Safeguarding your organization's data is not just a good practice—it's a necessity. But with hundreds of regulatory and security compliance frameworks available, how do you know which ones are right for your business? What's more, why are these frameworks important, and how can they help you strengthen your security posture?
The right framework will offer you a structured way to manage risks and ensure that you are fulfilling legal and contractual obligations. In this article, we’ll delve into the basics of 15 regulatory and security compliance frameworks to help you make an informed decision on which apply to your organization.
Structured security: Why compliance frameworks matter
Security compliance frameworks provide a structured set of guidelines and best practices for data security and privacy. These frameworks are often shaped by industry experts and are designed to help companies navigate the complex landscape of cybersecurity. By adhering to a trusted framework, organizations can ensure they are doing their due diligence to protect sensitive data, mitigate security risks, and even comply with legal regulations.
Compliance frameworks serve multiple purposes. First, they offer a roadmap to create a secure environment tailored to specific needs—be it healthcare, finance, or retail. Second, they help standardize security protocols, making it easier for organizations to communicate and collaborate securely. Lastly, in many cases, compliance is not optional. Failing to comply with relevant security frameworks can result in severe financial and legal repercussions, not to mention the potential damage to brand reputation.
How to decide which compliance frameworks to adopt
Each framework has its own set of requirements and audit processes. The choice of which framework(s) to adopt is often guided by several factors:
- Industry Specifics: Some frameworks are specific to certain industries. For example, healthcare organizations in the United States must comply with HIPAA, while financial institutions are typically required to adhere to SOX.
- Geographical Reach: Your location and the locations of your customers can dictate which frameworks you need. For instance, EU customers will require GDPR compliance, and a global market will likely require ISO 27001 certification.
- Business Objectives: Sometimes the choice of framework is also influenced by your business objectives. If you are aiming for a particular market or planning to get acquired, compliance with certain frameworks can make you more appealing to investors or potential buyers.
- Resource Availability: Implementing a compliance framework requires a significant investment of time, personnel, and technology and that level of effort can and will vary depending on framework. Your organization’s resource availability can be a significant factor in deciding which frameworks to adopt and when.
Regulatory Compliance Frameworks
Regulatory frameworks are sets of guidelines, rules, and principles established by regulatory bodies or governments to oversee specific activities, industries, or sectors. These frameworks are legally required and are developed to ensure that the industry operates in a way that's compatible with public interests such as safety, fairness, and environmental sustainability.
Below we’ll explain the basics of eight major regulatory frameworks that are in effect around the globe.
The European Union General Data Protection Regulation (GDPR)
GDPR gives EU citizens greater control over their personal data and reshapes the way organizations must approach data privacy. GDPR applies to both organizations located within the EU and organizations located outside the EU that handle the personal information of EU residents.
GDPR broadly defines personal data as any information relating to an identified or identifiable natural person. This can include name, address, IP address, health information, financial data, and more.
Key regulatory requirements:
- Establish a legal basis for data processing
- Obtain consent from data subjects in a way that is clear, specific, informed, and unambiguous
- Honor data subject rights, including the right to erasure
- Implement technical and organizational safeguards to ensure data security
- Send timely notifications in the event of a data breach
- Appoint a data protection officer (if applicable)
- Design products and services with privacy in mind
- Conduct a data protection impact assessment to explain how you identify and minimize risks
- Restrict personal data transfers outside of the EU
- Determine if data residency laws are applicable to your organization
- Complete privacy awareness training at least annually
The GDPR is enforced by the European Data Protection Board (EDPB), made up of data protection authorities from each of the 27 EU member states. Companies that fail to comply with GDPR can be fined up to €20M or 4% of their annual revenue for the previous fiscal year, whichever is greater.
The California Consumer Privacy Act (CCPA)
The California Consumer Privacy Act (CCPA) is one of the most comprehensive data privacy laws in the US. It grants California consumers more control over their personal information, allowing them to understand how their data is being used, and to request that their data be deleted or not sold to third parties.
The law applies to for-profit entities that do business in California and either have gross annual revenues more than $25 million; buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or derive 50% or more of their annual revenues from selling California residents' personal information.
Key regulatory requirements
- Consumers can request details about the specific personal information a business has collected about them.
- Consumers can ask businesses to delete their personal information.
- Consumers can instruct businesses that sell their personal information to third parties to stop doing so.
- Businesses cannot discriminate against consumers for exercising their rights under the CCPA, such as charging different prices or providing a different level of service.
