COMMON CYBERSECURITY REGULATIONS
Regulatory obligations are required by law, but are rules issued by a regulating body (e.g., government agency). Regulatory requirements tend to change more often than statutory requirements, due to how difficult it can be to change a law. From a cybersecurity and data privacy perspective, common regulatory requirements include, but are not limited to:
US Regulatory Requirements
- Defense Federal Acquisition Regulation Supplement (DFARS);
- Cybersecurity Maturity Model Certification (CMMC);
- Federal Acquisition Regulation (FAR);
- DoD Information Assurance Risk Management Framework (DIARMF);
- National Industrial Security Program Operating Manual (NISPOM);
- Financial Industry Regulatory Authority (FINRA); and
- New York Department of Financial Services (NY DFS) 23 NYCRR 500.