.png)

GRC Fundamentals

Common Cybersecurity Regulations

Regulatory obligations are required by law, but are rules issued by a regulating body (e.g., a government agency). Regulatory requirements tend to change more often than statutory requirements, due to how difficult it can be to change a law. This page provides a concise reference for the most impactful US cybersecurity regulations, including their scope, who they apply to, enforcement, and how the SCF CCF™ maps to each.

US Regulatory Requirements

Key Cybersecurity Regulations

The three most broadly impactful US cybersecurity regulations, covering defense contractors, financial institutions, and the broader federal supply chain.

CMMC

Cybersecurity Maturity Model Certification
US Federal
DoD / Defense

Applies to
DoD contractors and subcontractors who handle Federal Contract Information (FCI) or Controlled Unclassified Information (CUI)

Codified In
Title 32, Part 170 of the Code of Federal Regulations

Key Requires
Three-level maturity model (L1–L3); NIST SP 800-171 implementation; third-party C3PAO assessment for Level 2; annual self-attestation

Enforcement
Loss of contract eligibility; False Claims Act liability (treble damages); potential debarment

Certification
Yes (DoD CMMC certification via C3PAO or DIBCAC)

SCF Domains
GOV, IAC, MNT, CFG, NET, SA, SCF, RA, IRO

DFARS 252.204-70XX

Defense Federal Acquisition Regulation Supplement
US Federal
DoD / Defense

Applies to
Defense contractors and subcontractors storing, processing or transmitting Controlled Unclassified Information (CUI)

Key Clauses
252.204-7008 (pre-award); 252.204-7012 (safeguarding + 72hr incident reporting); 252.204-7019 (SPRS); 252.204-7020 (DoD audit); 252.204-7021 (CMMC)

Key Requires
Full implementation of NIST SP 800-171 (110 controls); SSP and POA&M documentation; SPRS score submission; 72-hour cyber incident reporting

Enforcement
Breach of contract; False Claims Act liability ($9M+ settlements); contract termination; suspension/debarment

Certification
Yes (via CMMC clause -7021)

SCF Domains
GOV, IAC, MNT, CFG, NET, SA, SCF, RA, IRO, TPM

NY DFS 23 NYCRR 500

New York Department of Financial Services Cybersecurity Regulation
US (New York)
Financial Services

Applies to
NY-licensed financial institutions: banks, insurers, mortgage companies, money transmitters, virtual currency businesses, and health/life insurers operating in New York

Key Requires
Written cybersecurity program; designated CISO; annual penetration testing; MFA for external/privileged access; 72-hour incident notification; annual compliance certification by April 15

Enforcement
Civil monetary penalties up to tens of millions; consent orders; license revocation; public enforcement disclosure (Robinhood $30M; EyeMed $4.5M)

Certification
No official cert. SCF CAP can issue SCF Certified for NY DFS 23 NYCRR 500

SCF Domains
GOV, IAC, RA, MON, IRO, TPM, BCD, TRN

Enforcement Reference

Cybersecurity Regulation Enforcement Comparison

Enforcement mechanisms and exposure vary significantly across regulations. This reference covers the primary enforcement levers. Actual consequences depend on severity, intent, and remediation efforts.

Enforcement mechanisms shown are indicative. Actual consequences vary based on severity, cooperation, and remediation. This is not legal advice.