Regulations and Frameworks Guide: Cyber Laws and Standards

Most security teams now answer to several cyber laws, a sector regulator and two or three control frameworks at once, and treating each as a separate project wastes effort and leaves gaps. This pillar maps the whole field: the binding laws (cyber resilience, sector rules, privacy, AI, incident reporting) and the voluntary or contractual frameworks (NIST, ISO, CIS, SOC 2, PCI DSS) that organisations use to show they comply. It explains how the pieces fit, what to build first, who owns what, and links every deep guide in the NHI Mgmt Group Regulations & Frameworks category, grouped by region and type. It is written for security leaders, GRC teams and engineers who have to turn legal text into controls and evidence. Status details for individual laws live in the linked deep guides, which are checked against the official sources.

Key takeaways

Laws set outcomes, frameworks supply the controls. NIS2, DORA, HIPAA or NYDFS say what must be achieved; NIST CSF 2.0, ISO/IEC 27001, CIS Controls and NIST SP 800-53 give you a structured control set to achieve it and show evidence.
Build one control set, map it many times. A single internal control library mapped to each regime (a "test once, comply many" approach) is cheaper and more consistent than parallel programmes. See the Control Mapping Guide.
Incident reporting clocks are the sharpest edge. First notices range from two hours (Singapore CII owners) to four business days after a materiality determination (SEC), and each clock starts on a different trigger.
Management accountability is now explicit. NIS2 Article 20, DORA and the SEC disclosure rules place approval, oversight or disclosure of cyber risk management on boards and senior management.
Status changes, so verify before you rely on it. Several regimes are mid-flight (UK Cyber Security and Resilience Bill, CIRCIA final rule, proposed NIS2 amendments, EU Cyber Resilience Act phases); check the deep guide and the official source before committing to a date.

What the field covers

Regulations and frameworks is the discipline of knowing which external requirements apply, translating them into controls, and producing evidence that satisfies regulators, auditors, customers and insurers. It sits between legal, risk management and security engineering. The field divides cleanly by type, and each type behaves differently.

Type	What it does	Examples	Binding?
Cyber resilience laws	Impose risk management measures, management duties and reporting on entities in critical or important sectors	NIS2, UK NIS Regulations 2018, Singapore Cybersecurity Act, Australia SOCI Act	Yes, by law
Sector rules	Prescriptive requirements for one industry, enforced by a sector regulator	DORA, NYDFS Part 500, GLBA Safeguards Rule, HIPAA Security Rule, NERC CIP, APRA CPS 234, MAS TRM	Yes, for regulated entities
Product and supply rules	Put security obligations on products or suppliers rather than operators	EU Cyber Resilience Act, UK PSTI Act, NIST SSDF attestation for US federal software suppliers	Yes, for manufacturers and suppliers in scope
Privacy and data protection	Require security of personal data and breach notification to regulators and individuals	GDPR Article 32 and Articles 33 and 34, UK GDPR, Australian Privacy Act and NDB scheme	Yes
AI regulation	Risk-tiered duties for AI providers and deployers, including security and logging	EU AI Act	Yes, phased
Incident reporting and disclosure	Fix who reports what, to whom and how fast	SEC Form 8-K Item 1.05, CIRCIA, CERT-In Directions	Yes, once in effect
Government and public sector schemes	Baselines for government systems and the cloud services that host them	FedRAMP, CMMC 2.0, CJIS Security Policy, IRS Publication 1075, IRAP, BSI C5, SecNumCloud, Spain ENS	Contractual or procurement condition
Voluntary frameworks and standards	Structure, controls and certification used to meet all of the above	NIST CSF 2.0, ISO/IEC 27001 and 27002, CIS Controls v8.1, NIST SP 800-53, COBIT 2019, NCSC CAF, Essential Eight	Voluntary unless a law, contract or regulator adopts them
Industry and contractual schemes	Requirements imposed by a payment network, cooperative or customer	PCI DSS 4.0, SWIFT CSP, SOC 2, HITRUST CSF, CSA STAR	By contract

The boundary with privacy is deliberate: privacy laws appear here only for their security and breach notification duties. Full privacy programme coverage, including lawful basis and data subject rights, sits in the privacy category. See the Global Privacy Regulatory Map.

