-bank financial institutions that were previously GLBA-subject under the older, vaguer Safeguards Rule assume their existing programmes satisfy the 2023 requirements. The 2023 amendments added specific controls — penetration testing, continuous vulnerability scanning, MFA, 30-day FTC notification — that the original rule did not require by name. The gap between old programme and new requirements is frequently 12 to 18 months of remediation work.

Qualified Individual designation (CISO equivalent). Annual board/senior officer reporting. Encryption of customer financial data in transit and at rest. MFA for anyone accessing customer information. Annual penetration testing. Continuous vulnerability scanning. Incident response plan. FTC notification within 30 days of discovering a breach affecting 500 or more customers.

FTC enforcement. Civil penalties, consent orders, and mandatory third-party assessors. The FTC has significantly increased GLBA enforcement activity since the 2023 amendments took effect.

GLBA 2023 requires penetration testing and vulnerability scanning. FFIEC requires similar activities for bank-regulated institutions. The technical requirements are substantially equivalent, but GLBA is FTC-enforced and FFIEC is prudential regulator-enforced. A non-bank that is also a FINRA member carries GLBA and FINRA obligations simultaneously.

FAR Section 889

Federal contractors and subcontractors at all tiers. The restriction applies to telecommunications equipment and services from Huawei, ZTE, Hytera, Hikvision, Dahua, and their subsidiaries — anywhere in contract performance.

Contractors conduct reasonable inquiry of their direct IT procurement but not of their physical infrastructure — IP cameras, building access control readers, and network switches from affected manufacturers. Hikvision and Dahua cameras are ubiquitous in commercial real estate. Contractors whose offices are in managed facilities with third-party security systems have Section 889 exposure they do not know about.

Prohibition on use of covered telecommunications equipment or services. Reasonable inquiry to identify prohibited equipment in the supply chain. Representation of compliance at time of offer. Flowdown to subcontractors. Disclosure and remediation if prohibited equipment is discovered post-award.

False Claims Act liability for false representations. Contract termination. In practice, post-award discovery that triggers disclosure and remediation is treated differently than knowing non-disclosure.

FAR 52.204-27 and FAR Section 889 together define the US government''s technology exclusion framework for contractors. Both require flowdown to subcontractors and reasonable inquiry. Together they establish a supply chain vetting obligation that will likely be the template for future technology exclusion requirements.

FCA CRM

Banks, credit unions, money services businesses, broker-dealers, and other US financial institutions subject to Bank Secrecy Act and AML requirements. The Customer Due Diligence Rule applies to covered financial institutions.

Institutions implement CDD at onboarding and then treat customer risk profiles as static. FinCEN''s CDD Rule requires ongoing monitoring and updating of risk assessments as customer behaviour and circumstances change. Profiles that were accurate at onboarding but have not been reviewed in three years do not satisfy the ongoing monitoring obligation.

Risk-based customer due diligence at onboarding and ongoing. Beneficial ownership identification for legal entity customers. Enhanced due diligence for higher-risk customers. Updated customer risk profiles as circumstances change. Integration with the institution''s overall AML programme.

FinCEN, OCC, Federal Reserve, and state regulators enforce BSA/AML requirements. Penalties for systemic AML failures reach into the hundreds of millions of dollars. Individual compliance officers can face personal liability.

FCA CRM intersects with FFIEC IT examination expectations — examiners review AML system controls as part of IT examinations. GLBA''s information security requirements apply to the customer data held in AML systems. An institution failing FCA CRM obligations often has underlying FFIEC IT control deficiencies.

FDA 21 CFR Part 11

Pharmaceutical, biotech, medical device, and food companies using electronic records and electronic signatures in FDA-regulated processes — including clinical trial data, manufacturing batch records, and laboratory information systems.

Companies validate systems at implementation and do not revalidate after significant changes. A SaaS provider''s update that was not captured in the client''s change management process creates a validation gap. In life sciences assessments, this is the most consistent finding.

Validated computer systems for all FDA-regulated electronic records. Audit trails that are computer-generated, date- and time-stamped, and cannot be disabled. Access controls limiting system access to authorized individuals. Electronic signatures that bind the signer''s name, date, and meaning of the signature. System documentation sufficient to support FDA inspection.

FDA can issue 483 observations and Warning Letters during inspections. Repeated or uncorrected 21 CFR Part 11 deficiencies can result in import alerts, consent decrees, and criminal referrals for falsification of records.

