IT Compliance category

Cybersecurity Compliance Frameworks and Regulations

Frameworks and incident-reporting rules for defending systems, detecting attacks and recovering from them. 16 entries, 8 with a full guide.

Cybersecurity frameworks describe how to identify, protect, detect, respond to and recover from attacks. Most are voluntary, but they are widely used as the yardstick in contracts, insurance questionnaires and government rules.

The NIST Cybersecurity Framework 2.0 gives a common language for outcomes and maturity. The CIS Critical Security Controls are a prioritised list of safeguards, with Implementation Group 1 as a practical baseline for smaller IT companies.

Some cybersecurity duties are mandatory. In India, the CERT-In Directions of April 2022 require reporting listed incidents within six hours and keeping logs for 180 days. In the EU, NIS2 and the Cyber Resilience Act add reporting duties for essential services and for products with digital elements.

Cybersecurity standards and laws

ISO 27001

ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems (ISMS) requirements

Certifiable standard Voluntary Global

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires you to define a scope, assess information security risks, choose controls from Annex A (93 controls in four themes) or elsewhere, and run a cycle of monitoring, internal audit, management review and improvement. It is voluntary, but an accredited ISO 27001 certificate is the most widely recognised proof of security for IT companies worldwide.

Covers, who needs it and key requirements
What it covers
Governance of information security: scope, risk assessment and treatment, policies, Annex A controls (organisational, people, physical, technological), internal audit, management review and continual improvement.
Who needs it
IT service providers, software and SaaS companies, data centres, BPOs, fintechs and any organisation whose clients ask for independent proof of information security.
Why it matters
It answers most security questionnaires with one certificate, is recognised in every market and is often a precondition for enterprise, banking and government contracts.
Applies in
Worldwide (international standard)
Key requirements
  • Define the ISMS scope and context (clauses 4.1 to 4.4)
  • Leadership commitment and an information security policy (clause 5)
  • Risk assessment, risk treatment plan and Statement of Applicability (clause 6)
  • Resources, competence, awareness and documented information (clause 7)
  • Operate and monitor controls, internal audit and management review (clauses 8 and 9)
  • Corrective action and continual improvement (clause 10)

IT Act 2000

Information Technology Act, 2000 (India), as amended in 2008, with rules made under it

Law Mandatory by law India

The Information Technology Act, 2000 is India's core law for electronic commerce and cybersecurity. It gives legal recognition to electronic records and signatures, defines cyber offences such as hacking, identity theft and data theft, makes companies liable to compensate for negligent handling of sensitive data (Section 43A, until the DPDP Act replaces it), sets due diligence and safe harbour rules for intermediaries (Section 79), and empowers CERT-In to issue binding directions (Section 70B).

Covers, who needs it and key requirements
What it covers
Electronic records and signatures, cyber contraventions and offences, corporate data protection (Section 43A and SPDI Rules), intermediary due diligence and safe harbour, government interception and blocking powers, critical information infrastructure and CERT-In's powers.
Who needs it
Every company operating computer systems in India: IT and software companies, SaaS and app providers, hosting and cloud providers, and intermediaries such as platforms and marketplaces.
Why it matters
It defines what is a crime, when you must pay compensation, and what intermediaries must do to keep safe harbour; CERT-In's binding directions come from it.
Applies in
India; extends to acts outside India involving computers or networks located in India (Section 75)
Key requirements
  • Reasonable security practices for sensitive personal data under Section 43A and the SPDI Rules 2011 (until 13 May 2027)
  • Intermediary due diligence under Section 79 and the IT Rules 2021, including grievance officers and takedown timelines
  • Comply with CERT-In directions under Section 70B (incident reporting, logs, clock sync)
  • Preserve and provide information when lawfully directed (Sections 67C, 69, 69B)
  • Protect against and report offences such as unauthorised access and data theft (Sections 43, 66)
  • Contracts that protect confidentiality of information accessed while providing services (Section 72A)

CERT-In Directions

CERT-In Directions of 28 April 2022 under Section 70B(6) of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents

Regulation Mandatory by law India

CERT-In's Directions of 28 April 2022 are binding rules for almost every organisation running IT systems in India. They require reporting listed cyber incidents to CERT-In within six hours of noticing them, keeping logs of all ICT systems for a rolling 180 days within India, synchronising clocks with NIC or NPL time servers, and naming a point of contact. Data centres, VPS, cloud and VPN providers must keep subscriber records for five years. Non-compliance is a criminal offence under Section 70B(7).

