3. CIS Critical Security Controls v8.1
The CIS Critical Security Controls v8.1 organizes practical defensive measures into 18 Controls and a more detailed set of Safeguards. They cover core work such as asset inventory, secure configuration, access management, vulnerability management, logging, and incident response. The Safeguards are grouped into three Implementation Groups. IG1 is the essential cyber hygiene baseline and the recommended starting point for every organization. IG2 and IG3 add safeguards for environments with greater complexity, more sensitive data, or higher risk.
Why it matters
The CIS Controls turn broad security goals into a practical work plan. They are a useful choice for teams that need to decide what to implement first and how to build from a basic baseline.
4. SOC 2
A SOC 2 examination is performed by an independent CPA firm. The resulting attestation report describes controls relevant to the AICPA Trust Services Criteria. Security is included in every SOC 2 examination. Availability, Processing Integrity, Confidentiality, and Privacy are included when they are relevant to the engagement.
A Type I report evaluates the design of controls at a point in time. A Type II report also evaluates whether the controls operated effectively over a defined period. A useful review goes beyond the report type. It should consider the system boundary, the auditor’s opinion, any exceptions, complementary user entity controls, and the treatment of subservice organizations.
Why it matters
A SOC 2 Type II report can provide valuable evidence about a vendor’s control environment. Its value depends on whether the scope covers the service being purchased and whether the customer understands any responsibilities assigned to it.
5. COBIT 2019
COBIT 2019 is ISACA’s framework for governing and managing enterprise information and technology. Its 40 governance and management objectives help organizations connect technology decisions with business goals, risk, performance, and accountability. COBIT is often paired with a more technical framework or control set. It helps define who makes decisions, who is accountable, and how technology performance and risk should be governed across the enterprise.
Why it matters
COBIT is useful when cybersecurity work needs stronger ties to enterprise governance, executive ownership, and board reporting.
6. PCI DSS 4.0.1
The Payment Card Industry Data Security Standard applies to entities that store, process, or transmit cardholder data or sensitive authentication data. It also covers entities that can affect the security of the cardholder data environment. The PCI Security Standards Council maintains the standard, while payment brands and acquiring banks manage compliance programs and enforcement. PCI DSS v4.0.1 is the active version. It clarified v4.0 without adding or removing requirements. Requirements that were initially future-dated took effect on March 31, 2025. Areas of focus include multifactor authentication, payment-page script security, vulnerability management, targeted risk analysis, and clear responsibility for controls shared with service providers.
Why it matters
Cardholder data can move through systems and providers that sit outside the obvious payment application. Organizations need a current view of that environment and evidence that required controls work throughout the year.
7. NERC Critical Infrastructure Protection standards
The North American Electric Reliability Corporation Critical Infrastructure Protection standards, commonly called NERC CIP, are mandatory reliability standards for applicable entities and Bulk Electric System cyber systems in the United States and parts of Canada. They address topics such as asset identification, electronic and physical security, personnel and training, incident response, configuration management, vulnerability assessments, recovery planning, and supply chain risk. The requirements that apply depend on an entity’s functions and the impact classification of its systems.
Why it matters
For organizations in scope, cyber risk can affect the reliability of the electric grid. NERC CIP therefore requires documented, repeatable controls and can carry significant penalties when those requirements are not met.
8. HIPAA Security Rule
The HIPAA Security Rule is a U.S. federal regulation that protects electronic protected health information, or ePHI. It applies to covered entities and business associates and requires appropriate administrative, physical, and technical safeguards. Regulated organizations must conduct risk analyses and manage identified risks. They also need appropriate access controls, audit controls, contingency planning, and business associate agreements. HHS proposed substantial changes to the Security Rule in late 2024, with publication in January 2025. As of September 2026, HHS still identifies those changes as a proposed rule and states that the current Security Rule remains in effect.
Why it matters
HIPAA security work starts with knowing where ePHI is created, stored, processed, and transmitted. That includes understanding which business associates can access it and how risk decisions are documented over time.
9. FISMA and the NIST Risk Management Framework
The Federal Information Security Modernization Act, or FISMA, requires U.S. federal agencies to maintain agency-wide information security programs. Its requirements also cover information systems used or operated by contractors or other organizations on behalf of an agency. A company does not fall under FISMA simply because it handles some form of federal data, although other contractual security requirements may still apply. FISMA implementation relies heavily on NIST standards. NIST SP 800-53 provides the control catalog, while the NIST Risk Management Framework sets out a seven-step process:
- Prepare
- Categorize
- Select
- Implement
- Assess
- Authorize
- Monitor.
Why it matters
An Authorization to Operate reflects a risk decision about a defined system. Maintaining that authorization requires continued monitoring because systems, suppliers, vulnerabilities, and threats change.
10. Cybersecurity Maturity Model Certification
The Cybersecurity Maturity Model Certification program applies to U.S. defense contractors and subcontractors that handle Federal Contract Information, or FCI, and Controlled Unclassified Information, or CUI. CMMC requirements are placed into solicitations and contracts. The model has three levels. Level 1 addresses basic safeguarding of FCI. Level 2 aligns with the 110 security requirements in NIST SP 800-171 Revision 2 for protecting CUI. Level 3 adds selected requirements from NIST SP 800-172 for the most sensitive programs. The implementation status changed on July 13, 2026, when the department suspended Phase II and began a review of the program. CMMC remains in Phase I. During the suspension, new requirements may call only for Level 1 self-assessments or Level 2 self-assessments. The department may also conduct selected government-led assessments. Requirements in DFARS 252.204-7012 for safeguarding covered defense information remain in effect.