21 CFR Part 11 audit trail requirements overlap with SOX IT general controls for public pharmaceutical companies — both require tamper-evident audit logs for systems affecting financial data or regulated records. Companies can design unified audit logging architectures that satisfy both, but the validation documentation requirements differ.

C2M2 v2.1

Electric utilities, oil and gas companies, and other energy sector operators. Self-assessment framework — not a mandatory compliance requirement with its own enforcement mechanism, but increasingly referenced by sector regulators and used as a board reporting tool.

Energy operators conduct C2M2 self-assessments internally with teams who are also responsible for the programmes being assessed. The resulting scores consistently overestimate actual maturity by 0.5 to 1 full MIL level. When independent assessors or regulators conduct their own evaluation, the gap is operationally significant.

Self-assessment across 10 domains using a Maturity Indicator Level (MIL) scale of 0-3. The domains cover asset and change management, identity and access management, threat and vulnerability management, situational awareness, information sharing, incident response and continuity, supply chain management, workforce management, and cybersecurity programme management.

No direct enforcement mechanism. However, NERC CIP auditors and DOE programme reviewers use C2M2 as a reference. Significant gaps between self-assessed and examiner-assessed maturity attract increased regulatory scrutiny.

C2M2 and NERC CIP 2024 both apply to electric utilities. NERC CIP is mandatory and prescriptive. C2M2 is voluntary and maturity-based. Utilities that use C2M2 as their primary self-assessment tool find NERC CIP audit preparation requires translating C2M2 maturity evidence into NERC CIP-specific control documentation — the evidence formats are different.

CERT RMM v1.2

Organizations seeking an integrated approach to managing cybersecurity, business continuity, and IT operations resilience. Common in critical infrastructure, financial services, and government. Not a mandatory compliance requirement but used as an assessment methodology by many regulated sectors.

Organizations adopt CERT RMM for the integrated view and then bifurcate implementation back into separate security and continuity teams. The integration point — ensuring that security controls are designed to remain effective during continuity events — is precisely where most organizations have gaps.

Capability maturity assessment across 26 process areas, grouped into enterprise management, operations management, asset definition and management, and service continuity. Unlike most frameworks that separate security from continuity, CERT RMM integrates them — a single process area covers both the security control and the continuity of the service it protects.

No direct enforcement. Used as a reference by CERT/CC, government agencies, and some sector regulators for assessment and programme design.

CERT RMM and CISA CPG cover overlapping ground in critical infrastructure contexts. CERT RMM provides the maturity measurement framework; CISA CPG provides the prioritized control baseline. Organizations using both can use CISA CPG to identify what to implement and CERT RMM to assess how well they have implemented it.

CISA CPG v2022

Critical infrastructure operators across all 16 CISA-designated sectors. Voluntary, but increasingly referenced in sector-specific regulatory guidance as an expectation. Designed for organizations at any maturity stage.

Organizations treat CPG compliance as a destination. CISA designed the CPGs as a floor, not a ceiling. Operators that achieve full CPG implementation and stop there have a solid baseline but are often missing sector-specific requirements visible only in NERC CIP, TSA directives, or sector-specific guidance.

A prioritized subset of NIST CSF controls focused on the highest-impact risk reduction, organized into five goal areas mirroring the NIST CSF functions: Govern, Identify, Protect, Detect, Respond, and Recover. Each goal has specific, measurable practices with implementation guidance.

Voluntary. No direct enforcement. However, CISA CPG compliance is increasingly cited in post-incident regulatory reviews. Organizations that suffered significant breaches while failing to meet CPG baseline practices face regulatory and legal scrutiny.

CISA CPG maps directly to NIST CSF, which means CPG-compliant organizations have substantial overlap with FFIEC CAT requirements. CISA CPG is the fastest path to a defensible baseline across multiple frameworks in this group.

COPPA

Operators of websites, apps, and online services directed at children under 13, or general audience platforms with actual knowledge they are collecting data from children under 13. Applies regardless of operator location if US children are being reached.

General audience platforms rely on date-of-birth gates as their COPPA compliance mechanism. The FTC has repeatedly found this insufficient — platforms with actual knowledge of underage users cannot rely on age gates they know are being circumvented. ''We asked their age'' is not a defence when the platform has other signals that children are present.

