Getting Started and Choosing a Provider
Cybersecurity Compliance Requirements by Industry: HIPAA, PCI DSS, FTC Safeguards, CMMC and SOC 2
A plain-English overview of the main US cybersecurity rules and frameworks that affect businesses, who each applies to, what they require and when to bring in a professional.
Which cybersecurity rules apply to your business depends mainly on the type of data you handle and who your customers are. Health data points to HIPAA, card payments to PCI DSS, certain financial and tax-related businesses to the FTC Safeguards Rule, defense contractors to CMMC, and enterprise customers often request SOC 2 even when no law demands it. All states also have breach notification laws. This guide summarizes each in plain language so you know which questions to ask a provider. It is general information, not legal advice.
Quick map: who is affected
| Framework or rule | Who it typically applies to | Nature |
|---|---|---|
| HIPAA Security Rule | Healthcare providers, health plans, clearinghouses and their business associates | Federal regulation |
| PCI DSS | Any business that accepts, stores, processes or transmits payment card data | Industry standard enforced through card brands and acquirers |
| FTC Safeguards Rule | Non-bank financial institutions under FTC jurisdiction, such as certain lenders, tax preparers and dealers | Federal regulation under the Gramm-Leach-Bliley Act |
| CMMC / NIST SP 800-171 | Defense contractors handling controlled unclassified information | Contractual and regulatory program |
| SOC 2 | Service providers whose customers demand independent assurance | Voluntary attestation by a CPA firm |
| State breach notification laws | Businesses holding residents' personal information | State law, all 50 states |
| State privacy and security laws | Depends on state and thresholds, for example California and others | State law |
HIPAA Security Rule
HIPAA applies to covered entities and their business associates, including many vendors that touch protected health information. The Security Rule requires administrative, physical and technical safeguards, including a documented security risk analysis, access controls, audit controls, workforce training and contingency planning. There is no official "HIPAA certification," so be wary of anyone selling one. The HHS Office for Civil Rights enforces the rule and publishes guidance. If you are a vendor to a health provider, you will probably sign a business associate agreement.
PCI DSS
The Payment Card Industry Data Security Standard is maintained by the PCI Security Standards Council. Requirements and validation depend on how many transactions you process and how you handle card data. Businesses that use a fully outsourced, compliant payment processor and never touch card data can often reduce their scope substantially, typically through a self-assessment questionnaire. PCI DSS version 4.0 replaced version 3.2.1, and the Council published a minor update, 4.0.1; check the Council's site for current dates and requirements. Your merchant bank or processor tells you what validation you must submit.
FTC Safeguards Rule
Under the Gramm-Leach-Bliley Act, the FTC's Safeguards Rule requires covered financial institutions to maintain a written information security program. Amended requirements include elements such as a designated qualified individual, a written risk assessment, access controls, encryption of customer information, multi-factor authentication, monitoring or testing, training and an incident response plan. Certain notification requirements to the FTC after specified events were added in later amendments. The FTC publishes a compliance guide for businesses; consult it and an attorney to confirm that you are covered and which exceptions apply.
CMMC and NIST SP 800-171
Companies in the defense supply chain that handle controlled unclassified information must meet requirements based on NIST SP 800-171, and the Department of Defense's CMMC program adds assessment requirements, with levels depending on the type of information. The program has been phased in through rulemaking, so rely on the Department of Defense CIO website and your contracting officer for current dates, levels and what your contracts require. Subcontractors are often asked to meet requirements flowed down by the prime contractor.
SOC 2
SOC 2 reports are issued by independent CPA firms under AICPA standards, evaluating controls against Trust Services Criteria such as security, availability, confidentiality, processing integrity and privacy. Type I examines design at a point in time; Type II examines operation over a period. SOC 2 is not a law. Companies pursue it because customers ask for assurance, and a provider can prepare you but cannot issue the report.
State laws
All 50 states, the District of Columbia and U.S. territories have data breach notification laws. They differ on definitions of personal information, notification deadlines, regulator notification and penalties. Some states, such as New York with its SHIELD Act, impose reasonable security requirements, and several states have comprehensive consumer privacy laws with thresholds that may or may not reach small businesses. Because these rules vary by where your customers live, not just where you are located, an attorney can help map your exposure.
Compliance versus security
Passing an audit does not mean you are secure, and a strong security program does not automatically satisfy a specific framework's documentation requirements. The best approach is to build real controls first, then document and evidence them. NIST's Cybersecurity Framework 2.0 is a widely used way to organize a program, and many frameworks map to it.
How to use this when talking to providers
- State which frameworks or contracts apply to you, and where the requirement comes from.
- Ask whether the provider has done similar work and can show an example deliverable, with confidential details removed.
- Clarify who is responsible for what: policies, technical controls, evidence collection, audit scheduling.
- Confirm costs for the audit or assessment itself, which are usually separate from consulting fees.
- Ask how they keep up with changes to rules and standards.
See choosing the right provider and timeline: what to expect.
When to consult a professional
Use an attorney for questions about legal applicability, contractual liability and notification duties. Use a qualified assessor or auditor for formal attestations. Use your insurance broker for how compliance interacts with coverage.
Frequently asked questions
Do small businesses have to comply with these?
Size alone does not decide it. The data you handle and your contracts do. Some rules have exceptions for small entities, so check the rule text or ask an attorney.
Can one program satisfy several frameworks?
Often there is overlap in controls such as MFA, access control, logging and incident response, so a well-organized program can support several frameworks, though each has unique documentation requirements.
What are the penalties for non-compliance?
They vary by rule and can include regulatory fines, contract loss and liability. Check the specific regulator's guidance.
Where can I find the official text?
Use the regulators' own sites listed below rather than summaries from vendors.
Sources
- U.S. Department of Health and Human Services — HIPAA Security Rule
- PCI Security Standards Council — PCI DSS
- Federal Trade Commission — Safeguards Rule guidance
- DoD CIO — CMMC program
- AICPA — SOC 2