Why it matters
Contractors should read each solicitation and contract carefully. They also need to know where FCI and CUI flow and ensure that applicable safeguarding requirements reach subcontractors.
11. General Data Protection Regulation
The European Union’s General Data Protection Regulation, or GDPR, applies to organizations established in the EU. It can also apply to an organization outside the EU when that organization offers goods or services to people in the EU or monitors their behavior there. Holding information about an EU citizen does not by itself establish that GDPR applies. GDPR requires technical and organizational measures appropriate to the risk. It also supports principles such as data minimization and data protection by design. When a personal data breach occurs, a controller generally must notify the relevant supervisory authority within 72 hours of becoming aware of it. Notification is not required when the breach is unlikely to create a risk to people’s rights and freedoms. For the most serious infringements, fines can reach EUR 20 million or 4 percent of total worldwide annual turnover from the preceding financial year, whichever is higher.
Why it matters
Organizations need to know what personal data they process, where it goes, which processors and subprocessors handle it, and who will make time-sensitive breach decisions.
12. Digital Operational Resilience Act
The EU’s Digital Operational Resilience Act, or DORA, has applied since January 17, 2025. It sets common digital operational resilience requirements for financial entities within its scope. DORA covers ICT risk management, incident reporting, resilience testing, and third-party risk. Financial entities must maintain a Register of Information for contractual arrangements with ICT providers. They also need to perform due diligence, address concentration and dependency risk, include required terms in relevant contracts, and conduct threat-led penetration testing when the rules apply to them. The framework also creates an EU oversight regime for ICT providers designated as critical.
Why it matters
A financial entity remains accountable for resilience when an important service is outsourced. It needs a reliable view of critical providers, subcontracting arrangements, concentrations, incidents, and exit plans.
13. NIS2 Directive
The NIS2 Directive establishes a common cybersecurity baseline across 18 critical sectors in the EU. Member states were required to transpose it into national law by October 17, 2024. Registration, supervision, enforcement, and some scope details depend on each country’s implementing law. NIS2 distinguishes between essential and important entities based on factors such as sector, size, and critical role. Required measures cover incident handling, business continuity, supply chain security, vulnerability handling, access control, encryption, and multifactor authentication where appropriate. Management bodies must approve and oversee cybersecurity risk measures, and their members must receive training. A significant incident generally triggers an early warning within 24 hours, an incident notification within 72 hours, and a final report within one month of that notification. For financial entities, DORA takes precedence where its sector-specific requirements overlap with NIS2.
Why it matters
NIS2 makes cyber risk a leadership responsibility and gives organizations little time to report significant incidents. Companies should confirm their status under each relevant national law and test their reporting process before an incident occurs.
How to choose and use the right cybersecurity frameworks
1. Start with scope
Identify the laws, sector rules, contracts, customer commitments, data types, and locations that apply to the organization. This establishes which requirements are mandatory and which frameworks could help organize the work.
2. Choose a core structure
NIST CSF 2.0 or an ISO/IEC 27001 ISMS can provide the backbone for governance and risk management. A more detailed control set, such as the CIS Controls or NIST SP 800-53, can guide implementation.
3. Map obligations to shared controls
One well-designed control may support several requirements. A central mapping shows where evidence can be reused and where a regulation requires something unique.
4. Test and monitor
Policies and diagrams describe intended controls. Technical testing, internal review, independent assessment, and ongoing monitoring show whether those controls work and whether the environment has changed.
5. Report what matters
Leadership needs a clear view of material exposure, business impact, ownership, deadlines, and progress. A long compliance checklist is much less useful when it does not show where action is needed.
The real goal is defensible, continuous risk management
Frameworks, certifications, and reports provide valuable structure and evidence. Each also has a defined scope and a point-in-time or period-of-time boundary. Meanwhile, assets, cloud services, vulnerabilities, suppliers, and threats keep changing. The practical challenge is to connect written requirements with the systems and relationships that create exposure. A defensible program can show what applies, what is in scope, which controls address the risk, whether those controls work, and how the organization responds when conditions change.
How Bitsight helps
Bitsight adds an outside-in view of cyber risk to the internal evidence an organization already collects. That evidence can help teams see changes between formal assessments and focus their follow-up work. Bitsight does not certify compliance or replace legal advice, audits, regulator-required assessments, or internal control testing.
See the external attack surface
Bitsight External Attack Surface Management helps organizations discover internet-facing assets, identify externally observable exposures, and prioritize vulnerabilities. This can reveal assets or issues that are missing from internal inventories and help teams direct remediation to the places that need attention.
Monitor third-party risk
Bitsight Third-Party Risk Management provides ongoing external insight into vendors and their broader technology relationships. Risk teams can use it to identify changes between scheduled reviews, investigate emerging vulnerabilities, and decide which vendors require faster follow-up.
Prioritize action and explain progress
Consistent metrics, benchmarks, exposure data, and historical trends can help teams decide where limited resources will have the greatest effect. They can also make reporting clearer by showing leaders what changed, what improved, and what still requires action. The result is a stronger connection between framework requirements and day-to-day risk decisions. The framework defines the outcomes and obligations. Continuous evidence helps the organization see where exposure is changing and respond sooner.