Core concepts

Applicability and scope: every regime defines who is in scope, usually by sector, size, licence or the data handled. NIS2, for example, uses sector annexes plus a size cap, with some digital providers in scope regardless of size. Scoping is the first legal analysis, and a wrong answer wastes a year.
Law, regulation, guidance and standard: a law (NIS2, a directive transposed nationally; DORA, a regulation applying directly) creates duties. Secondary rules such as DORA's regulatory technical standards add detail. Guidance from regulators explains expectations. Standards such as ISO/IEC 27001 are voluntary until something references them.
Outcome versus prescriptive rules: NIS2 Article 21 lists ten measure areas from risk analysis to multi-factor authentication on an all-hazards basis; NYDFS 500.12 requires MFA for any individual accessing any information system of a covered entity. Outcome rules need judgement and documented risk assessment; prescriptive rules need exact implementation evidence.
Control framework and control mapping: a framework organises controls (CSF 2.0 has six Functions: Govern, Identify, Protect, Detect, Respond, Recover). Mapping links each internal control to the clauses it satisfies, so one test produces evidence for several regimes.
Attestation, certification and assessment: ISO/IEC 27001 is certified by an accredited body; SOC 2 is an attestation report by a CPA firm; FedRAMP and IRAP are government assessments; NYDFS requires an annual certification of material compliance or acknowledgment of noncompliance by 15 April. Know which form of assurance each stakeholder accepts.
Proportionality: most modern rules scale duties to size and risk (NIS2 essential versus important entities, DORA's Article 16 simplified ICT risk management framework for eligible entity types, CIS Implementation Groups). Small organisations should claim proportionality explicitly and document why.
Reporting triggers: clocks start on awareness, on classification as major, on a determination of materiality, or on a ransom payment. The trigger matters as much as the deadline.

Main threats

Regulations respond to a short list of harms, and the compliance programme carries its own risks. Both shape what auditors look for.

The harms regulators are targeting

Disruption of essential services: ransomware against operators of critical infrastructure and their suppliers, the core concern behind NIS2, SOCI, CIRCIA and the UK Bill.
Credential-based intrusion: stolen passwords, tokens and API keys used against remote access and cloud services, which is why NIS2, DORA's ICT risk RTS and NYDFS name identity and MFA directly. The Change Healthcare breach began with a stolen credential on a remote-access portal that had no MFA, and was followed by an HHS Office for Civil Rights investigation and state litigation.
Supply chain and third-party compromise: tampered software updates and shared providers, addressed by DORA's oversight of critical ICT third-party providers, the CRA and the SSDF. The SolarWinds compromise is the reference case.
Loss of personal data: the trigger for GDPR, state breach notification laws and HIPAA breach duties.
Investor and market harm: undisclosed or late-disclosed material incidents, addressed by the SEC rules.

Compliance programme risks

Mis-scoping: assuming a regime does not apply, or applying the wrong tier, then discovering it during an incident.
Paper compliance: policies that exist but controls that are not operating, exposed the first time an auditor samples evidence.
Missed reporting clocks: no logged awareness or materiality timestamp, so the organisation cannot prove it reported on time.
Status drift: building to a draft that was later amended, or missing a phase-in date.

Key controls by maturity

The same handful of capabilities satisfies most regimes. Build them in this order and scale depth to your size and number of regimes.

