Updated October 24, 2026 (CIRCIA and CMMC status rechecked). We rewrote this guide to reflect the laws and rules in force today, including recent changes to the FTC Safeguards Rule, the SEC’s cyber disclosure rules, CIRCIA, CMMC and new EU laws. Each status below was checked in September 2026 and links to its source. This is general information, not legal advice.
There is no single U.S. cybersecurity law. Instead, organizations face a patchwork: federal rules for specific sectors (healthcare, finance, government and defense), disclosure rules for public companies, state privacy and breach notification laws, and criminal laws that punish hacking. Companies that operate in Europe also have to deal with GDPR, NIS2, DORA and the Cyber Resilience Act.
This guide explains what each major law covers, who it applies to and where it stands in 2026.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Cybersecurity laws at a glance (October 2026)
| Law or rule | Who it covers | Key requirement | Status |
|---|---|---|---|
| HIPAA Security Rule | Health plans, most providers, clearinghouses and their business associates | Administrative, physical and technical safeguards for electronic health data | In force; major update proposed Jan 2025, not final |
| GLBA / FTC Safeguards Rule | Non-bank financial firms (lenders, auto dealers, tax preparers and others) | Written security program, MFA, encryption; report breaches of 500+ consumers to the FTC | In force (breach reporting since May 13, 2024) |
| Bank incident notification rule | Banks and their service providers | Notify regulators within 36 hours of a significant incident | In force since May 1, 2022 |
| FISMA | Federal agencies and their contractors’ systems | Risk-based security programs based on NIST standards, annual reviews | In force (updated 2014) |
| CIRCIA | Critical infrastructure entities (to be defined in the final rule) | Report major incidents within 72 hours, ransom payments within 24 hours | Law passed 2022; final rule under White House review since Oct 1, 2026 |
| SEC cyber disclosure rules | U.S. public companies | Disclose material incidents within 4 business days of the materiality decision; annual risk management disclosure | In force since Dec 2023 |
| CMMC | Defense contractors handling federal contract or controlled unclassified information | Meet NIST SP 800-171 and assess compliance | Phase 1 in force; Phase 2 suspended July 2026 |
| State privacy and breach laws | Businesses holding residents’ personal data | Reasonable security, breach notification, consumer privacy rights | All 50 states have breach laws; 24 have comprehensive privacy laws |
| CFAA | Everyone | Criminalizes unauthorized access to computers | In force |
| EU NIS2, DORA, CRA, GDPR | Companies operating in or selling to the EU | Risk management, incident reporting, secure products, data protection | NIS2 and DORA apply now; CRA reporting from Sept 11, 2026 |
Healthcare: HIPAA
The Health Insurance Portability and Accountability Act (HIPAA) Security Rule requires covered entities and their business associates to protect electronic protected health information with administrative, physical and technical safeguards, including a risk analysis. The Breach Notification Rule requires notifying affected individuals, HHS and, for large breaches, the media.
What’s changing: In January 2025, HHS proposed the first major update to the Security Rule in years. It would make most safeguards mandatory, including multi-factor authentication, encryption, asset inventories and regular vulnerability scanning (Federal Register). As of mid-2026, the rule is not final: HHS moved it to its long-term actions list and now projects final action for July 2027 (Davis Wright Tremaine). The current Security Rule remains fully enforceable. For more on the threats hospitals face, see our healthcare cybersecurity guide.
Finance: GLBA, the FTC Safeguards Rule and banking rules
The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to protect customer information. For non-bank financial companies such as mortgage brokers, auto dealers, payday lenders and tax preparers, the FTC enforces it through the Safeguards Rule.
Amendments that took effect on June 9, 2023 require a written information security program overseen by a “qualified individual,” a written risk assessment, multi-factor authentication, encryption of customer data, and regular testing and reporting to the board (FTC). Since May 13, 2024, covered companies must also notify the FTC within 30 days of discovering a breach involving unencrypted information of at least 500 consumers (FTC).
Other financial rules to know:
- Bank incident notification rule: banks must notify their federal regulator within 36 hours of a significant computer-security incident, with compliance required since May 1, 2022 (FDIC).
- SEC Regulation S-P: amendments adopted in 2024 require brokers, investment advisers and similar firms to have an incident response program and notify affected customers within 30 days. Larger firms had to comply by December 2025 and smaller firms by June 2026 (SEC).
- New York DFS Part 500: New York’s cybersecurity regulation for banks, insurers and other licensed firms was amended in 2023. The final requirements, including broad MFA and a full asset inventory, took effect on November 1, 2025 (Greenberg Traurig).
