Resources
There are several guidelines and agencies that oversee cybersecurity companies to ensure they adhere to industry standards and regulations. Here are some key guidelines and agencies you should be aware of:
-
![Infographic titled 'Cybersecurity Strengthens U.S. Manufacturers' explaining the benefits of cybersecurity for small and mid-sized manufacturers. Highlights include improved recovery, risk mitigation, and data protection. It states that 55% of small businesses experience cyberattacks, with common types being spear phishing and ransomware. Suggests five steps to reduce risks, including identifying assets and detecting incidents. Notes compliance requirements for defense suppliers by December 31, 2017. Provided by the MEP National Network and NIST.]()
NIST Cybersecurity Framework
The National Institute of Standards and Technology (NIST) provides a comprehensive framework to help organizations manage and reduce cybersecurity risk. This framework is widely adopted across various industries.
-
![Diagram of IT security frameworks including COBIT 5, ISO 27000, NIST SP 800-53, CIS Controls, HITRUST CSF, and NIST Cyber Security Framework.]()
ISO/IEC 27001:2022 International Standards Organization
Information security, cybersecurity and privacy protection This is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS).
-
![Infographic about GDPR compliance rules and deadlines. Sections include business impact, personal data definition, changes, next steps, data controllers, consequences, and a contact for questions. Compliance deadline is May 25, 2018. By Sibbalds Chartered Accountants.]()
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the toughest privacy and security law in the world. Though it was drafted and passed by the European Union (EU), it imposes obligations onto organizations anywhere, so long as they target or collect data related to people in the EU. If you handle data from EU citizens, you must comply with GDPR, which sets guidelines for the collection and processing of personal information.
-
![HIPAA compliance checklist outlining technical, physical, and administrative protections, along with tasks for HIPAA privacy, breach notification, and omnibus rules. Includes steps like encrypting EPHI, managing access, training staff, and updating policies.]()
Health Insurance Portability and Accountability Act of 1996 ("HIPAA")
The Standards for Privacy of Individually Identifiable Health Information ("Privacy Rule") establishes national standards to protect certain health information, as required by the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). If you work with healthcare data, HIPAA provides guidelines for protecting sensitive patient information.
-
![CMMC Maturity Progression chart showing five levels: Performed, Documented, Managed, Reviewed, Optimizing.]()
CMMC (Cybersecurity Maturity Model Certification):
To protect American ingenuity and national security information, the DoD developed the Cybersecurity Maturity Model Certification (CMMC) 2.0 program to reinforce the importance of DIB cybersecurity for safeguarding the information that supports and enables our warfighters. This is required for contractors working with the Department of Defense, CMMC ensures that contractors have adequate cybersecurity controls and processes in place.
Agencies
-
![Comparison table showing differences in security approaches across identity, device, network/environment, application workload, and data categories, labeled as Traditional, Advanced, and Optimal in rows, with specific details under each category.]()
Cybersecurity and Infrastructure Security Agency (CISA):
CISA is a part of the Department of Homeland Security and is responsible for enhancing the security, resilience, and reliability of the nation’s cybersecurity and communications infrastructure.
