What is the CMMC Standard? The CMMC certification methodology was developed by the Department of Defense (DoD) to ensure that contractors have safeguards in place to secure sensitive data,...
What is the FFIEC Compliance Framework? The Federal Financial Institutions Inspection Council (FFIEC) is a structured interagency body made up of five banking regulators who are in charge of...
What is HIPAA? The Health Insurance Portability and Transparency Act of 1996 (HIPAA), is a collection of regulations that ensure the lawful use and disclosure of protected health information...
What is the NIST SP 800-82 framework? The National Institute of Standards and Technology (NIST) Special Publication 800-82 offers detailed assistance regarding how to protect Industrial Control Systems (ICS),...
What is the Sarbanes-Oxley Act? Sarbanes-Oxley Act (SOX), is a regulation that was signed into law on July 30, 2002. For compliance, all institutional investors are expected to install...
What is NIST Zero Trust? NIST Zero Trust Architecture (ZTA) is a cybersecurity framework developed by the National Institute of Standards and Technology (NIST) to guide organizations in moving...
What is NERC CIP compliance? The North American Electric Reliability Corporation (NERC) is a global regulatory authority that operates to reduce the risks associated with power grid infrastructure. This...
What is the NYDFS Cybersecurity Regulation? The New York Department of Financial Services (NYDFS) Cybersecurity Regulation (23 NYCRR 500) is a set of rules issued by the New York...
What is the GDPR? The General Data Protection Regulation (GDPR) is one of the world’s most influential privacy laws, designed to protect personal data and reinforce individuals’ rights over...
What is the NIST Privacy Framework? The National Institute of Standards and Technology (NIST) recently released the Privacy Framework, which assists organizations in prioritizing privacy threats and outcomes, and...
What is SOC 2 Type II compliance? SOC 2 (System and Organization Controls 2) is an auditing process developed by the American Institute of CPAs (AICPA). Its primary initiative...
What is HECVAT? The Higher Education Community Vendor Assessment Toolkit (HECVAT) is a risk assessment template that was created in 2016 specifically for higher education institutions to assess vendor...
What is FERPA? The Family Educational Rights and Privacy Act (FERPA) of 1974, also known as the Buckley Amendment, is a Federal privacy law that protects the privacy of...
What is the NIST 800-171? The National Institute of Standards and Technology (NIST) is a non-regulatory agency of the U.S. Commerce Department, responsible for conducting research and establishing standards...
What is NIST 800-53? NIST 800-53 is a comprehensive set of guidelines developed by the National Institute of Standards and Technology (NIST) aimed at helping organizations manage and protect...
What is the COSO Framework? The Committee of Sponsoring Organizations of the Treadway Commission (COSO), a voluntary private-sector initiative, was established in 1985 to improve business performance and governance...
What is the ISA/IEC 62443 framework? The International Society of Automation (ISA) and the International Electrotechnical Commission (IEC) joined forces to develop the 62443 series. ISA/IEC 62443 is a...
What is the NIST SP 800-46 framework? The US Commerce Department’s National Institute of Standards and Technology (NIST) is a non-regulatory body responsible for investigating and developing standards for...
What is the NY SHIELD Act? On March 21, 2020, the data security provisions of New York’s Stop Hacks and Improve Electronic Data Security Act (“SHIELD Act”) came into...
Updated November 2026: this article was written in 2021, and the PSD2 compliance deadlines below have passed. What is PSD2? The Payment Services Directive (PSD) of 2007, was replaced...
What is COBIT 5? COBIT is an IT management framework created by ISACA (Information Systems Audit and Control Association), which helps organizations achieve their goals for governance and management...
What is the ICDM Framework? The Israeli Cyber Defense Methodology (ICDM), also known as The Corporate Defense Methodology is part of the National Defense Concept, which includes a variety...
What is OWASP ASVS? The Application Security Verification Standard (ASVS) v5.0.0 is OWASP’s leading framework for defining and assessing the security of web applications and APIs. Version 5 introduces...
What is FedRAMP? The Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide framework that created a standardized process for assessing, authorizing and continuously monitoring cloud services...
What is the MITRE ATT&CK Framework? MITRE ATT&CK is a framework that organizes and categorizes the different approaches, strategies and procedures utilized by threat actors in the digital environment,...
What is ISO/IEC 27001? ISO/IEC 27001 is a member of the ISO 27000 family of standards. The ISO 27001 standard is internationally accepted as a specification for an Information...
What are the CIS Controls? The CIS Critical Security Controls (CSC) are published by the Center for Internet Security (CIS) to assist organizations in better defending against well-known threats...
Updated November 2026: this article was written in 2021, when CCM v4 was new. CSA released CCM v4.1 and CAIQ v4.1 in January 2026; STAR accepts v4.0 and v4.1...
ISO/IEC 27701:2025 is the international standard for Privacy Information Management Systems (PIMS). It provides requirements and guidance for establishing, implementing, maintaining, and continually improving a system for managing personally...
What is the GLBA Act? The Gramm-Leach-Bliley Act (GLBA), also recognized as the Financial Modernization Act of 1999, is a federal law in the United States that requires the...