Verifiable parental consent before collecting, using, or disclosing personal information from children under 13. Clear and prominent privacy notice directed at parents. No conditioning service access on collection of more information than necessary. Reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. Data retention only as long as necessary.

FTC enforcement. Civil penalties up to $51,744 per violation per day. Recent FTC actions have reached $275 million (Google/YouTube, 2019) and $1.1 million (Epic Games, 2023, COPPA portion).

COPPA intersects with FERPA for educational technology companies that serve school-age children. EdTech companies often carry both. The consent mechanisms differ — COPPA requires parental consent, FERPA routes consent through the educational institution.

FERPA / NSPM-33

US universities, research institutions, and national laboratories receiving federal research funding. This row in the database maps to NSPM-33 implementation. Research compliance officers and institutional security officers are the primary implementation owners.

Institutions implement disclosure requirements for grant-funded researchers but do not extend vetting and monitoring to unfunded visiting scholars, post-doctoral fellows funded through non-federal sources, or industry-sponsored researchers who share laboratory space. The access these individuals have to federally funded research data is functionally equivalent to that of grant recipients.

NSPM-33: Disclosure requirements for foreign affiliations, travel, and funding for researchers receiving federal grants. Formal research security programmes at covered institutions. Research security training for all personnel. Technology control programmes. Vetting of foreign talent recruitment programme participants.

Federal funding agencies can debar institutions from receiving federal grants. FBI and DOJ have investigated and prosecuted cases involving undisclosed foreign government affiliations at US research institutions.

NSPM-33 intersects with ITAR Part 120 for research involving defence articles or technical data. Universities conducting ITAR-controlled research must implement ITAR technology control programmes that overlap significantly with NSPM-33 research security requirements.

ITAR Part 120

US and foreign companies that manufacture, export, import, or broker defence articles or defence services on the US Munitions List. Aerospace companies, defence contractors, and technology companies whose products touch USML categories.

Companies register with DDTC, implement export licences for hardware, and then fail to control technical data in IT systems accessible to foreign national employees or contractors. An uncontrolled SharePoint with ITAR-controlled design files and foreign national read access is a violation regardless of whether anything was exported.

Registration with DDTC as a condition of manufacturing or exporting USML items. Export licences for controlled items and technical data. Technology control programmes (TCPs) preventing unauthorized foreign national access to ITAR-controlled data. Written authorizations for foreign national employees. Screening programmes for new hires.

DDTC civil penalties up to $1.3 million per violation. Criminal penalties up to $1 million per violation and 20 years imprisonment. Debarment from government contracting. DDTC has imposed consent agreements with monitoring requirements for significant violations.

ITAR and DFARS/CMMC both apply to defence contractors. DFARS/CMMC addresses CUI protection. ITAR addresses export-controlled technical data. A company can achieve CMMC Level 2 and simultaneously be ITAR non-compliant because the access control models are different — CMMC focuses on system authorization, ITAR focuses on nationality-based access restrictions.

FIPPs

US federal agencies and their systems handling PII. Privacy officers, IT architects, and system developers within federal agencies. FIPPs are codified into the Privacy Act of 1974 and numerous other statutes, making their practical effect legally binding.

Federal agencies conduct PIAs at system deployment and do not update them when systems are significantly modified. A system deployed under a 2018 PIA that has had its data sharing expanded, its retention period extended, and its user population changed is operating under a stale privacy authorization.

Eight principles: transparency, individual participation, purpose specification, data minimization, use limitation, data quality and integrity, security, and accountability. Operationalized through Privacy Impact Assessments (PIAs) for new systems, Systems of Records Notices (SORNs), and privacy programme governance.

OMB oversight. Inspector general audits. Congressional oversight. Non-compliance with Privacy Act requirements (which codify FIPPs) can result in civil liability — individuals can sue agencies for intentional or willful violations.

FIPPs are the foundation from which SSA EIESR, IRS 1075, CJIS, and 45 CFR 155.260 data protection requirements are derived. All of those frameworks implement FIPPs principles in sector-specific ways. An organization that understands FIPPs has the conceptual architecture to interpret all of them.

DFARS Cybersecurity 252.204-70xx

DoD prime contractors and subcontractors at all tiers handling Controlled Unclassified Information. Mandatory 72-hour cyber incident reporting applies regardless of CMMC status.

