Directory
Short, plain descriptions of every framework, standard, and body referenced in TrebSec reporting, each with a direct link to its official website. Search by name, or filter by type.
Law and Regulation
The Health Insurance Portability and Accountability Act sets U.S. national standards for protecting sensitive patient health information. Its Privacy, Security, and Breach Notification Rules are enforced by the HHS Office for Civil Rights, which investigates breaches and complaints and can impose corrective action plans and civil money penalties.
Official website: U.S. Department of Health and Human Services, HIPAA homeDiscipline and Practice
GRC is the integrated discipline of governance, risk management, and compliance: how an organization directs itself, handles uncertainty, and proves it follows its obligations. OCEG, the nonprofit that coined the term, publishes the GRC Capability Model and professional certifications used by practitioners worldwide.
Official website: OCEG, the organization that created GRCLaw and Regulation
The New York State Department of Financial Services regulates banks, insurers, and other financial services firms operating in New York. Its Cybersecurity Regulation, 23 NYCRR Part 500, was the first U.S. state cybersecurity rule for financial services and requires covered entities to maintain a risk-based cybersecurity program, appoint a CISO, and certify compliance annually.
Official website: New York State Department of Financial ServicesFramework and Standard
The National Institute of Standards and Technology is the U.S. federal agency that publishes widely adopted security standards, including the Cybersecurity Framework 2.0 and the SP 800 series of controls guidance. NIST publications are voluntary for most private organizations and mandatory across much of the federal government, and they anchor many other compliance programs.
Official website: NIST Cybersecurity FrameworkAgency and Program
The Cybersecurity and Infrastructure Security Agency is the U.S. federal agency charged with defending civilian government networks and critical infrastructure. CISA maintains the Known Exploited Vulnerabilities catalog, issues binding operational directives for federal agencies, and publishes joint advisories with the FBI, NSA, and international partners.
Official website: Cybersecurity and Infrastructure Security AgencyAgency and Program
The National Security Agency is the U.S. intelligence agency for signals intelligence and information assurance. Its cybersecurity mission focuses on preventing and eradicating threats to national security systems and the defense industrial base, and it co-authors public guidance and advisories through its Cybersecurity Collaboration Center.
Official website: National Security AgencyLaw and Regulation
The Gramm-Leach-Bliley Act requires financial institutions to explain their information-sharing practices and to safeguard sensitive customer data. The FTC Safeguards Rule turns that duty into a concrete program: a written risk assessment, a designated qualified individual, access controls, encryption, multifactor authentication, testing, vendor oversight, and a written incident response plan.
Official website: Federal Trade Commission, Gramm-Leach-Bliley ActAgency and Program
CMMC is the U.S. Department of Defense program that verifies defense contractors protect Federal Contract Information and Controlled Unclassified Information. It builds on NIST SP 800-171, is applied through contracts under DFARS clause 252.204-7012, and phases in assessment requirements from self-assessment up to third-party certification.
Official website: Department of Defense CIO, About CMMCFramework and Standard
The Payment Card Industry Data Security Standard is the global baseline for protecting payment card data, maintained by the PCI Security Standards Council, which the major card brands founded. Any organization that stores, processes, or transmits cardholder data is expected to meet its controls, with validation duties that scale with transaction volume.
Official website: PCI Security Standards CouncilAgency and Program
The U.S. Securities and Exchange Commission regulates securities markets and protects investors. Its cybersecurity rules require public companies to disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and to describe their cyber risk management, strategy, and governance in annual reports.
Official website: U.S. Securities and Exchange CommissionAgency and Program
The Federal Bureau of Investigation is the lead U.S. federal agency for investigating cyber crime. Its Internet Crime Complaint Center, IC3, is the central public hub for reporting cyber-enabled crime, and the Bureau co-authors the #StopRansomware advisory series and annual internet crime reports that quantify reported losses.
Official website: FBI Internet Crime Complaint Center (IC3)Vendor Security Program
Microsoft publishes security updates for Windows, Office, Azure, and its other products on a monthly Patch Tuesday cycle, coordinated through the Microsoft Security Response Center (MSRC). Because Microsoft software runs in most enterprises, its advisories, severity ratings, and exploitation assessments drive patching priorities worldwide.
Official website: Microsoft SecurityFramework and Standard
MITRE ATT&CK is a globally accessible, free knowledge base of adversary tactics and techniques drawn from real-world observations. Security teams use it to model threats, map detections, and speak a common language about attacker behavior, and U.S. government advisories routinely map threat activity to ATT&CK techniques.
Official website: MITRE ATT&CKFramework and Standard
ISO/IEC 27001 is the world's best-known standard for information security management systems. It sets the requirements for establishing, implementing, maintaining, and continually improving an ISMS, and organizations can be certified against it by accredited bodies to demonstrate disciplined, risk-based security management.
Official website: ISO, ISO/IEC 27001:2022Framework and Standard
ISO/IEC 27002 is the companion guidance to ISO/IEC 27001. It provides detailed best-practice controls and implementation advice across organizational, people, physical, and technological themes, and it cannot be certified against directly; it is the practical blueprint behind a 27001 management system.
Official website: ISO, ISO/IEC 27002:2022Framework and Standard
The NIST AI Risk Management Framework is a voluntary framework for managing risks to individuals, organizations, and society from artificial intelligence systems. Organized around the Govern, Map, Measure, and Manage functions, it helps organizations incorporate trustworthiness into the design, development, use, and evaluation of AI products and services.
Official website: NIST AI Risk Management FrameworkLaw and Regulation
The General Data Protection Regulation is the European Union's comprehensive data protection law, in force since 2018. It governs how organizations collect and process personal data, grants individuals enforceable rights over their data, and allows fines up to EUR 20 million or 4 percent of worldwide annual turnover; the European Data Protection Board coordinates its enforcement across member states.
Official website: European Data Protection BoardLaw and Regulation
The Digital Operational Resilience Act is the EU regulation that harmonizes digital resilience rules for the financial sector. It sets requirements for ICT risk management, incident reporting, resilience testing, and third-party risk, and it places critical ICT providers to financial entities under direct EU-level oversight.
Official website: EIOPA, Digital Operational Resilience Act