Government: FISMA
The Federal Information Security Modernization Act of 2014 (FISMA) requires federal agencies to run risk-based security programs based on NIST standards, report incidents and undergo annual reviews. It updated the original 2002 law and gave the Department of Homeland Security, where CISA now leads this work, an operational role in federal cybersecurity (CISA). Contractors that run systems for agencies are usually bound by FISMA requirements through their contracts.
Critical infrastructure: CIRCIA
The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. The law only takes effect through CISA’s final rule.
CISA published its proposed rule in April 2024. CISA missed its September 2026 target and sent the draft final rule to the White House Office of Information and Regulatory Affairs (OIRA) for review on October 1, 2026 (Covington). OIRA review usually takes up to 90 days, so publication is expected in early 2027, with reporting duties starting after an effective date set in the rule. CISA says funding lapses slowed the work, and it held four town hall meetings on the rule in June 2026 (CISA). Until the rule is final, reporting to CISA is voluntary, though sector rules may already require it. Our guide to cyber attacks on critical infrastructure explains why these sectors are a priority.
A related law, the Cybersecurity Information Sharing Act of 2015, gives companies legal protections when they share threat information with the government and each other. It was written to last 10 years and has since been kept alive with short-term extensions; the latest runs to December 11, 2026, according to the Congressional Research Service. Check its status if your company depends on those protections.
Public companies: SEC cybersecurity disclosure rules
Rules the SEC adopted in July 2023 require public companies to:
- File a Form 8-K (Item 1.05) within four business days of determining that a cybersecurity incident is material, describing its nature, scope, timing and likely impact.
- Describe their cybersecurity risk management, strategy and governance, including board oversight, in their annual 10-K (Regulation S-K Item 106).
The rules took effect in December 2023, with smaller reporting companies following in June 2024 (SEC). Banking and financial industry trade groups petitioned the SEC in May 2025 to rescind the incident disclosure requirement (SEC petition), and the SEC is reviewing Regulation S-K disclosures. As of September 2026, the rules have not been rescinded and remain in effect.
Defense contractors: CMMC
The Cybersecurity Maturity Model Certification (CMMC) program checks that defense contractors protect federal contract information (FCI) and controlled unclassified information (CUI). It has three levels:
- Level 1: 15 basic safeguarding requirements for FCI, with an annual self-assessment.
- Level 2: the 110 requirements of NIST SP 800-171 for CUI, verified by self-assessment or a third-party assessor (C3PAO).
- Level 3: Level 2 plus selected NIST SP 800-172 requirements, assessed by the government.
The program rule (32 CFR Part 170) took effect in December 2024, and the rule adding CMMC to defense contracts took effect on November 10, 2025, starting Phase 1 (Federal Register). Phase 2, which would have required third-party Level 2 certifications from November 10, 2026, was suspended on July 13, 2026 while the department reviews the program. A September 3, 2026 class deviation (2026-O0025, Revision 3) tells contracting officers to remove third-party assessment requirements from new and existing contracts; as of late October 2026 no restart date has been announced (Dentons). During the suspension, contracts may only require Level 1 or Level 2 self-assessments, and existing obligations such as NIST SP 800-171 and incident reporting under DFARS still apply (Morgan Lewis; DoD CIO). For the self-assessment, SPRS and affirmation steps that still apply, see our guide to CMMC after the Phase 2 suspension.
State laws: breach notification and privacy
All 50 states, plus D.C. and U.S. territories, have laws requiring businesses to notify people when their personal information is breached (NCSL). Deadlines and definitions vary, so companies with customers in many states have to follow the strictest rules that apply.
States have also passed comprehensive consumer privacy laws that give residents rights over their data and require “reasonable” security. As of August 2026, 24 states have enacted one; Alabama, Louisiana, Oklahoma and Vermont were added in 2026, with effective dates in 2027 and 2028 (Privacy World).
California goes further. Regulations effective January 1, 2026 require certain businesses to conduct annual cybersecurity audits and risk assessments, with the first audit certifications phased in starting in 2028 for the largest companies (California Privacy Protection Agency).
Criminal law: the Computer Fraud and Abuse Act
The Computer Fraud and Abuse Act (CFAA) is the main federal anti-hacking law. It makes it a crime to access a computer without authorization or to exceed authorized access, and it also covers spreading damaging code and trafficking in passwords (18 U.S.C. § 1030). Victims can also sue under it.
Two changes narrowed its reach. In Van Buren v. United States (2021), the Supreme Court held that someone “exceeds authorized access” only when they enter parts of a system that are off-limits to them, not when they misuse data they are allowed to see (Supreme Court opinion). In May 2022, the Justice Department said it would not charge good-faith security research under the CFAA (DOJ Justice Manual 9-48.000). If you’re considering a career in penetration testing, stay within written scope and authorization.