Contractors implement 800-171 controls but have not built the 72-hour reporting pipeline. In tabletop exercises, fewer than 20% of DFARS-covered contractors had ever walked through the mechanics of DoD reporting via dibnet.dod.mil before the exercise. Most had not registered on the portal or confirmed their reporting credentials. The 72-hour clock does not pause for administrative issues.

NIST SP 800-171 implementation (110 security requirements) for covered contractor information systems. 72-hour cyber incident reporting to DoD via dibnet.dod.mil. Preservation of images of compromised systems for 90 days. Submission of damage assessments at DoD request. Flow-down to subcontractors that handle CUI.

False Claims Act exposure for false representations about NIST 800-171 compliance. Contract termination. DoD contractor debarment. The Department of Justice Civil Cyber-Fraud Initiative has pursued DFARS non-compliance cases aggressively since 2021.

DFARS is the contractual vehicle; CMMC is the verification mechanism for the same underlying 800-171 requirements. FAR 52.204-21 is the floor; DFARS builds the structure above it. Organizations achieving CMMC Level 2 certification are demonstrating DFARS compliance through third-party assessment.

DHS CISA SSDAF

Software vendors selling to US federal agencies. The form must be completed by the CEO or a designee with authority to bind the organization.

Product security teams complete the attestation without legal review. The SSDAF is a legal representation by the CEO — false attestation is False Claims Act exposure. Product security professionals who fill out the form without involving legal counsel and without verifying that the development practices claimed are actually in place are creating liability, not resolving it.

CEO-level attestation that the software is developed in accordance with NIST SSDF (SP 800-218). Specific attestation items cover software supply chain security, use of automated security testing, protection of software development environments, and the organization''s ability to identify and report vulnerabilities.

False attestations are subject to False Claims Act prosecution. CISA can refer cases to DOJ. Agencies can stop purchasing from vendors who submit materially false attestations.

SSDAF implements EO 14028''s software supply chain requirements. Vendors already subject to DFARS supply chain risk management requirements have overlapping obligations — the SSDF practices required by SSDAF overlap with DFARS 252.204-7012 supply chain provisions.

DHS CISA TIC 3.0

US federal agencies and their cloud service providers and managed security service providers. Agencies must apply TIC 3.0 security capabilities when accessing external services, connecting remote workers, and using cloud platforms.

Agencies that migrated to cloud under TIC 2.0 exemptions are still operating under those exemptions rather than implementing TIC 3.0 architectures. TIC 3.0 has been available since 2020. Agencies still citing legacy TIC 2.0 approaches are operating under stale security architectures.

Security capabilities aligned to use case scenarios: traditional (on-premise), cloud, and remote user. The Security Capabilities Catalog defines specific capabilities that must be implemented for each scenario. Unlike TIC 2.0, traffic does not need to be routed through Trusted Internet Connection points.

OMB oversight. DHS CISA can conduct assessments and issue recommendations. Persistent non-compliance surfaces in FISMA reporting.

TIC 3.0 implements aspects of the zero trust architecture required by EO 14028 and the DoD Zero Trust frameworks. Agencies implementing TIC 3.0 cloud use cases are simultaneously building zero trust foundations. The capability overlap is substantial but the documentation and reporting requirements differ.

DHS ZTCF

DHS components, programme managers, and IT system owners. The ZTCF is DHS-internal but directly relevant to DHS contractors whose systems must integrate with DHS zero trust architecture.

DHS components implement identity and network pillars first — where existing investment is concentrated — and defer data and application pillars. The data pillar requires data classification and data flow mapping that most agencies have not completed.

Zero trust capability implementation across the standard pillars — identity, devices, networks, applications, and data — using DHS-specific implementation guidance. Aligns with the DoD Zero Trust Reference Architecture and OMB federal zero trust strategy memorandum.

DHS CIO oversight. Zero trust progress is tracked against OMB M-22-09 milestones, which apply across all CFO Act agencies including DHS.

ZTCF and the DoD Zero Trust documents share the same architectural pillars. Organizations delivering IT to both DoD and DHS can build unified zero trust architectures, though the specific capability requirements and assessment mechanisms differ.

FTC Act Section 5

Any US company handling consumer data. The FTC''s Section 5 data security authority applies across industries and company sizes with no sector exclusion.

Organizations assume that because the FTC Act has no prescriptive standard, it imposes no real obligation. The FTC''s enforcement record says otherwise. Reasonable practices are partly defined by what the FTC has accepted in consent agreements — those agreements establish the de facto standard.