CCPA is enforced by the California Attorney General. Violations that are not resolved within 30 days of notice can result in civil penalties of up to $2,500 per violation and up to $7,500 per intentional violation. In cases of data breaches, consumers can recover damages of between $100 to $750 per consumer, per incident, or actual damages (whichever is greater).
The Health Insurance Portability and Accountability Act (HIPAA)
The Health Insurance Portability and Accountability Act (HIPAA) is US federal law that establishes standards for the protection of sensitive patient health information.
HIPAA applies to both covered entities (doctors, healthcare clinics, hospitals, etc.) and their business associates (entities that provide services to a covered entity that involve the use or disclosure of protected health information).
Key regulatory requirements:
- Privacy Rule: Protects the privacy of individually identifiable health information known as Protected Health Information (PHI).
- Security Rule: Specifies a series of administrative, physical, and technical safeguards to ensure the confidentiality, integrity, and availability of electronic PHI.
- Breach Notification Rule: Affected individuals must be notified of a breach within 60 days of discovery of the breach. Notifications must be sent in writing. In certain cases, notification must be made to the media and the Secretary of the Department of Health and Human Services (HHS).
- Minimum Necessary Rule: Disclosures or requests of PHI should be limited to the minimum necessary to achieve the purpose.
- Omnibus Rule: This rule incorporates provisions from the HITECH Act and addresses areas like business associate responsibilities and patient rights to electronic copies of their health records.
The HHS Office for Civil Rights (OCR) enforces the Privacy and Security Rules. Violations range depending on the severity and intent behind the violation. Penalties can vary from $100 per violation to $1.5 million, plus criminal penalties.
The Federal Risk and Authorization Management Program (FedRAMP)
FedRAMP is a U.S. federal government program that standardizes the security assessment, risk assessment, authorization, and continuous monitoring processes for cloud services used by federal agencies.
Both commercial and non-commercial cloud services (including those developed internally by federal agencies) must comply with FedRAMP if they are to be adopted by federal entities.
Key regulatory requirements:
- A System Security Plan (SSP) that describes the cloud system boundaries, system environment, how it operates, and the security processes and policies that are in place.
- A set of standardized security controls derived from NIST SP 800-53, including access controls, incident response, contingency planning, and system and information integrity.
- Continuous monitoring and reporting on their security state, including regular reporting, change management processes, and vulnerability scanning.
- Compliance with 26 NIST 800-53 control families
- Annual security assessments conducted by a 3PAO
FedRAMP is managed by the General Services Administration (GSA), while Individual federal agencies are responsible for granting Authority to Operate (ATOs) and ensuring that the cloud services they use are FedRAMP compliant.
Non-compliance means that a cloud service provider may not be granted an ATO, effectively barring them from being adopted by federal agencies.
The Federal Information Security Management Act (FISMA)
The Federal Information Security Management Act (FISMA) is US federal law. It aims to improve the cybersecurity of federal agencies and their information systems by requiring agencies storage develop, document, and implement and information security and protection program.
Key regulatory requirements:
- Risk Assessments: Agencies are required to conduct periodic risk assessments to determine the likelihood and impact of potential security breaches.
- Security Controls: Based on risk levels, government agencies must select and implement appropriate security controls from the NIST Special Publication 800-53.
- Certification and Accreditation: Information systems must be certified for their security processes and then accredited by agency officials to operate.
- Continuous Monitoring: Agencies need to continually monitor their security controls and conduct periodic risk assessments to ensure ongoing effectiveness.
- Incident Reporting: Agencies must have provisions for detecting, reporting, and responding to security incidents.
- Annual Independent Evaluations: Ongoing evaluations of an agency's information security program must be conducted by independent auditors.
FISMA is enforced by the Office of Management and Budget (OMB), while The Department of Homeland Security (DHS) provides implementation support and the National Institute of Standards and Technology (NIST) develops standards and guidelines.
The Cybersecurity Maturity Model Certification (CMMC)
The Cybersecurity Maturity Model Certification (CMMC) is designed to enhance the protection of sensitive defense information, specifically Federal Contract Information (FCI) and Controlled Unclassified Information (CUI), by verifying that companies within the Department of Defense supply chain have the necessary controls in place to adequately protect sensitive data. Starting in 2026, any organization that works as a Department of Defense contractor will be legally required to comply with CMMC standards.
Key regulatory requirements:
- Level 1: Foundational: Organizations have baseline cybersecurity practices in place. Organizations may implement these security practices ad-hoc, without relying on documentation. Certification involves an annual self-assessment. CMMC Level 1 is for DoD contractors and subcontractors that handle Federal Contract Information.