Cybercrime is still hard to prosecute. Attackers often operate from countries that won’t extradite them, many victims never report, and criminals use cryptocurrency and anonymizing services to hide. Reporting to the FBI’s Internet Crime Complaint Center helps investigators connect cases and sometimes recover funds.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
International laws: GDPR, NIS2, DORA and the Cyber Resilience Act
- GDPR: the EU’s data protection law requires appropriate security for personal data and notifying regulators of breaches within 72 hours where feasible. Fines can reach €20 million or 4% of global annual turnover (GDPR text).
- NIS2: expands EU cybersecurity duties to many more sectors, such as energy, transport, health, digital infrastructure and manufacturing. It requires risk management measures, management accountability and staged incident reporting (an early warning within 24 hours, a notification within 72 hours and a final report within a month). Member states had until October 17, 2024 to write it into national law, and in November 2024 the Commission warned 23 countries that had not fully done so (European Commission; Commission notice). Check the national law in each country where you operate.
- DORA: the Digital Operational Resilience Act has applied to EU financial firms since January 17, 2025. It covers ICT risk management, incident reporting, resilience testing and oversight of critical tech providers (ESMA).
- Cyber Resilience Act (CRA): sets security requirements for hardware and software products sold in the EU. It entered into force on December 10, 2024. Reporting of actively exploited vulnerabilities applies from September 11, 2026, and the main obligations from December 11, 2027 (European Commission).
Incident reporting deadlines by regulation
When something goes wrong, the clock that matters is the reporting deadline. These are the main ones, with the current status noted where a rule is not yet in force.
| Rule | Who reports | Deadline |
|---|---|---|
| SEC Form 8-K Item 1.05 | US public companies | 4 business days after deciding an incident is material |
| CIRCIA (not yet in force) | Covered critical infrastructure entities | 72 hours for covered incidents; 24 hours after a ransom payment (proposed rule) |
| DFARS 252.204-7012 | Defense contractors with covered defense information | 72 hours to DoD |
| NYDFS Part 500 | NY-licensed banks, insurers and financial firms | 72 hours to DFS |
| FTC Safeguards Rule | Non-bank financial institutions | 30 days to the FTC for events affecting 500 or more consumers |
| HIPAA Breach Notification Rule | Covered entities and business associates | Without unreasonable delay, no later than 60 days after discovery |
| SEC Regulation S-P | Brokers, advisers and similar firms | Notify affected customers within 30 days |
| GDPR Article 33 | Organizations handling EU personal data | 72 hours to the supervisory authority |
| EU NIS2 Article 23 | Essential and important entities in the EU | 24-hour early warning, 72-hour notification, final report within one month |
Sources: SEC, CISA, DFARS 252.204-7012, NYDFS, FTC, HHS, GDPR Art. 33, NIS2.
How to stay compliant
Most of these laws ask for the same basics: know your data and systems, assess risk, use MFA and encryption, patch, train staff, manage vendors, and have a tested incident response plan with clear reporting deadlines. The practical approach is to build one security program on a recognized framework and map each law’s specific requirements to it.
- Our guide to cybersecurity frameworks compares NIST CSF 2.0, CIS Controls, ISO 27001 and others.
- Our cybersecurity compliance guide explains how to turn requirements into controls and evidence.
- Password and MFA rules show up in almost every regulation. See our password policy best practices.
- Working with the U.S. Department of Defense? Our guide to IAM vs IAT certifications covers the DoD 8140 workforce requirements, and our DoD 8140 approved certifications list shows which certs qualify for each work role.
Rules change fast. The CyberExperts Daily Brief tracks new regulations, deadlines and enforcement actions in a short weekday email.
Frequently asked questions
What are the main cybersecurity laws in the United States?
The main ones are HIPAA (healthcare), GLBA and the FTC Safeguards Rule (finance), FISMA (federal agencies), the SEC’s cyber disclosure rules (public companies), CMMC (defense contractors), CIRCIA (critical infrastructure, once its final rule is issued), state breach notification and privacy laws, and the Computer Fraud and Abuse Act, which criminalizes hacking.
Is there a federal data breach notification law?
No single federal law covers all businesses. Every state has its own breach notification law, and sector rules add federal duties: HIPAA for health data, the FTC Safeguards Rule for non-bank financial firms, the 36-hour bank rule, and SEC disclosure for public companies.
Is CIRCIA in effect?
Not yet. CISA sent the draft final rule to the White House for review on October 1, 2026, and publication is expected in early 2027. Reporting under CIRCIA becomes mandatory only after the final rule sets an effective date. Until then, reporting to CISA is voluntary unless a sector rule already requires it.