Reasonableness standard — no prescriptive controls. The FTC assesses whether security practices were reasonable given the sensitivity of data held, the size of the organization, the cost of protective measures, and the availability of alternatives.

FTC can seek injunctive relief and civil penalties for violating consent orders — up to $51,744 per violation per day. The FTC''s track record includes actions against companies of all sizes.

FTC Act Section 5 is the catch-all that applies to companies not covered by sectoral rules. But it also applies alongside GLBA, COPPA, and FACTA. A mortgage company subject to GLBA is also subject to Section 5. Satisfying GLBA does not immunize a company from Section 5 enforcement for practices outside GLBA''s scope.

NERC CIP 2024

Electric utilities, transmission operators, balancing authorities, generation owners, and their vendors with assets connected to the North American bulk electric system. Assets are classified as high, medium, or low impact.

Utilities maintain strong compliance posture for High and Medium impact assets and neglect Low impact assets. Current assessment data consistently shows Low impact asset inventories are incomplete and Low impact controls are either undocumented or unenforced.

14 active CIP standards covering electronic security perimeters, access management, incident reporting, recovery plans, configuration change management, supply chain risk management, and physical security. The 2024 updates added requirements around low-impact assets that were previously under-regulated.

NERC Regional Entities conduct audits. Violations are reported to FERC. Penalties can reach $1 million per violation per day. NERC has levied penalties exceeding $10 million in single cases. NERC makes violation and settlement data publicly available.

NERC CIP and C2M2 both apply to electric utilities. NERC CIP is prescriptive and audited; C2M2 is maturity-based and self-assessed. Using C2M2 to prepare for NERC CIP audits is common, but the control documentation formats required for NERC CIP audit evidence are specific — a C2M2 self-assessment does not substitute for them.

NISPOM

US defence contractors, subcontractors, and facilities with Facility Clearances accessing, storing, or processing classified national security information. Oversight by DCSA. Mandatory for all NISP participants.

Contractors build NISPOM compliance programmes around the Facility Security Officer''s domain — physical security, personnel clearances, classified document handling — and under-invest in the insider threat programme''s technical monitoring requirements. The 2020 NISPOM codification added explicit user activity monitoring requirements that many contractors have not fully implemented.

Personnel security clearance procedures. Facility accreditation. Classified information handling procedures covering storage, transmission, destruction, and access. Mandatory insider threat programmes with reporting mechanisms, training, and user activity monitoring. Self-inspections at least annually.

DCSA can revoke Facility Clearances, which terminates classified contract eligibility. Personal liability for individuals who willfully violate classified information handling requirements. Criminal penalties under 18 U.S.C. § 1001 for false statements to DCSA.

NISPOM and DFARS/CMMC both apply to defence contractors but address different information types. NISPOM covers classified information. DFARS/CMMC covers CUI. The access control architectures must be kept separate — classified systems cannot share infrastructure with CUI systems.

NSTC NSPM-33

US research institutions receiving federal funding above a threshold set by funding agencies. Research compliance officers and export control managers are the primary implementation owners.

Institutions focus NSPM-33 compliance on disclosure requirements for senior researchers and miss the export control integration requirement. Research security plans that do not address the export control dimension are non-compliant with the guidance.

Formal research security programme with four components: cybersecurity, foreign travel security, research security training, and export control. Disclosure requirements for researchers covering foreign affiliations, foreign talent recruitment programme participation, and foreign funding. Policy prohibiting participation in foreign government talent recruitment programmes for researchers with access to federally funded research.

Federal funding agencies can debar institutions. The Departments of Justice, State, and Commerce have prosecuted cases involving undisclosed foreign affiliations at US research institutions.

NSPM-33 and ITAR Part 120 overlap substantially for research institutions working on defence-related projects. The technology control programme required by ITAR and the research security programme required by NSPM-33 share access control, foreign national vetting, and data protection requirements.

SEC Cybersecurity Rule

Publicly traded companies registered with the SEC and foreign private issuers. The 4-business-day Form 8-K disclosure applies to material cybersecurity incidents. Annual Form 10-K disclosures on risk management and governance apply to all registrants.

Companies build their SEC incident response around a binary materiality determination without defining who makes that call, what criteria trigger the determination process, or how long the process is expected to take. In our assessments, the general expectation is that materiality will be ''obvious.'' It is not obvious, and the SEC''s posture suggests extended deliberations about materiality are themselves a problem.