- Level 2: Advanced: Organizations must have formally documented, repeatable processes in place and perform those processes as documented. Organizations that handle information related to national security must undergo a third-party assessment (C3PAO) every three years. Organizations not processing data critical to national security will conduct an annual self-assessment.
- Level 3: Expert: Organizations must have dedicated strategies and resources in place to manage advanced persistent threats (APTs). This typically includes documented goals, projects, resources, and training programs. Level 3 applies to companies that handle the most sensitive information for DoD programs.
The CMMC Accreditation Body trains and accredits Certified Third-Party Assessment Organizations (C3PAOs), which are then tasked with evaluating companies based on CMMC standards. Companies that are not certified to the appropriate CMMC level are not eligible to bid on, or win, DoD contracts that require that level of certification.
The Sarbanes-Oxley Act (SOX)
The Sarbanes-Oxley Act of 2002 (SOX) is a U.S. federal law aimed at improving corporate governance and accountability. It’s designed to protect investors from fraudulent financial reporting by corporations. By emphasizing increased transparency in financial reporting. SOX also holds executives accountable for their companies' financial disclosures.
Key regulatory requirements:
- Corporate Responsibility for Financial Reports: Senior management must certify the accuracy of reported financial statements.
- Management Assessment of Internal Controls: Management and the external auditor must report on the adequacy of a company's internal controls over financial reporting.
- Recordkeeping: SOX includes requirements relating to the destruction, alteration, or falsification of records.
- Penalties for Wrongful Certifications: Penalties are imposed for certifying misleading or fraudulent financial reports.
The Securities and Exchange Commission (SEC) is the primary regulatory body for SOX, overseeing the audits of public companies. Violations for willful violations or misrepresentations can include criminal and civil penalties.
Information Security Compliance Frameworks
Information security frameworks are structured guidelines and best practices designed to help organizations implement, manage, and measure the effectiveness of their information security posture. These frameworks provide a systematic approach to safeguard sensitive data against unauthorized access, disclosure, alteration, and destruction.
While compliance with these frameworks is not legally required, most of them are essential for companies to be competitive in the marketplace. Most customers, especially large enterprises, will not partner with vendors that do not have compliance reports or certifications with certain security frameworks.
We break down the basics of the most in-demand frameworks below.
System and Organization Controls 2 (SOC 2)
SOC 2 aims to provide trust and visibility into a service organization’s ability to maintain data security. Created by the American Institute of Certified Public Accountants (AICPA), SOC 2 focuses on safeguarding sensitive data through the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
There are two types of SOC 2 reports. A Type I report evaluates an organization’s controls at a single point in time. A Type II report assesses how an organization’s controls perform over a period of time, typically 3-12 months. The length of the audit window is up to the organization, but generally organizations will do 3 months their first time and then increase to 6 or 12 months their second time, until they get to doing annual 12 month audit windows.
While not legally required, SOC 2 reports have become a de facto industry standard for data security and management. They’re typically required by enterprises when considering partnerships with third-party vendors.
Compliance requirements vary depending on which Trust Services Criteria are in scope for a SOC 2 audit.
Key security requirements:
Security
- Logical and Physical Access Controls: Ensure only authorized individuals can access systems and data.
- Intrusion Detection: Implement measures to detect and respond to security incidents.
- Data Encryption: Encrypt sensitive data in transit and at rest.
- Firewalls and Network Security: Implement firewalls to block unauthorized access to networks.
Availability
- System Monitoring: Regularly monitor system performance and availability.
- Disaster Recovery and Business Continuity: Establish and maintain a disaster recovery plan to ensure continuous availability of services.
- Incident Handling: Define and follow procedures for managing incidents that affect availability.
- Redundancy: Use redundant systems, data centers, and other essential components to maintain service availability.
Processing Integrity
- Quality Assurance and Error Checking: Implement quality checks to ensure accurate data processing.
- Process Monitoring: Monitor processing systems to detect incomplete, inaccurate, or unauthorized transactions.
- Data Verification: Implement measures to verify data inputs and outputs.
- Integrity Monitoring Tools: Use tools to ensure data integrity during processing and storage.
Confidentiality
- Data Classification: Classify data based on its level of sensitivity.
- Access Restrictions: Restrict access to confidential data based on need-to-know.
- Confidentiality Policies: Develop and communicate policies regarding the handling of confidential data.