Covers, who needs it and key requirements
What it covers
Cyber incident reporting (20 listed incident types), log retention, clock synchronisation, point of contact, information requests from CERT-In, subscriber records for data centre, VPS, cloud and VPN providers, and KYC records for virtual asset service providers.
Who needs it
IT companies, SaaS providers, data centres, cloud, VPS and VPN providers, intermediaries, body corporates and government organisations operating in India.
Why it matters
The six-hour reporting window is one of the strictest in the world and failing to comply is a criminal offence, so incident response plans for India must be built around it.
Applies in
India
Key requirements
  • Report listed cyber incidents to CERT-In within 6 hours of noticing them (incident@cert-in.org.in or the reporting portal)
  • Enable and keep logs of all ICT systems securely for a rolling 180 days within Indian jurisdiction
  • Synchronise system clocks with the NTP servers of NIC or NPL (or traceable sources)
  • Designate a point of contact to interface with CERT-In and share details
  • Provide information and assistance when CERT-In asks
  • Data centres, VPS, cloud and VPN providers: keep validated subscriber records for 5 years; VASPs keep KYC and transaction records for 5 years

NIST CSF 2.0

NIST Cybersecurity Framework (CSF) 2.0

Framework Voluntary US / global

The NIST Cybersecurity Framework 2.0 is a voluntary framework of cybersecurity outcomes organised into six functions: Govern, Identify, Protect, Detect, Respond and Recover. It does not prescribe specific controls; instead it gives a common language, organisational profiles (current and target) and tiers to describe how rigorous your practices are. Version 2.0, released in February 2024, added the Govern function and supply chain risk management, and is designed for organisations of any size or sector.

Covers, who needs it and key requirements
What it covers
Cybersecurity governance, risk strategy and supply chain risk (Govern), asset and risk identification (Identify), safeguards (Protect), monitoring (Detect), incident response (Respond) and recovery (Recover), with references to detailed controls such as SP 800-53, ISO 27001 and CIS Controls.
Who needs it
Any organisation that wants a structured cybersecurity programme, including IT companies reporting cyber risk to boards, clients, investors or insurers, and US federal contractors.
Why it matters
It is the most widely recognised way to describe cybersecurity maturity, maps to most other standards, and is free.
Applies in
United States origin; used worldwide
Key requirements
  • Govern (GV): context, risk strategy, roles, policy, oversight and cybersecurity supply chain risk management
  • Identify (ID): asset management, risk assessment and improvement
  • Protect (PR): identity and access, awareness and training, data security, platform security, resilience
  • Detect (DE): continuous monitoring and adverse event analysis
  • Respond (RS): incident management, analysis, reporting and mitigation
  • Recover (RC): recovery plan execution and communication

NIST SP 800-53

NIST Special Publication 800-53 Revision 5: Security and Privacy Controls for Information Systems and Organizations

Framework Mandatory if in scope US federal

NIST SP 800-53 Revision 5 is the US government's catalogue of security and privacy controls, organised into 20 families from Access Control to Supply Chain Risk Management. Federal agencies must select controls from it using the Low, Moderate or High baselines in SP 800-53B, and FedRAMP builds on it for cloud services. Private companies use it as the most detailed public control library. Release 5.2.0 in August 2025 strengthened software update and patching controls.

Covers, who needs it and key requirements
What it covers
Twenty control families: AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI and SR, covering technical, operational, management, privacy and supply chain safeguards.
Who needs it
US federal agencies, federal contractors and cloud providers pursuing FedRAMP, plus organisations that want a detailed control catalogue for high-assurance systems.
Why it matters
It is the control foundation for FISMA, FedRAMP and many state and sector programmes, and the reference most other frameworks map to.
Applies in
United States (federal); used worldwide as a reference catalogue
Key requirements
  • Categorise the system (FIPS 199) and select a Low, Moderate or High baseline (SP 800-53B)
  • Tailor controls and document them in a System Security and Privacy Plan
  • Implement controls across the 20 families
  • Assess controls using SP 800-53A procedures
  • Obtain authorization (ATO) based on residual risk
  • Continuously monitor controls and update plans of action and milestones (POA&M)

CIS Controls v8.1

CIS Critical Security Controls, Version 8.1

Framework Voluntary Global

The CIS Critical Security Controls are a prioritised set of 18 controls and 153 safeguards that defend against the most common cyberattacks. Safeguards are grouped into three Implementation Groups: IG1 (56 safeguards, essential cyber hygiene for every organisation), IG2 and IG3 for more complex environments. Version 8.1, released in June 2024, aligned the controls with NIST CSF 2.0. They are free, practical and ideal as a first baseline for small IT companies.