How fast do public companies have to report a cyberattack?
Under the SEC’s 2023 rules, a public company must file a Form 8-K within four business days after it determines an incident is material. The clock starts at the materiality decision, not at the discovery of the attack, but companies must make that decision without unreasonable delay.
Is CMMC required now?
Phase 1 has applied since November 10, 2025, so many defense contracts require Level 1 or Level 2 self-assessments. Phase 2, which would have required third-party Level 2 certification from November 2026, was suspended in July 2026 pending a program review.
Does the HIPAA Security Rule require MFA?
The current rule doesn’t explicitly require MFA, but it requires safeguards based on a risk analysis, and regulators expect strong access controls. The January 2025 proposal would make MFA mandatory, but it isn’t final as of September 2026.
What law makes hacking illegal?
In the U.S., the Computer Fraud and Abuse Act (18 U.S.C. § 1030) makes unauthorized access to computers a federal crime. States have their own computer crime laws too. Security testing is legal only with clear written authorization.
What are cybersecurity regulations?
Cybersecurity regulations are binding rules, set by laws or by agencies such as the SEC, FTC, HHS and state regulators, that require organizations to protect systems and data and to report incidents. They differ from voluntary frameworks like the NIST Cybersecurity Framework, which many regulators point to as a way to meet the rules.
Sources
- Federal Register, HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information (proposed rule, Jan 6, 2025): federalregister.gov
- Davis Wright Tremaine, HHS Updates HIPAA Rulemaking Timeframes (July 2026): dwt.com
- FTC, FTC Safeguards Rule: What Your Business Needs to Know: ftc.gov
- FTC, FTC Amends Safeguards Rule to Require Non-Banking Financial Institutions to Report Data Security Breaches: ftc.gov
- FDIC, Computer-Security Incident Notification Implementation (FIL-12-2022): fdic.gov
- SEC, SEC Adopts Amendments to Regulation S-P (2024-58): sec.gov
- Greenberg Traurig, NYDFS Final Cybersecurity Rules (Nov 2025): gtlaw.com
- CISA, Federal Information Security Modernization Act: cisa.gov
- CISA, Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA): cisa.gov
- Congressional Research Service, The Cybersecurity Information Sharing Act of 2015: Expiring Provisions (IF12959): congress.gov (PDF)
- SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies (2023-139): sec.gov
- SEC, Joint Petition for Rulemaking to rescind Form 8-K Item 1.05 (May 2025): sec.gov
- Federal Register, DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (Sept 10, 2025): federalregister.gov
- Morgan Lewis, Department of War Suspends CMMC Phase II Requirements, but Cybersecurity Obligations Remain (July 2026): morganlewis.com
- DoD CIO, Cybersecurity Maturity Model Certification: dodcio.defense.gov
- NCSL, Security Breach Notification Laws: ncsl.org
- Privacy World, Adding to the Count: The latest in state consumer privacy laws (Aug 2026): privacyworld.blog
- California Privacy Protection Agency, CCPA Updates, Cybersecurity Audits, Risk Assessments and ADMT Regulations: cppa.ca.gov
- Legal Information Institute, 18 U.S. Code § 1030: law.cornell.edu
- Supreme Court, Van Buren v. United States (2021): supremecourt.gov (PDF)
- U.S. Department of Justice, Justice Manual 9-48.000, Computer Fraud and Abuse Act (charging policy revised May 19, 2022): justice.gov
- GDPR text: gdpr-info.eu
- European Commission, NIS2 Directive: digital-strategy.ec.europa.eu
- ESMA, Digital Operational Resilience Act (DORA): esma.europa.eu
- European Commission, Cyber Resilience Act: digital-strategy.ec.europa.eu
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
CMMC After the Phase 2 Suspension: What Contractors Still Have to Do in 2026
Short answer: on July 13, 2026, the Department of War suspended the move to CMMC Phase 2, which was due on November...
Blue Team Certifications (2026): CySA+, GCIA, BTL1 and SC-200 Compared
Blue team certifications compared from the issuers' own pages: CompTIA CySA+ V4, GIAC GCIA, BTL1 from Centri (Security Blue Team) and Microsoft...
Digital Forensics Certifications (2026): GCFA, CHFI, EnCE and CCE Compared
Digital forensics certifications compared from the issuers' own pages: GIAC GCFA and GCFE, EC-Council CHFI, OpenText EnCE and ISFCE CCE, with exam...
Monday’s brief: Ivanti’s last VPN fix is due today, then WordPress update attacks, a fake Claude Code extension and Drupal stores
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