Form 8-K Item 1.05: disclose material cybersecurity incidents within 4 business days of determining materiality. Form 10-K: annual disclosure of cybersecurity risk management and strategy, material risks from cybersecurity threats, board oversight, and management''s role. Disclosure of board member cybersecurity expertise.

SEC enforcement. Civil penalties for late, incomplete, or misleading disclosures. Form 10-K cybersecurity disclosure deficiencies have attracted SEC comment letters. Companies that disclose incidents materially earlier in some channels than in their 8-K face additional securities law exposure.

SEC Rule and SOX both apply to public companies but address different aspects of the same event. A ransomware attack at a public company requires a 4-business-day 8-K disclosure and may require updating the SOX ITGC risk assessment if financial systems were affected. Legal and IT audit teams must coordinate both in real time.

SOX

Publicly traded US companies and foreign private issuers listed on US exchanges, plus their external auditors. Section 404 assessments are mandatory. Smaller reporting companies have reduced external auditor attestation requirements.

SOX ITGC programmes scope based on financial system categories and miss SaaS applications integrated into financial workflows without going through the SOX scoping process. ERP migrations and finance department SaaS adoption regularly outpace SOX scoping reviews. External auditors find scope gaps during walkthroughs that management did not catch.

IT general controls covering access management, change management, computer operations, and data backup for systems that process or report financial data. Annual management assessment of ITGC effectiveness. External auditor attestation for accelerated filers. Quarterly certification by CEO and CFO.

SEC enforcement. External auditor reporting of ITGC material weaknesses in the audit opinion directly affects stock price and management credibility. Material weaknesses in ITGC require public disclosure. Willful certification of false reports carries personal criminal liability for CEOs and CFOs.

SOX and the SEC Cybersecurity Rule both apply to public companies and both require board-level governance of technology risk. A major cybersecurity incident at a public company implicates both — the incident response must address both the 8-K disclosure deadline and any SOX ITGC implications simultaneously.

SSA EIESR v8.0

State agencies, healthcare organizations, financial institutions, and other entities receiving SSA data through electronic information exchange agreements. Attestation to EIESR compliance is required before SSA data sharing begins.

Organizations attest EIESR compliance at the time of agreement execution and do not update their control implementation as the EIESR version advances. SSA periodically issues new EIESR versions with updated control requirements. Organizations running EIESR v6.x implementations when v8.0 is current have compliance gaps they may not discover until an SSA security review.

NIST SP 800-53-based controls across access control, audit logging, incident response, media protection, and system protection for systems handling SSA-provided data. SSA security reviews at periodic intervals. Immediate reporting of unauthorized disclosures.

SSA can terminate data sharing agreements. Given that SSA data is often required for benefits programme eligibility verification, termination is operationally severe.

SSA EIESR, IRS 1075, and CJIS form the trio of federal data-sharing compliance frameworks that state human services agencies most commonly carry simultaneously. All three are NIST 800-53-based, all three use different audit mechanisms, and none of them accept the others'' audit results as evidence of compliance.

TSA / DHS 1580/82-2022-01

Passenger railroad carriers, freight railroad carriers, and rail transit systems designated by TSA. Designation is based on ridership and cargo volumes. The directive affects approximately 30 to 40 entities.

Rail operators implement the IT-side controls and treat OT network segmentation as a future-state initiative. The 24-hour reporting requirement creates pressure to have clear OT visibility before an incident, not after. Operators who cannot determine within 24 hours whether an OT system has been affected by a detected IT incident cannot meet the reporting requirement.

Cybersecurity incident reporting to CISA within 24 hours. Designated cybersecurity coordinator reachable 24/7. Cybersecurity incident response plan. Vulnerability assessments. Network segmentation between IT and OT environments. Access control measures. Continuous monitoring. Annual cybersecurity assessments.

TSA can impose civil penalties up to $25,000 per day per violation. In 2023, TSA began issuing civil penalties for non-compliance with security directive requirements. Criminal penalties for obstruction of TSA enforcement.

TSA''s 24-hour reporting requirement is the shortest incident reporting clock in this group. Rail operators that are subsidiaries of publicly traded companies carry both the 24-hour TSA report and the 4-business-day SEC materiality determination simultaneously.

