.png)
US Regulatory Requirements
Key Cybersecurity Regulations
The three most broadly impactful US cybersecurity regulations, covering defense contractors, financial institutions, and the broader federal supply chain.
CMMC
US Federal
DoD / Defense
Cybersecurity Maturity Model Certification
Applies to
DoD contractors and subcontractors who handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI)
Codified In
Title 32, Part 170 of the Code of Federal Regulations
Key Requires
Three-level maturity model (L1–L3); NIST SP 800-171 implementation; third-party C3PAO assessment for Level 2; annual self-attestation
Enforcement
Loss of contract eligibility; False Claims Act liability (treble damages); potential debarment
Certification
Yes (DoD CMMC certification via C3PAO or DIBCAC)
SCF Domains
GOV, IAC, MNT, CFG, NET, SA, SCF, RA, IRO
DFARS 252.204-70XX
US Federal
DoD / Defense
Defense Federal Acquisition Regulation Supplement
Applies to
Defense contractors and subcontractors storing, processing or transmitting Controlled Unclassified Information (CUI)
Key Clauses
252.204-7008 (pre-award); 252.204-7012 (safeguarding + 72hr incident reporting); 252.204-7019 (SPRS); 252.204-7020 (DoD audit); 252.204-7021 (CMMC)
Key Requires
Full implementation of NIST SP 800-171 (110 controls); SSP and POA&M documentation; SPRS score submission; 72-hour cyber incident reporting
Enforcement
Breach of contract; False Claims Act liability ($9M+ settlements); contract termination; suspension/debarment
Certification
Yes (via CMMC clause -7021)
SCF Domains
GOV, IAC, MNT, CFG, NET, SA, SCF, RA, IRO, TPM
NY DFS 23 NYCRR 500
US (New York)
Financial Services
New York Department of Financial Services Cybersecurity Regulation
Applies to
NY-licensed financial institutions: banks, insurers, mortgage companies, money transmitters, virtual currency businesses, and health/life insurers operating in New York
Key Requires
Written cybersecurity program; designated CISO; annual penetration testing; MFA for external/privileged access; 72-hour incident notification; annual compliance certification by April 15
Enforcement
Civil monetary penalties up to tens of millions; consent orders; license revocation; public enforcement disclosure (Robinhood $30M; EyeMed $4.5M)
Certification
No official cert. SCF CAP can issue SCF Certified for NY DFS 23 NYCRR 500
SCF Domains
GOV, IAC, RA, MON, IRO, TPM, BCD, TRN
Enforcement Reference
Cybersecurity Regulation Enforcement Comparison
Enforcement mechanisms and exposure vary significantly across regulations. This reference covers the primary enforcement levers. Actual consequences depend on severity, intent, and remediation efforts.
Regulation
Jurisdiction
Primary Enforcement
Criminal Exposure?
Certification Required?
CMMC
US Federal (DoD)
Loss of contract eligibility; False Claims Act (treble damages)
Yes (via FCA qui tam provisions)
Yes (C3PAO or DIBCAC, Level 2+)
DFARS 252.204-7012
US Federal (DoD)
Breach of contract; FCA liability; $9M+ settlements on record
Yes (via False Claims Act)
Yes (via CMMC clause -7021)
DFARS 252.204-7019
US Federal (DoD)
Ineligibility to bid; SPRS score scrutiny during source selection
Yes (score inflation = FCA fraud)
No (self-assessed SPRS score)
NY DFS 23 NYCRR 500
New York State
Civil monetary penalties; consent orders; license suspension/revocation
No (civil regulatory)
No (annual self-certification to DFS)
FAR 52.204-21
US Federal
Contract termination; suspension/debarment
Yes (via FCA if misrepresented)
No (self-attestation)
FINRA Cybersecurity Rules
US (Self-Regulatory)
Fines, suspensions, and expulsion from FINRA membership
No (regulatory)
No
Enforcement mechanisms shown are indicative. Actual consequences vary based on severity, cooperation, and remediation. This is not legal advice.
%20(white).png)