- Data Masking and Redaction: Utilize masking and redaction to hide portions of sensitive data where necessary.
Privacy
- Personal Information Identification: Identify personal information (PII) and ensure it's treated with special consideration.
- Privacy Policies: Develop privacy policies and communicate them to relevant stakeholders.
- User Consent: Where applicable, obtain consent for the collection, processing, and sharing of personal data.
- Privacy Training: Train staff about privacy requirements and responsibilities.
International Organization for Standardization/International Electrotechnical Commission 27001 (ISO/IEC 27001)
Similar to SOC 2, ISO 27001 helps organizations protect their information assets. Respected internationally, the standard provides guidelines for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
Companies can choose to become ISO 27001 certified by undergoing an audit performed by an accredited certification body. Certification typically involves two stages: a Stage 1 audit to review documentation, and a Stage 2 audit to assess the effectiveness of the ISMS. Certification is valid for three years, with annual surveillance audits.
Key security requirements:
- ISO 27002:2022 Annex A: This document includes a list of 93 potential security controls that an organization can implement. These controls are grouped into 4 categories, including Organizational, People, Physical, and Technological controls.
- Leadership commitment: Executive management must demonstrate a commitment to the proper creation, maintenance, and continuous improvement of the ISMS.
- Risk assessment: Identify information assets, internal and external threats, vulnerabilities, impacts, likelihoods, and risk levels.
- Risk treatment: Define how the identified risks will be mitigated, avoided, transferred, or accepted. Implement chosen controls and procedures to manage cybersecurity risks.
- Evaluation and improvement: Regular internal audits and management reviews must be conducted to monitor the effectiveness of the ISMS. Any nonconformities must be addressed to continually improve the ISMS.
National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)
The NIST Cybersecurity Framework provides an organized and cost-effective approach to managing cybersecurity risk. One of the most notable aspects of the NIST CSF is its flexibility. Organizations can customize the framework to align with their specific risk profiles and business needs.
The current framework is built around five core functions:
- Identify: Understand cybersecurity risks to systems, people, assets, and data.
- Protect: Implement safeguards to ensure delivery of critical services.
- Detect: Develop a way to identify security events and anomalies.
- Respond: Develop a way to respond to a detected security incident, including communications and analysis.
- Recover: Develop a way to restore capabilities or services after a cybersecurity incident
NIST CSF 2.0 will be released in early 2024 and will include Governance as its sixth core function.
Key security requirements:
- Conducting a risk assessment to understand the organization's risk posture.
- Selecting appropriate security controls based on the risk assessment.
- Implementing policies, procedures, and technology needed to achieve the framework's outcomes.
- Monitoring the effectiveness of security controls and making adjustments as needed.
National Institute of Standards and Technology Risk Management Framework (NIST RMF)
Described in NIST Special Publication 800-37, the Risk Management Framework was designed to help federal agencies and other organizations effectively manage information security risks. It provides a structured process that integrates security and risk management activities into the system development life cycle:
- Prepare: Establish the context, priorities, and resources for the RMF process within the organization.
- Categorize: Identify what kind of information the system processes and how important it is to the organization.
- Select: Choose security controls for the system that are tailored to the categorization of information.
- Implement: Implement the chosen security controls and document their implementation.
- Assess: Test and assess the security controls to ensure they are effective.
- Authorize: Based on the assessment of security controls, authorize the system to operate or deny its operation.
- Monitor: Continuously monitor security controls and risk posture of the information system, reporting on changes.
Key security requirements:
- Conduct a comprehensive risk assessment to understand and document risks.
- Choose appropriate controls from NIST's catalog of security controls (NIST 800-53).
- Complete documentation at each step, including System Security Plans (SSP), Risk Assessment Reports, and Authorization Packages.
- Maintain an ongoing awareness of information security, vulnerabilities, and threats to support organizational risk management decisions.
Payment Card Industry Data Security Standard (PCI DSS)
The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. Created by the Payment Card Industry Security Standards Council (PCI SSC), this standard aims to protect cardholder data from theft and ensure secure payment systems.
PCI DSS compliance is enforced by acquiring banks and card brands. Fines can range from $5,000-$100,000 per month, and other penalties can include increased transaction fees or termination of the ability to accept card payments.
Depending on the annual volume of transactions, companies may need to complete regular security audits by a Qualified Security Assessor (QSA) or complete a Self-Assessment Questionnaire (SAQ).
Key security requirements:
PCI DSS is structured around six core goals, which are divided into twelve key requirements.