Audit mechanisms are completely separate. IRS conducts safeguard reviews through the Office of Safeguards. SSA conducts its own security reviews. CJIS audits are conducted by State CJIS Systems Agencies. None accepts the others'' evidence. An organization passing all three audits in the same year submits three separate evidence packages for controls that are materially identical.

All three are NIST SP 800-53-based frameworks governing federal data sharing with state agencies and contractors. Access control, encryption, audit logging, incident response, and media protection requirements are functionally near-identical across all three. A state human services agency carrying all three implements the same technical controls three times.

CMMC provides third-party verification for DFARS requirements; FAR 52.204-21 is self-attested. DFARS includes a 72-hour incident reporting obligation that CMMC does not independently require. A contractor can achieve CMMC Level 2 certification and still fail a DFARS audit for missing an incident report.

The federal contractor compliance stack. FAR 52.204-21 is the baseline. DFARS builds on it for CUI environments. FAR Section 889 and FAR 52.204-27 apply technology restriction layers across all.

Disclosure timelines are incompatible for overlapping incidents. SEC requires 4-business-day Form 8-K disclosure of material incidents. GLBA requires FTC notification within 30 days of discovering a breach. SOX does not have a disclosure timeline but requires quarterly CEO/CFO certification. A publicly traded non-bank financial institution facing a breach on January 1 must notify the FTC by January 31 but disclose materially to the SEC within 4 business days of materiality determination — these are different events with different clocks.

Financial company technology governance and incident disclosure. All three require some combination of board oversight, incident response capabilities, and disclosure to external parties following a material cyber incident.

DoD and DHS have separate milestone timelines, separate assessment mechanisms, and separate reporting chains. A technology vendor supporting both DoD and DHS components must demonstrate zero trust compliance against both sets of requirements. The evidence packages are different even when the underlying technical implementation is identical.

Zero trust implementation across the US government. All four require implementation of zero trust capabilities across the same seven pillars. The technical architecture is substantially equivalent.

Treating framework applicability as a one-time determination

Organizations assess which frameworks apply during contract award, regulatory examination, or initial compliance programme design — and then treat the result as stable. In reality, applicability changes when new contract vehicles are added, when data flows change, when corporate structure changes, or when a vendor relationship begins. A company that wins its first DoD contract with CUI picks up DFARS overnight. An insurance subsidiary that starts offering tax preparation services picks up GLBA expansion provisions. Nobody revisited applicability.

Compliance gaps that are contractually invisible until an examination, an incident, or a due diligence process surfaces them. At that point the organization is remediating controls it did not know it needed, often under time pressure and sometimes under regulatory scrutiny.

Building compliance programmes against the framework text rather than the examiner''s perspective

Compliance teams read the framework documentation and build programmes against the stated requirements. Examiners operate from a different lens — they have seen what the failures look like across hundreds of organizations and test specifically for the failure modes they have seen most. FFIEC examiners do not test whether you have an MFA policy; they test whether MFA is actually enforced on all privileged access paths, including legacy systems that the policy team forgot about.

Programmes that pass internal self-assessments and fail external examinations. The gap between documented compliance and demonstrated compliance is the gap between the framework text and the examiner''s playbook.

Assuming sector-specific framework compliance covers the FTC Act

Companies in heavily regulated sectors build compliance programmes around their primary regulator''s requirements and assume coverage. GLBA compliance does not immunize a financial institution from FTC Act Section 5 enforcement. The FTC''s reasonableness standard applies in the gaps and around the edges of every sectoral framework.

FTC enforcement actions against companies that believed they were compliant with their primary regulatory framework. The FTC Act applies to practices that sectoral frameworks do not address — consumer-facing security representations, third-party SDK data collection, marketing analytics that process sensitive data without appropriate disclosure.

Treating supply chain compliance as a vendor questionnaire programme

Organizations implement vendor risk management programmes that send questionnaires to critical vendors, receive responses, and file them as evidence of due diligence. FAR Section 889 requires reasonable inquiry into the supply chain. DFARS requires flowdown. ITAR requires technology control over foreign national access. None of these obligations are satisfied by a vendor''s self-attestation that they are compliant.

Organizations that are technically non-compliant with supply chain requirements because their vendors'' attestations do not accurately reflect actual practices. The organization has documentation; it does not have compliance. When a Section 889 or ITAR violation surfaces through a vendor, the prime contractor faces enforcement exposure for the vendor''s conduct.