Capability	Foundational	Established	Advanced
Regulatory inventory	List of applicable laws, regulators and contracts with an owner each	Applicability analysis recorded with legal sign-off and review dates	Horizon scanning feeding a regulatory change process. See the Regulatory Change Management Guide
Control framework	Adopt one baseline (CIS Controls IG1, Essential Eight or CSF 2.0 profile)	Internal control library mapped to each regime's clauses	Automated evidence collection and continuous control monitoring
Risk assessment	Annual documented risk assessment	Method aligned to ISO/IEC 27005 or NIST SP 800-30, linked to treatment plans	Quantified scenarios supporting board decisions
Identity and access	MFA on remote access, email and privileged accounts	Joiner, mover, leaver process and access reviews covering service accounts and API keys	Phishing-resistant MFA, just-in-time privilege, full non-human identity inventory
Incident reporting	Contact list of every regulator and its deadline	Playbook with a decision log for awareness, classification, materiality and payment timestamps	Exercised multi-regime reporting with pre-approved templates
Third parties	Register of critical suppliers and contracts	Risk-tiered due diligence and contractual security clauses	Concentration and exit planning, as DORA expects for ICT providers
Governance	Named accountable executive and board reporting at least yearly	Board approval of measures and training, as NIS2 Article 20 requires	Metrics-driven oversight with internal audit assurance

How to implement

Scope: list sectors, countries, licences, data types and customer contracts, then decide which regimes apply and at what tier. Record the reasoning.
Choose an anchor framework: ISO/IEC 27001 if you need certification for customers, NIST CSF 2.0 if you need an outcome map that executives understand, NIST SP 800-53 if you serve US federal agencies. Many organisations use CSF 2.0 for governance and ISO/IEC 27001 for certification. See the NIST CSF to ISO 27001 Mapping Guide.
Gap assess: map the anchor framework to each regime and record gaps against prescriptive requirements first, because those cannot be argued away.
Fix reporting and identity first: these are where enforcement and incidents concentrate, and they are quick to evidence.
Pilot the evidence model: run one internal audit cycle against one regime, sample evidence, and fix the gaps in the evidence process before external assessment.
Exercise: run a tabletop that triggers several reporting clocks at once and check the decision log.
Maintain: review applicability yearly and on every new market, product or acquisition; treat a missed regulatory change like a failed control.

Decision guidance

Small organisation, one regime: implement the regime directly on a light baseline (CIS IG1 or Essential Eight); a full ISO/IEC 27001 ISMS may be more than you need unless customers ask for it.
Multinational or multi-sector: invest in a control library and mapping tool early; the cost of parallel programmes grows with every regime.
Financial entity in the EU: DORA applies instead of NIS2's risk management and reporting rules for the entities it covers. See the DORA and NIS2 Overlap Mapping Guide.
SaaS provider selling to many sectors: SOC 2 or ISO/IEC 27001 plus CSA STAR satisfies most customer questionnaires; add FedRAMP, IRAP, BSI C5 or SecNumCloud only where target markets require them.

Detection and measurement

Control coverage: percentage of mapped requirements with an operating, tested control (target above 95% for prescriptive rules).
Evidence freshness: share of controls with evidence younger than the test cycle.
Reporting readiness: time from incident declaration to a drafted regulator notice in exercises, measured against the shortest applicable clock.
Audit findings: open high findings and median days to close.
Regulatory change latency: days from a published rule change to an updated control owner action.
Identity coverage: percentage of human and non-human accounts in scope of MFA or credential rotation requirements that comply.

Roles and ownership

Role	Owns	Typical evidence
Board or management body	Approval and oversight of cyber risk measures; accountability under NIS2, DORA and SEC disclosure	Minutes, approved risk appetite, training records
CISO or head of security	Control framework, security programme, incident response	Programme plan, metrics, playbooks
Legal and compliance	Applicability, interpretation, regulator relationships, notification decisions	Applicability memos, notification logs
GRC or risk function	Control library, mapping, risk register, regulatory change	Mappings, register, change log
Control owners (IT, engineering, HR)	Operating controls and producing evidence	Configuration exports, tickets, review records
Internal audit	Independent assurance that controls operate	Audit reports, sampled test results
Procurement and vendor management	Third-party due diligence and contract clauses	Supplier register, assessments, contract schedules

Map these to the three lines: control owners in the first line, risk and compliance in the second, internal audit in the third. See the Three Lines Model for Cyber Risk Guide.

