Secure Controls Framework
Download The SCF
Start Here
Content
GRC Fundamentals
SCF Certified
Marketplace

Common Cybersecurity Laws

Cybersecurity laws create binding legal obligations regardless of whether an organization chooses to comply. This page provides a concise reference for the most impactful cybersecurity and data protection laws globally, including their scope, who they apply to, penalties, and how the SCF maps to each.

On This Page

US Federal & State Laws

Key US Cybersecurity & Data Privacy Laws

The United States has a fragmented, sector-based approach to cybersecurity law. Different industries face different mandatory regimes, and state privacy laws add additional layers of obligation.

HIPAA / HITECH

US Federal
Healthcare

Health Insurance Portability & Accountability Act

Applies to
Covered entities (health plans, providers, clearinghouses) and their business associates handling PHI
Key Requires
Annual risk assessment; security policies; breach notification; BAAs with all PHI processors; minimum necessary standard
Penalties
Up to $1.9M per violation category per year; criminal prosecution for willful neglect
SCF Domains
PRI, DCH, CRY, IAC, IRO, TPM, GOV

GLBA

US Federal
Financial Services

Gramm-Leach-Bliley Act: Safeguards Rule

Applies to
Financial institutions: banks, mortgage lenders, insurance companies, financial advisors, tax preparers
Key Requires
Written Information Security Program (WISP); annual penetration testing; MFA; encryption; incident response; vendor oversight
Penalties
Up to $100,000 per violation; officers liable up to $10,000; criminal prosecution possible
SCF Domains
GOV, RA, IAC, CRY, TPM, IRO, MON
Deep Dive: GLBA

SOX

US Federal
Public Companies

Sarbanes-Oxley Act: IT Controls

Applies to
Publicly traded companies and their auditors; IT general controls (ITGC) that support financial reporting
Key Requires
IT General Controls (change management, access controls, operations); annual management assessment; external auditor attestation
Penalties
Up to $5M fines and 20 years imprisonment for executives who certify false reports
SCF Domains
GOV, IAC, CHG, CFG, MON, BCD
Deep Dive: SOX

CCPA / CPRA

US (California)
Privacy

California Consumer Privacy Act / Privacy Rights Act

Applies to
For-profit businesses serving CA residents meeting any threshold: $25M revenue, 100K+ consumer records, or 50%+ revenue from selling data
Key Requires
Privacy notice; opt-out rights; DSAR fulfillment within 45 days; data security; annual cybersecurity audit (high-risk)
Penalties
Up to $7,500 per intentional violation; $750 per consumer per incident for data breaches
SCF Domains
PRI, DCH, TPM, IRO
Deep Dive: CCPA / CPRA

FedRAMP

US Federal
Cloud / Federal IT

Federal Risk and Authorization Management Program

Applies to
Any cloud service provider (CSP) seeking to provide cloud services to federal agencies
Key Requires
Full NIST SP 800-53 control implementation; third-party assessment; Authority to Operate (ATO); continuous monitoring
Penalties
Loss of ATO; removal from FedRAMP Marketplace; contract termination; loss of federal revenue
SCF Domains
All 33 SCF domains
Deep Dive: FedRAMP

TX SB 2610

US (Texas)
All Businesses

Texas Cybersecurity Act: Business Obligations

Applies to
Businesses operating in Texas that collect, process, or store personal information of Texas residents
Key Requires
Reasonable cybersecurity measures; incident reporting; vendor management; data disposal requirements
Penalties
Civil penalties; attorney general enforcement; private right of action for data breach victims
SCF Domains
GOV, RA, IRO, TPM, DCH
Deep Dive: TX SB 2610
International Laws

Key International Cybersecurity & Data Privacy Laws

International laws apply to organizations outside their originating jurisdiction. For example, GDPR applies to any organization processing EU resident data regardless of where the organization is located. Cross-border compliance is a global operational reality.