1. Build and Maintain a Secure Network and Systems
- Requirement 1: Install and maintain a firewall configuration to protect cardholder data.
- Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters.
2. Protect Cardholder Data
- Requirement 3: Protect stored cardholder data.
- Requirement 4: Encrypt transmission of cardholder data across open, public networks.
3. Maintain a Vulnerability Management Program
- Requirement 5: Use and regularly update antivirus software.
- Requirement 6: Develop and maintain secure systems and applications.
4. Implement Strong Access Control Measures
- Requirement 7: Restrict access to cardholder data by business need-to-know.
- Requirement 8: Identify and authenticate access to system components.
- Requirement 9: Restrict physical access to cardholder data.
5. Regularly Monitor and Test Networks
- Requirement 10: Track and monitor all access to network resources and cardholder data.
- Requirement 11: Regularly test security systems and processes. This includes running scans which are from “Approved Scanning Vendors, commonly known as ASV scans, which is a PCI hard requirement.
6. Maintain an Information Security Policy
- Requirement 12: Maintain a policy that addresses information security for all personnel.
Center for Internet Security (CIS) Controls
The Center for Internet Security Controls (CIS Controls) is a set of best practices designed to help organizations prevent, detect, and mitigate security incidents. The CIS Controls framework consists of a set of controls divided into three categories:
- Basic Controls: Essential actions for cyber defense that provide clear security benefits and are considered fundamental for organizations.
- Foundational Controls: More specialized and detailed security measures that an organization with more mature cybersecurity capabilities should implement.
- Organizational Controls: These controls are focused on the governance and evaluation aspects of cybersecurity.
Key security requirements:
- Keep an active inventory of all hardware devices.
- Maintain an inventory of authorized software and prevent unauthorized software from executing.
- Ensure that sensitive data is encrypted and adequately protected both at rest and in transit.
- Develop and implement an incident response plan and a rapid response capability.
- Train staff and monitor them to ensure they follow best practices.
- Regularly back up systems and data, and ensure that recovery processes are functional.
- Maintain and enforce security configurations for network devices and systems.
- Monitor and control communications crossing network perimeters.
- Make sure sensitive data is encrypted and well-protected, both at rest and in transit.
- Conduct regular penetration tests to ensure controls are effective against active threats.
Microsoft Supplier Security & Privacy Assurance Program (SSPA)
Microsoft SSPA was designed to ensure Microsoft’s suppliers follow standardized security and privacy requirements. It aims to mitigate risks associated with data handling, data storage, and other aspects of information security and privacy.
Key security requirements:
- Suppliers must comply with Microsoft's policies on data protection and adhere to applicable laws and regulations.
- Suppliers are often required to have an ISMS in place that meets Microsoft's standards.
- Suppliers must have a defined incident response plan that includes notifying Microsoft in the case of any security or data breach incidents.
- Strict access controls on Microsoft-related data, including multi-factor authentication and periodic access reviews.
- Data, both at rest and in transit, must be encrypted as per Microsoft’s requirements.
- Suppliers are subject to audits to verify compliance with SSPA requirements, and may need to produce evidence of internal audits, security certifications, or other indicators of security and privacy measures.
- Some suppliers may be required to undergo third-party security assessments as part of the SSPA program.
Control Objectives for Information and Related Technologies (COBIT)
Originally developed by ISACA (Information Systems Audit and Control Association), COBIT has become a leading governance, risk, and compliance framework. It seeks to align an organization’s IT processes and compliance program with business objectives.
Key security requirements:
- Identifying, assessing, and managing IT risks.
- Ensuring optimal utilization of IT resources, including people, information, infrastructure, and applications.
- Meeting compliance needs with regard to laws, regulations, and contractual agreements.
- Aligning IT goals and processes with the organization’s strategic objectives and business functions.
- Setting up KPIs and other metrics to track the performance of IT services and processes.
- Ensuring the confidentiality, integrity, and availability of information assets.
- Establishing processes for continuous improvement and quality assurance in IT operations.
How to simplify and strengthen your compliance posture with automation
Automation is fundamentally changing the way companies achieve and maintain regulatory and security compliance.
GRC automation platforms can streamline evidence collection, simplify vendor management, facilitate employee training, eliminate duplicated efforts for multiple compliance audits, and accelerate final audit reports — all adding up to substantial time and cost savings.
With over 20 frameworks built in house, plus custom framework capabilities, learn more about how Securefame can help automate these compliance frameworks by scheduling a demo.
