Regulatory obligations are required by law, but are rules issued by a regulating body (e.g., a government agency). Regulatory requirements tend to change more often than statutory requirements, due to how difficult it can be to change a law. This page provides a concise reference for the most impactful US cybersecurity regulations, including their scope, who they apply to, enforcement, and how the SCF CCF™ maps to each.
The three most broadly impactful US cybersecurity regulations, covering defense contractors, financial institutions, and the broader federal supply chain.
Cybersecurity Maturity Model Certification
Defense Federal Acquisition Regulation Supplement
New York Department of Financial Services Cybersecurity Regulation
Enforcement mechanisms and exposure vary significantly across regulations. This reference covers the primary enforcement levers. Actual consequences depend on severity, intent, and remediation efforts.
Enforcement mechanisms shown are indicative. Actual consequences vary based on severity, cooperation, and remediation. This is not legal advice.
%20(white).png)
.png)