GDPR

General Data Protection Regulation

This is some text inside of a div block.
This is some text inside of a div block.
Deep Dive: GDPR

NIS2 Directive

Network and Information Security Directive 2

This is some text inside of a div block.
This is some text inside of a div block.
Deep Dive: NIS2

DORA

Digital Operational Resilience Act

This is some text inside of a div block.
This is some text inside of a div block.
Deep Dive: DORA

GDPR

EU / EEA
Extraterritorial
Privacy

General Data Protection Regulation

Applies to
Any organization worldwide that processes personal data of EU/EEA residents, extraterritorial by design
Key Requires
Lawful basis; privacy notice; ROPA; individual rights; DPIA for high-risk; DPAs; 72-hour breach notification; DPO (in some cases)
Penalties
Up to €20M or 4% of global annual turnover, whichever is higher
SCF Domains
PRI, DCH, CRY, TPM, IRO, GOV
Deep Dive: GDPR

NIS2 Directive

EU
Critical Infrastructure

Network and Information Security Directive 2

Applies to
Medium and large organizations in critical sectors (energy, transport, health, digital, water, finance) operating in EU member states
Key Requires
Risk management measures; supply chain security; incident reporting (24hrs initial / 72hrs detailed); board accountability; cybersecurity governance
Penalties
Up to €10M or 2% of global turnover for essential entities; executive personal liability
SCF Domains
GOV, RA, IRO, TPM, NET, BCD
Deep Dive: NIS2

DORA

EU
Financial Services

Digital Operational Resilience Act

Applies to
EU financial entities: banks, investment firms, insurance companies, payment processors, crypto-asset service providers, and their critical ICT providers
Key Requires
ICT risk management framework; incident classification and reporting; digital operational resilience testing (TLPT); ICT third-party risk management
Penalties
Up to 1% of average daily global turnover per day of violation; executive personal liability
SCF Domains
GOV, RA, IRO, BCD, TPM, MON
Deep Dive: DORA
Penalty Reference

Cybersecurity Law Penalty Comparison

Maximum statutory penalties vary dramatically across laws. This reference table covers the headline maximums. Actual penalties depend on severity, willfulness, harm caused, and remediation efforts.

Law
Jurisdiction
Max Civil Penalty
Criminal Exposure?
Private Right of Action?
GDPR
EU / Global
€20M or 4% global turnover
Member state discretion
Yes (GDPR Article 82)
HIPAA / HITECH
US Federal
$1.9M per violation category/year
Yes (up to 10 years)
Limited; via state AG
CCPA / CPRA
California
$7,500 per intentional violation
No
Yes ($100–$750 per consumer)
NIS2
EU
€10M or 2% global turnover
Executive personal liability
No
DORA
EU
1% daily global turnover (per day)
Executive personal liability
No
GLBA
US Federal
$100,000 per violation
Yes (officers up to 10 years)
No
SOX
US Federal
$5M per false certification
Yes (up to 20 years)
Limited
FedRAMP
US Federal
Loss of ATO / contract
No (regulatory)
No
TX SB 2610
Texas
Civil penalties; AG discretion
No
Yes (breach victims)

Maximum penalties shown. Actual penalties vary based on severity, cooperation, and remediation. This is not legal advice.

Join 25,000+ GRC Professionals

Get the latest SCF updates, cybersecurity insights, and community news delivered to your inbox. You know you want to do it!

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Controls are your security, compliance & resilience program - A control is the power to influence or direct behaviors and the course of events.
‍

DOWNLOAD THE SCF

Start Here

What Is The SCF?How To Implement (SCRMS)Domains & PrinciplesLaws & Frameworks (LRF)Relationship Mapping (STRM)NIST OLIR ParticipationESG Considerations

Free Content

SCF DownloadSecurity, Compliance & Resilience Management System (SCRMS)SCRM Prioritized Implementation 
Guide (SCRMS PIG)Risk Management (SCR-RMM)Maturity Model (SCR-CMM)Assessment Standards (CDPAS)Mergers & Acquisitions (MA&D)Privacy Principles (DPMP)Evidence Request List (ERL)Unified Scoping Guide (USG)

Resources

GRC FundamentalsSCF CertifiedMarketplaceFAQAboutBlogSwag - SCF Branded Gear

Support

DonateVolunteer

© 2026 Secure Controls Framework Council, LLC. All rights reserved.

Terms & ConditionsPrivacyCookiesSitemap