Covers, who needs it and key requirements
What it covers
Asset and software inventory, data protection, secure configuration, account and access management, vulnerability management, audit logs, email and browser protection, malware defences, data recovery, network monitoring, security awareness, service provider management, application security, incident response and penetration testing.
Who needs it
Any organisation, especially small and mid-sized IT companies that need a practical, prioritised security baseline.
Why it matters
It turns security into an ordered to-do list based on real attack data, and IG1 is a realistic starting point that also satisfies many insurer and client questionnaires.
Applies in
Worldwide
Key requirements
  • Inventory and control enterprise assets and software (Controls 1 and 2)
  • Data protection and secure configuration (Controls 3 and 4)
  • Account management and access control, including MFA (Controls 5 and 6)
  • Continuous vulnerability management and audit log management (Controls 7 and 8)
  • Malware defences, data recovery and network defences (Controls 9 to 13)
  • Awareness training, service providers, application security, incident response and pen testing (Controls 14 to 18)

OWASP Top 10

OWASP Top 10:2025 The Ten Most Critical Web Application Security Risks

Awareness standard Voluntary Global

The OWASP Top 10 is the most widely used awareness list of critical web application security risks, published by the non-profit OWASP Foundation from vulnerability data and community surveys. The 2025 edition, released in November 2025, ranks Broken Access Control first, adds Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10), and folds SSRF into access control. It is a starting point for secure coding, testing and developer training, not a complete standard.

Covers, who needs it and key requirements
What it covers
A01 Broken Access Control, A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging and Alerting Failures, A10 Mishandling of Exceptional Conditions.
Who needs it
Software development companies, web and app agencies, SaaS teams, QA and penetration testing providers, and any team building web applications or APIs.
Why it matters
Clients, PCI DSS assessors and pen testers use it as the baseline, so building and testing against it avoids the most common and most expensive application flaws.
Applies in
Worldwide
Key requirements
  • Enforce access control on the server for every request (A01)
  • Harden configurations and remove defaults (A02)
  • Manage dependencies, build pipelines and SBOMs (A03)
  • Use strong, current cryptography and protect secrets (A04)
  • Use parameterised queries and output encoding (A05) and threat-model designs (A06)
  • Strong authentication, integrity checks, logging with alerting, and safe error handling (A07 to A10)

FISMA

Federal Information Security Modernization Act of 2014 (originally the Federal Information Security Management Act of 2002)

Law Mandatory if in scope US federal

FISMA is the US federal law that requires every federal agency to run an agency-wide information security programme, including for systems operated by contractors. Agencies categorise systems, apply NIST SP 800-53 controls under the Risk Management Framework, authorize systems to operate, continuously monitor them and report annually to OMB and Congress. IT companies meet FISMA through contract clauses when they build, host or operate systems for federal agencies.

Covers, who needs it and key requirements
What it covers
Federal information and information systems, including those run by contractors: risk-based security programmes, system categorisation, security controls, authorization, continuous monitoring, incident reporting to CISA and annual reporting.
Who needs it
US federal agencies and the IT contractors, integrators and cloud providers that operate systems or process information on their behalf.
Why it matters
Federal contracts flow FISMA duties down to vendors; without an ATO a system cannot go live.
Applies in
United States (federal)
Key requirements
  • Inventory information systems and categorise them (FIPS 199)
  • Select and implement NIST SP 800-53 controls (FIPS 200 minimum requirements)
  • Write a system security plan and assess controls
  • Obtain an Authorization to Operate from the authorizing official
  • Continuously monitor and report incidents to CISA
  • Annual independent evaluation and FISMA reporting to OMB

NIS2 Directive

Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2)

Law Mandatory if in scope EU

NIS2 is the EU's cybersecurity law for essential and important entities in 18 sectors, including digital infrastructure, cloud and data centre providers, managed service and managed security service providers, and many manufacturers. Member states had to transpose it by 17 October 2024. In-scope entities must take risk management measures, report significant incidents (early warning within 24 hours, notification within 72 hours, final report within a month) and hold management accountable. Fines reach EUR 10 million or 2% of turnover.

