cybersecurity-compliance
Cybersecurity Compliance
Disclaimer: This skill provides general educational information about legal topics relevant to software development. It is not legal advice. Laws vary by jurisdiction and change frequently. Always consult a qualified attorney licensed in the relevant jurisdiction before making legal decisions for your organization.
Overview
Cybersecurity is no longer just a technical concern — it is a regulated activity. Mandatory incident reporting, board-level accountability, and third-party risk requirements are expanding globally. Organizations that experience a cyber incident face not only the technical challenge of response and recovery but also a complex web of legal obligations with strict timelines. Failure to comply with these obligations can result in penalties that compound the damage of the underlying incident. Understanding your reporting obligations, certification requirements, and insurance coverage before an incident occurs is essential.
Cybersecurity Regulations
| Regulation | Jurisdiction | Scope | Key Requirements | Effective |
|---|---|---|---|---|
| NIS2 Directive | EU | Essential + important entities across 18 sectors | Risk management measures, 24hr incident reporting, supply chain security, board accountability | October 2024 |
| DORA | EU | Financial entities + ICT providers | ICT risk management, incident reporting, resilience testing, third-party risk management | January 2025 |
| SEC Cyber Disclosure Rules | US | Public companies | Material incident disclosure within 4 business days on Form 8-K, annual risk management disclosure | December 2023 |
| CISA Incident Reporting (CIRCIA) | US | Critical infrastructure | 72hr incident reporting, 24hr ransomware payment reporting | Rules being finalized |
| State Breach Notification Laws | US (all 50 states) | Organizations with residents' data | Notification to affected individuals + state AG within specified timeframes | Varies by state — some as short as 30 days |
| PSTI Act | UK | Consumer IoT devices | No default passwords, vulnerability disclosure policy, defined support period | April 2024 |
| CER Directive | EU | Critical entities | Risk assessment, resilience measures, incident notification | October 2024 |