5 Critical Cybersecurity Compliance Requirements

Updated September 2026. We rewrote this guide for the current rules. The old version covered CMMC 1.0, the EU-U.S. Privacy Shield (invalidated in 2020) and 2020-era state laws. This version reflects the FTC Safeguards Rule updates, the SEC’s cyber disclosure rules, CMMC 2.0, PCI DSS 4.0.1, ISO 27001:2022, NIST CSF 2.0 and the EU’s NIS2 and DORA. This is general information, not legal advice.

Cybersecurity compliance means meeting the security requirements that apply to your organization. Those come from three places: laws and regulations (like HIPAA or the SEC rules), contracts and industry standards (like PCI DSS for card payments or CMMC for defense work), and frameworks you use to organize and prove your controls (like NIST CSF 2.0, CIS Controls or ISO 27001). The details vary, but almost every rule asks for the same five things, which are covered below.

Which compliance rules apply to you?

For the current status of each law, including rules still in progress like CIRCIA and the proposed HIPAA Security Rule update, see our guide to cybersecurity laws and regulations.

The 5 critical cybersecurity compliance requirements

1. A documented risk assessment and governance

Nearly every rule starts here: know what data and systems you have, assess the risks to them, and assign someone accountable. The HIPAA Security Rule requires a risk analysis. The FTC Safeguards Rule requires a written risk assessment, a “qualified individual” to run the program and regular reports to the board (FTC). Public companies must describe how they manage cyber risk and how the board oversees it in their annual 10-K (SEC). NIST CSF 2.0 added a “Govern” function for the same reason (NIST).

What to have ready: an asset and data inventory, a dated risk assessment, a named security owner, written policies and evidence of leadership review.

2. Access control and multi-factor authentication

MFA has moved from best practice to requirement. The FTC Safeguards Rule requires MFA for anyone accessing customer information systems. New York’s Part 500 required MFA for all users of covered systems from November 1, 2025 (Greenberg Traurig). NIST SP 800-171, the basis of CMMC Level 2, requires MFA for privileged accounts and network access. Regulators also expect least privilege, prompt removal of former employees’ access and periodic access reviews.

What to have ready: MFA coverage reports, access review records and offboarding logs. See our password policy best practices for current NIST password and MFA guidance.

3. Data protection: encryption, retention and secure configuration

Most rules require protecting sensitive data in storage and in transit, usually with encryption, and keeping it only as long as needed. The FTC Safeguards Rule requires encryption of customer information, GDPR calls for “appropriate technical and organisational measures,” and state privacy laws require “reasonable” security. PCI DSS 4.0.1 added new requirements, mandatory since March 31, 2025, including controls on scripts running on payment pages to prevent card skimming (PCI Security Standards Council).

What to have ready: a data classification and retention policy, encryption settings, secure configuration baselines and patching records.

4. Incident response and reporting deadlines

Every major rule now sets a reporting clock, and the deadlines are short:

What to have ready: a written incident response plan with named roles, a contact list for regulators and counsel, a way to make materiality decisions quickly, and records of tabletop exercises.

5. Third-party and vendor oversight

Regulators hold you responsible for the vendors that handle your data. The FTC Safeguards Rule requires overseeing service providers, NYDFS Part 500 requires third-party service provider policies, and DORA requires EU financial firms to manage ICT third-party risk (ESMA). Defense contractors must pass CMMC requirements down to subcontractors that handle covered information. It matters in practice too: Verizon found a third party involved in 48% of breaches in its 2026 report (Verizon).

What to have ready: a vendor inventory ranked by risk, security clauses in contracts, SOC 2 or ISO 27001 reports from key providers, and review records.

Frameworks that help you prove compliance

• NIST Cybersecurity Framework (CSF) 2.0: released in February 2024, it organizes security outcomes into six functions (Govern, Identify, Protect, Detect, Respond, Recover). It’s voluntary but widely used to structure programs and report to boards.
• CIS Controls v8.1: 18 prioritized controls. Implementation Group 1’s 56 safeguards are a practical baseline for small organizations (CIS).
• ISO/IEC 27001:2022: the international, certifiable standard for an information security management system. Certificates to the old 2013 version had to be moved to the 2022 version by October 31, 2025 (SGS).
• SOC 2: an independent attestation report on a service organization’s controls under the AICPA Trust Services Criteria, commonly requested by business customers (AICPA).
• NIST SP 800-171: 110 security requirements for protecting controlled unclassified information, used by CMMC Level 2 (NIST).
• PCI DSS 4.0.1: the current card-data security standard. Version 4.0 was retired at the end of 2024.

Our guide to cybersecurity frameworks compares these in more depth and explains how to combine them.

CMMC in 2026: where it stands

CMMC Phase 1 took effect on November 10, 2025, when the rule adding CMMC to defense contracts became effective (Federal Register). Phase 2, which would have required third-party Level 2 certifications from November 10, 2026, was suspended on July 13, 2026 while the Defense Department reviews the program. Level 1 and Level 2 self-assessments, NIST SP 800-171 and DFARS incident reporting still apply (Morgan Lewis).

How to build a compliance program

1. Assign ownership. Name an accountable security lead and involve legal, IT, HR and finance.
2. Map your obligations. List the laws, contracts and standards that apply, using the table above as a starting point.
3. Pick one control framework (CSF 2.0, CIS or ISO 27001) and map every obligation to it, so you build controls once and reuse the evidence.
4. Run a gap assessment and fix the biggest risks first: MFA, patching, backups, logging and incident response. Our list of essential cybersecurity controls and our cybersecurity checklist help here.
5. Collect evidence continuously rather than scrambling before audits, and test your incident response plan at least once a year.
6. Review regularly. Rules change. In 2026 alone, CMMC Phase 2 was suspended, EU Cyber Resilience Act reporting began, and new state privacy laws passed.

Compliance isn’t the same as security. Passing an audit shows you met a baseline on a given day, so treat the requirements as a floor, not a finish line.

To keep up with new rules, deadlines and enforcement actions, sign up for the CyberExperts Daily Brief.

Frequently asked questions

Sources

• FTC, FTC Safeguards Rule: What Your Business Needs to Know: ftc.gov
• SEC, SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure (2023-139): sec.gov
• NIST, The NIST Cybersecurity Framework (CSF) 2.0: nist.gov (PDF)
• Greenberg Traurig, NYDFS Final Cybersecurity Rules (Nov 2025): gtlaw.com
• PCI Security Standards Council, Just Published: PCI DSS v4.0.1: pcisecuritystandards.org
• eCFR, 45 CFR 164.404 (HIPAA notification to individuals): ecfr.gov
• ESMA, Digital Operational Resilience Act (DORA): esma.europa.eu
• Verizon, 2026 Data Breach Investigations Report: verizon.com
• Center for Internet Security, CIS Controls v8.1: cisecurity.org
• SGS, Last Chance to Transition to ISO/IEC 27001:2022 (Sept 2025): sgs.com
• AICPA & CIMA, SOC 2: aicpa-cima.com
• NIST, SP 800-171 Rev. 2: csrc.nist.gov
• Federal Register, DFARS: Assessing Contractor Implementation of Cybersecurity Requirements (Sept 10, 2025): federalregister.gov
• Morgan Lewis, Department of War Suspends CMMC Phase II Requirements (July 2026): morganlewis.com

George Mutune

I am a cyber security professional with a passion for delivering proactive strategies for day to day operational challenges. I am excited to be working with leading cyber security teams and professionals on projects that involve machine learning & AI solutions to solve the cyberspace menace and cut through inefficiency that plague today's business environments.