Covers, who needs it and key requirements
What it covers
Cybersecurity risk management measures, supply chain security, incident reporting, management body accountability, registration and supervision for essential and important entities.
Who needs it
Medium and large entities in listed sectors operating in the EU, including cloud, data centre, DNS, managed service and managed security service providers.
Why it matters
Managed service providers are directly in scope, and in-scope clients pass NIS2 security requirements to their IT suppliers.
Applies in
European Union, through national transposition laws
Key requirements
  • Determine whether you are an essential or important entity in each member state
  • Implement the risk management measures in Article 21, including supply chain security
  • Report significant incidents within 24 hours, 72 hours and one month
  • Train management bodies and make them approve and oversee measures
  • Register with national authorities where required

Cyber Resilience Act

Cyber Resilience Act, Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements

Law Mandatory if in scope EU

The Cyber Resilience Act sets cybersecurity requirements for hardware and software products with digital elements sold in the EU. Manufacturers must design products securely, handle vulnerabilities for the support period, provide security updates and an SBOM, and carry out conformity assessment and CE marking. Reporting of actively exploited vulnerabilities and severe incidents has applied since 11 September 2026; the main requirements apply from 11 December 2027. Fines reach EUR 15 million or 2.5% of turnover.

Covers, who needs it and key requirements
What it covers
Security by design, vulnerability handling, security updates, SBOMs, technical documentation, conformity assessment, CE marking and reporting of exploited vulnerabilities and incidents for products with digital elements.
Who needs it
Manufacturers, importers and distributors of software and connected products placed on the EU market, including software companies selling licensed products. Pure SaaS is mostly covered by NIS2 instead.
Why it matters
It makes secure development and vulnerability handling a legal condition for selling software and connected products in the EU.
Applies in
European Union; applies to products placed on the EU market from anywhere
Key requirements
  • Meet the essential cybersecurity requirements in Annex I
  • Vulnerability handling for the support period, with an SBOM
  • Report actively exploited vulnerabilities and severe incidents (early warning within 24 hours)
  • Conformity assessment and CE marking before placing on the market
  • Technical documentation and user security information

Cyber Essentials

Cyber Essentials and Cyber Essentials Plus (UK government-backed certification scheme)

Certifiable standard Mandatory if in scope United Kingdom

Cyber Essentials is a UK government-backed certification, run by the National Cyber Security Centre with IASME as delivery partner, that proves five basic technical controls: firewalls, secure configuration, user access control, malware protection and security update management. The basic level is a verified self-assessment; Cyber Essentials Plus adds hands-on technical testing. It is required for many UK central government contracts that involve personal data or certain ICT services.

Covers, who needs it and key requirements
What it covers
Five technical controls applied to internet-connected devices, servers, cloud services and users in scope.
Who needs it
Suppliers to UK government and many UK businesses, including IT and software companies with UK public sector clients.
Why it matters
It is a low-cost entry to UK public sector work and blocks most common internet-based attacks.
Applies in
United Kingdom
Key requirements
  • Boundary firewalls and internet gateways
  • Secure configuration of devices and software
  • User access control, including MFA for cloud services
  • Malware protection
  • Security update management within 14 days for high and critical fixes

CMMC 2.0

Cybersecurity Maturity Model Certification 2.0 (US Department of Defense / Department of War)

Certifiable standard Mandatory if in scope US defence

CMMC is the US defence department's programme for verifying that contractors protect Federal Contract Information and Controlled Unclassified Information. Level 1 covers 15 basic safeguards, Level 2 the 110 requirements of NIST SP 800-171, and Level 3 adds selected SP 800-172 requirements. Phase 1 (self-assessments) began on 10 November 2025. In July 2026 the department paused Phase 2, which would have made third-party Level 2 assessments mandatory from 10 November 2026, pending a review.

Covers, who needs it and key requirements
What it covers
Protection of Federal Contract Information and Controlled Unclassified Information in contractor systems, with self, third-party (C3PAO) or government assessments by level.
Who needs it
US defence contractors and subcontractors at every tier, including software and IT service suppliers handling FCI or CUI.
Why it matters
Defence contracts can require a CMMC status as a condition of award; the rules remain in place even while Phase 2 is paused.
Applies in
United States (defence contracts)
Key requirements
  • Identify FCI and CUI and the systems that handle them
  • Implement FAR 52.204-21 (Level 1) or NIST SP 800-171 (Level 2) requirements
  • Complete the required self or third-party assessment and affirm in SPRS
  • Maintain a System Security Plan and POA&M
  • Keep watching the Phase 2 status for contract requirements

NIST SP 800-171

NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

Framework Mandatory if in scope US federal contracts

NIST SP 800-171 defines the security requirements contractors must meet to protect Controlled Unclassified Information (CUI) in their own systems. Revision 3 (May 2024) has 97 requirements in 17 families, but US defence contracts continue to assess against the 110 requirements of Revision 2 under a class deviation, including for CMMC Level 2. It is required through DFARS 252.204-7012 and other federal contract clauses.