Standards and frameworks

Frameworks are the working language of compliance. The table shows where each fits and the CSF 2.0 and SP 800-53 anchors that tie compliance itself to a control.

Framework	Best used for	Assurance form
NIST CSF 2.0	Outcome map and profiles for executives; GV.OC-03 covers understanding legal, regulatory and contractual requirements	Self-assessment, profiles
ISO/IEC 27001:2022 with 27002	Certifiable ISMS with 93 Annex A controls in four themes	Accredited certification
NIST SP 800-53 Rev. 5	Detailed control catalogue for US federal and high-assurance systems (for example PM-1 programme plan, CA-2 control assessments, CA-7 continuous monitoring)	Assessment and authorisation
CIS Controls v8.1	Prioritised safeguards by Implementation Group	Self-assessment
COBIT 2019 and ITIL 4	IT governance and service management alignment	Capability assessment
NCSC CAF and Essential Eight	National outcome and baseline models for the UK and Australia	Regulator or self assessment
SOC 2, PCI DSS 4.0, HITRUST, CSA STAR	Customer and contractual assurance	Attestation, QSA assessment, certification

Choosing between them is covered in depth in the Cybersecurity Frameworks Compared Guide.

Common failure patterns

Separate programmes per regime: duplicate controls, inconsistent evidence and contradictory answers to regulators.
Exceptions on legacy entry points: an MFA policy that exempts one old gateway is exactly what the Change Healthcare intrusion exploited.
Human accounts only: access reviews and MFA evidence that ignore service accounts, API keys and tokens, which auditors increasingly sample. See the Identity Security Regulatory Map.
No decision log: the team reports late because nobody recorded when the incident was classified as major or material.
Supplier blind spots: critical providers not in the register, so concentration and exit duties cannot be met.

Practitioner checklist

Write down every regime that applies, why, at what tier, and who owns it.
Pick one anchor framework and build an internal control library mapped to every regime.
Prioritise prescriptive requirements (MFA, reporting deadlines, certifications) in the gap plan.
Build one incident playbook with every regulator's trigger, deadline and recipient, and a timestamped decision log.
Bring non-human identities into access reviews, MFA or credential rotation evidence.
Record board approval and training where NIS2, DORA or similar rules require it.
Keep a register of critical third parties with contract clauses and exit plans.
Review applicability and status of pending laws at least every quarter, using the deep guides below.

Where to go next

New to Regulations and Frameworks? These are the foundational guides to read first.

Start here

Global Cybersecurity Regulatory Map: cyber laws and reporting clocks compared across regions.
Control Mapping Guide: one control set across ISO 27001, SOC 2 and NIST.
NIST CSF 2.0 Guide: Functions, Categories, profiles and tiers.
NIST SP 800-53 Guide: the federal control catalogue and baselines.
ISO 27002 Controls Guide: Annex A controls and themes.
CIS Controls Guide: Implementation Groups, safeguards and benchmarks.
PCI DSS 4.0 Guide: payment card requirements.
NIS2 Directive Guide: scope, Article 21 measures and reporting.
DORA Guide: digital operational resilience for financial entities.
EU Cyber Resilience Act Guide: product security and vulnerability reporting duties.
HIPAA Security Rule Guide: safeguards for electronic protected health information.
SEC Cybersecurity Disclosure Rules Guide: Form 8-K and annual disclosure.

Browse all Regulations & Frameworks guides

Standards and references

Related NHI Mgmt Group resources: Global Cybersecurity Regulatory Map · Control Mapping Guide · Risk Management Guide · Identity Security Regulatory Map. This guide summarises cyber laws, regulations and frameworks at overview level and is not legal advice.

Regulations and Frameworks Guide: The Cyber Laws and Standards Security Teams Must Know