Covers, who needs it and key requirements
What it covers
Access control, awareness, audit, configuration, identification and authentication, incident response, maintenance, media, personnel, physical, risk, security assessment, system and communications protection, and system integrity for CUI.
Who needs it
US federal and defence contractors and subcontractors that store, process or transmit CUI.
Why it matters
It is a contractual condition for handling CUI and the basis of CMMC Level 2.
Applies in
United States (federal contracts)
Key requirements
  • Scope systems that handle CUI
  • Implement the 800-171 requirements (Rev. 2 for current DoD assessments)
  • Document a System Security Plan and plans of action
  • Report a self-assessment score in SPRS where DFARS 252.204-7019 applies
  • Report cyber incidents to DoD within 72 hours (DFARS 252.204-7012)

SEBI CSCRF

SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities, 2024

Regulation Mandatory if in scope India

SEBI's Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024 with phased compliance through 2025, sets cybersecurity standards for stock exchanges, depositories, brokers, mutual funds, investment advisers and other SEBI-regulated entities. It follows a graded approach by entity category and covers governance, identification, protection, detection, response, recovery and evolution, with cyber audits, a security operations centre for larger entities and incident reporting to CERT-In and SEBI.

Covers, who needs it and key requirements
What it covers
Cyber governance, asset and risk identification, protection controls, SOC and detection, incident response and reporting, recovery, audits and third-party (including cloud) risk.
Who needs it
SEBI-regulated entities and the IT, cloud and SaaS vendors that serve them.
Why it matters
Market entities must audit their vendors and include CSCRF requirements in contracts.
Applies in
India (SEBI-regulated entities)
Key requirements
  • Classify the entity category and applicable controls
  • Board-approved cybersecurity policy and governance
  • SOC or managed SOC as required
  • Periodic cyber audits by CERT-In empanelled auditors
  • Incident reporting to CERT-In and SEBI

Essential Eight

Australian Cyber Security Centre Essential Eight Maturity Model

Framework Mandatory if in scope Australia

The Essential Eight is the Australian Cyber Security Centre's prioritised set of eight mitigation strategies: application control, patching applications, configuring Microsoft Office macros, user application hardening, restricting administrative privileges, patching operating systems, multi-factor authentication and regular backups. Each is assessed at maturity levels one to three. Australian government entities must implement it, and it is widely requested from suppliers.

Covers, who needs it and key requirements
What it covers
Eight mitigation strategies and a maturity model from Level 1 to Level 3.
Who needs it
Australian government entities and their IT suppliers, and organisations wanting a practical baseline.
Why it matters
It is short, measurable and focused on stopping common attacks.
Applies in
Australia (mandatory for many federal agencies; voluntary elsewhere)
Key requirements
  • Application control and macro restrictions
  • Patch applications and operating systems promptly
  • User application hardening
  • Restrict admin privileges and use MFA
  • Regular, tested backups

NYDFS Part 500

New York Department of Financial Services Cybersecurity Regulation, 23 NYCRR Part 500

Regulation Mandatory if in scope New York, US

Part 500 requires banks, insurers and other financial services companies licensed by the New York DFS to run a risk-based cybersecurity programme. The second amendment (November 2023) phased in duties through November 2025, including CISO reporting to the board, MFA for all remote and privileged access, asset inventories, stricter controls for larger Class A companies, notification of cybersecurity events within 72 hours and of extortion payments within 24 hours, and annual certification by 15 April.

Covers, who needs it and key requirements
What it covers
Cybersecurity programme and policies, governance, risk assessment, access privileges, MFA, encryption, vendor management, incident response, notification and annual certification.
Who needs it
DFS-regulated financial institutions and the IT and SaaS vendors that serve them (through third-party service provider policies).
Why it matters
DFS enforces actively, and covered entities must assess and contractually bind their technology vendors.
Applies in
New York State, USA (DFS-licensed entities)
Key requirements
  • Risk-based cybersecurity programme and CISO
  • MFA for remote and privileged access
  • Third-party service provider security policy
  • Notify DFS within 72 hours of a cybersecurity event
  • Annual certification or acknowledgement of non-compliance by 15 April

Need help with cybersecurity compliance?

Get a gap assessment from vetted compliance and cybersecurity firms, or ask us a question.

Get an assessment Find a company

List your IT company for free

Create a profile in minutes, get reviewed by our editors and start receiving enquiries from clients looking for your skills.

Get listed free